ERR_BLOCKED_BY_RESPONSE, what it means and how to fix it

The server replied, and in the same reply instructed the browser not to show it in this context. This happens when a page is loaded inside a frame or embed and the site's headers (X-Frame-Options set to DENY or SAMEORIGIN, a Content-Security-Policy with frame-ancestors, or a Cross-Origin-Resource-Policy) forbid framing by other sites. It is standard clickjacking protection doing its job, usually discovered by whoever built the embedding page.

The fix, in order

  1. Open the page directly instead of embedded. If you met this in a preview, a reader app, or a site that frames other sites, visit the address in its own tab. Framing is what is blocked; the page itself works.
  2. If you run the embedding page, the fix is not in your markup: the embedded site has opted out of being framed. Link out to it, use its official embed or API if it offers one, or ask the operator to allowlist your origin in its frame-ancestors policy.
  3. If you run the blocked site and framing should be allowed, adjust the headers: set CSP frame-ancestors to list the origins allowed to embed you, or relax X-Frame-Options from DENY to SAMEORIGIN only if same-origin framing covers the use case. Keep the list as narrow as the actual need.
  4. For Cross-Origin-Resource-Policy blocks, the resource's own Cross-Origin-Resource-Policy: same-origin header is refusing cross-origin use; serve public assets with cross-origin or from a CDN path that does.

If it still happens

A resource that suddenly starts blocking embeds after a server or framework update usually gained these headers from a new default in the framework or a security plugin. The headers are visible in the browser's network panel on the response itself, which names exactly which policy fired.

Common questions

Is ERR_BLOCKED_BY_RESPONSE the same as a 403? No. A 403 means the server refused to serve the content to you at all. Blocked by response means the server served it, with instructions that the browser must not display it in this particular context, typically inside another site's frame.

Can I disable this protection as a visitor? No, and there is nothing to gain by it: the restriction protects the site's users from clickjacking. As a visitor the remedy is simply to open the page directly rather than through a frame.

Related errors

ERR_BLOCKED_BY_CLIENT · ERR_UNKNOWN_URL_SCHEME · 403 Forbidden