Allowing iframes from a shared hosting server

Shared Hosting Providers

Website security is a very important thing these days.  There are lots of reasons to refuse sites from embedding your site via iframe or embed tag.  However if you have or are purchasing a paid for services like an intranet and you don't want to re-write everything to work with that services JavaScript library and security policy, an embed or iframe may just be what you need to use.  

By default, most of the shared webhosts I've used allow configuration with a .htaccess file.  Now I do recommend going though and assessing what you need to setup for your site to get done what you need to get done security wise; but in this case I need to allow for iframes from an igloo intranet site.

Typically if you have experience in setting up something like apache, you would use the x-frame header to do this; however this has changed for modern browsers, and while you may still need to add the x-frame for some legacy browsers, I'm going to be focusing on edge, chrome and firefox.

On igloo I have a embed tag, with the source going to a website which I have on a shared host.  I have a sample that can be seen below.  By default the shared hosting provider refuses the iframe connection by default.

<embed type="text/html" src="https://websiteIcontrol.ca" width="500" height="200">

On your host, edit your .htaccess file and find your mod_headers.c by default it should be something link this below.

## Suppress mime type detection in browsers for unknown types

<IfModule mod_headers.c>

Header always set X-Content-Type-Options "nosniff"

</IfModule>

We want to add the following (the one highlighted in green).

## Suppress mime type detection in browsers for unknown types

<IfModule mod_headers.c>

Header always set X-Content-Type-Options "nosniff"

Header set Content-Security-Policy: frame-ancestors 'self' https://websiteIcontrol.ca

</IfModule>

Once you add that and save the .htaccess file and when you refresh you page on igloo your iframe/embed will show up in igloo. as shown below.

For more information please refer to the links below for more information about .htaccess, x-frames and content-security policy.

https://htaccessbook.com/

https://htaccessbook.com/important-security-headers/#xframe

Migrating a website to shopify, while keeping your email working

Recently a site I was hosting on my shared host decided to move their online presence off Joomla to the shopify platform.  The website was originally on a shared host; which is fine but when the site was moved to shopify, I was asked to update the A and cname records for the domain to the shopify ip and url.

My host on CPANEL when you setup a domain, puts in a bunch of default settings for the domain, as they should.  Here is a sample of a default setup.

This client is forwarding domain emails to a gmail account, they don't have google apps or anything like that and it isn't required for them.  So when I updated one mx record pointing to my main a record and when I updated the A record to point to the new IP and change the cnames to point to shops.myshopify.com, my client being unaware that shopify doesn't provided email service email just stopped working because the mx record was pointing to the main A record.  This caused all email pointing to domain.ca to stop which was being forwarded by the server to a web email service.

The solution was to make a new A record with the old ip address in this case making a name record mail.domain.ca A = sharedhost IP and putting a new cname domain.ca MX = mail.domain.ca

Now you can see here I removed the mail.domain.ca cname record I felt it was redundant but if I have problems I can always put it back in especially since the mail.domain.ca was not being used.  I do have to setup DMARC but that is something else that I'm not doing at the moment.