WordPress网站运行于iframe中，寻求原因排查技术帮助

Hey there, let’s figure out why your WordPress site is stuck loading inside an iframe—this is a common issue with a handful of possible causes, so let’s go through them one by one:

• Check your active theme
  Themes can sometimes include iframe code in their template files (like header.php or index.php) either by design or due to customization. First, switch to a default WordPress theme (e.g., Twenty Twenty-Four) and see if the problem goes away. If it does, dive into your original theme’s files (via FTP or the WordPress Theme Editor) to hunt for any unexpected <iframe> tags or functions that force embedding.

• Rule out plugin conflicts
  Plugins are often the culprit here—especially security plugins, caching tools, or any plugin that handles embedding/iframe functionality. Try disabling all plugins at once, then re-enable them one by one, checking your site after each reactivation. The plugin that brings back the iframe issue is the one you need to investigate further (update it, check its settings, or replace it with an alternative).

• Inspect your .htaccess file
  Some server-level rules in .htaccess can inadvertently force your site into an iframe. First, make a backup of your current .htaccess file, then replace it with the default WordPress .htaccess code:

  # BEGIN WordPress
  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /
  RewriteRule ^index\.php$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
  </IfModule>
  # END WordPress
  

  Save the file and refresh your site—if the iframe is gone, your original .htaccess had problematic rules that need fixing.

• Check your hosting/CDN settings
  Some web hosts or CDN providers offer features that wrap your site in an iframe for security (e.g., DDoS protection) or embedding purposes. Log into your hosting control panel or CDN dashboard and look for settings related to "iframe embedding," "site shielding," or similar options—toggle them off to test.

• Scan for malicious code
  If none of the above works, your site might have been compromised by malware that injects iframe code. Use a WordPress security plugin like Wordfence or Sucuri to run a full scan. You can also manually check key files like wp-config.php, header.php, and functions.php for suspicious code (random <iframe> tags, unknown PHP includes, or base64-encoded scripts).

• Verify page-specific settings
  It’s possible only certain pages are affected. Edit the problematic page(s) in WordPress and check the content editor for any accidental iframe shortcodes or embedded <iframe> tags. Also, look for page-specific settings in your theme or page builder that might enable iframe embedding.

If you’ve tried all these steps and still can’t track down the issue, consider reaching out to a WordPress developer or your hosting provider’s support team for deeper troubleshooting.

内容的提问来源于stack exchange，提问作者user1404963