know this has been asked a fair bit but can't find a solution which works for me.

Trying to put an i-frame of our website on a different domain and am getting this error in the browser:

Refused to display 'my-site' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

I have a Passenger server with a Nginx configuration. My site is https and the certificate is from Let's Encrypt Authority X3. It's a ruby on rails app.

I would like to override this setting. I have grep'ed all the files looking for where X-Frame Options has been set but can't find it anywhere - where is it coming from and how can I remove it?

Things i've tried:

• I have tried setting add_header X-Frame-Options ALLOWALL always in etc/nginx/sites-enabled - i get the following error in the browser: Refused to display 'my-site' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('SAMEORIGIN, ALLOWALL'). Falling back to 'deny'.
• I've also tried add_header X-Frame-Options "" always;
• I've looked for an SSL config file inside the snippets folder but there doesn't seem to be one.