title: Mistakes in .htaccess file, trying to overwrite HTTP header settings
body: <p>I have a SFTP access to a web space with these settings:</p>
  <pre><code>HTTP/1.1 200 OK
  server: Apache
  accept-ranges: bytes
  content-length: 7864
  x-frame-options: sameorigin
  content-security-policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' *.mydomain.com; font-src 'self' *.mydomain.com
  content-type: text/html; charset=utf-8
  strict-transport-security: max-age=31536000; includeSubDomains
  </code></pre>
  <p>On this web space, I uploaded a web page (HTML and CSS only, with OTF fonts). Now, I want to embed this web page as <code>iframe</code> on another website.</p>
  <p>Currently, it doesn't work because of CORS. Because I have no access to the server settings, I would like to do it with the <code>.htaccess</code> file.</p>
  <p>I read <a href="https://www.a2hosting.com/kb/developer-corner/apache-web-server/modifying-http-headers" rel="nofollow noreferrer">this</a> article, and thought about creating a <code>.htaccess</code> file with a content like this:</p>
  <pre><code>X-Frame-Options: allow-from https://the-page-with-my-iframe.com/
  Content-Security-Policy: no-restrictions
  </code></pre>
  <p>How is it possible to write that correctly?</p>
  <p>Would be very thankful for help!</p>
  <p>&lt;3</p>