How to render a widget only on the domain for which it is created

Question

I have a widget (built with PHP on an Apache webserver) that is embedded on webpages of other sites.

I'd like to render the widget only on pages for which the widget was built.

For example, if the widget is for site example-a.com and it is embedded on domain example-b.com, I want it is not shown on example-b.com. Is it possible to do something like this?

Maybe using http_referer I can solve the problem?

To embed the widget I use an iframe , but I'm not sure the http_referer isn't hackable.

The iframe is something like this:

<iframe id="WidgetContent" src="http://127.0.0.1:8000/widget/1" frameborder="0" height="600"></iframe>

So no javascript is used.

Any advices on this? Thank you!

Answer 1

您可以使用X-Frame-Options HTTP 响应标头指定允许哪些站点在框架中显示页面。

X-Frame-Options: http://example-a.com