What is globally adding an "x-frame-options: deny" header?
<p>I have a client who uses ColdFusion 10 and IIS 7.5 on Win 2k3 R2. The ColdFusion admin uses frames. When I log into the CF admin I'm seeing a blank white screen in Chrome and in IE I am seeing a message telling me this:</p>

<blockquote>
  <p>This content cannot be displayed in a frame</p>
  
  <p>To help protect the security of information you enter into this website, the publisher of this content does not allow it to be displayed in a frame.</p>
</blockquote>

<p>I see a few of this message (1 for each frame) in the chrome dev console:</p>

<blockquote>
  <p>Refused to display '<a href="http://localhost/CFIDE/Administrator/navserver.cfm" rel="nofollow">http://localhost/CFIDE/Administrator/navserver.cfm</a>' in a frame because it set 'X-Frame-Options' to 'DENY'.</p>
</blockquote>

<p>Looking at the response headers in Chrome, I can see that this is set to DENY.</p>

<p>I can't figure out where this is coming from. All of the sites on this server now are outputting this header. I never explicitly configured anything to output this header. I know CF wouldn't have done so in a patch because it would break its own admin interface. </p>

<p>IIS's root server-wide configuration HTTP Response Headers doesn't have a X-Frame-Options set and neither do any of the configured websites. </p>

<p>If I explicitly add an X-Frame-Options header and set it to sameorigin I see <em>both</em> headers (deny and sameorigin).</p>

<p>Is there perhaps some software the client's security team might have installed that would be injecting this header?</p>

<p>I'm accessing the site on localhost so I can't imagine that it's a network device causing the problem. It must be on the server itself, right?</p>

<p>Any ideas?</p>