Is this your game?
Make it playable right here on Gamesdle. Copy this prompt into your AI coding agent (Claude Code, Cursor, Copilot and the like), or send it to whoever runs the site.
My web game at https://choicervoicer.games/ needs to be playable inside an iframe on https://gamesdle.bid (a directory of daily games that embeds games in its page).
The response headers already allow framing, but the game does not load or stops working inside the frame.
Please make these changes, keeping everything else about the site the same:
1. Send this on every HTML response (merge it into the existing Content-Security-Policy if there is one; keep any other origins that are already allowed):
Content-Security-Policy: frame-ancestors 'self' https://gamesdle.bid
2. Remove the X-Frame-Options header. It cannot allow one specific outside site, and frame-ancestors replaces it in all current browsers.
3. Find where headers are set. Common places: public/_headers (Cloudflare Pages, Netlify), vercel.json "headers", next.config.js headers(), nuxt/vite server config, nginx add_header, Apache Header set, Express/helmet (frameguard and contentSecurityPolicy.frameAncestors), a Cloudflare Worker or other edge function, or a CDN response-header rule.
4. Search the client code for frame-busting such as `if (top !== self) top.location = ...`, `window.top.location`, or code that hides the page when `window.self !== window.top`, and remove it or allow it to run when the parent is https://gamesdle.bid.
5. Inside a cross-site iframe, browsers may block or partition third-party cookies and storage. If saving progress or signing in depends on cookies, make sure the game still starts and plays without them (localStorage is fine; it is kept separately per embedding site).
When it is deployed, verify with:
curl -sI https://choicervoicer.games/ | grep -iE 'x-frame-options|content-security-policy'
The output should include frame-ancestors with https://gamesdle.bid and no X-Frame-Options DENY or SAMEORIGIN.
