By default, for security reasons, Matomo (Piwik) prevents standard pages and reports to be included in an iframe.
If you try to include Matomo pages as Iframe you will likely get the error
Refused to display ‘https://example.com/’ in a frame because it set ‘X-Frame-Options’ to ‘deny’..
Use Widgets to embed Matomo in an iframe
To include your Matomo Analytics reports in your website or app or dashboard, using an iframe, we recommend you use the “Widgets” feature (Widgetize).
Not recommended: enable iframing Matomo app
The Widgets feature lets you embed in an iframe all Matomo reports. But sometimes you need to let your users also manage Matomo (for example, create new goals, funnels, dimensions, etc.) and you want to embed the Matomo app in an iframe. We don’t recommend embedding the whole Matomo app in an iframe for security reasons.
This is not recommended because:
- it exposes your users to risks of Clickjacking
- if you add a
token_authin the URL, it would then appear in server access logs, and this could include
token_authof admin or super users.
- several people might be using the same “iframe” embed code with the same
token_authwhich would make it impossible to know who did what (since they’d all be logged in as the same user)
But if you really wish to go ahead knowing there are serious security risks, and when existing Widgets are not enough for your needs, you can edit your
config/config.ini.php under the category
[General] add the following line:
If you also wish to enable the “Settings” pages (Manage websites, Users, etc.) to load in an iframe, you can also add the setting:
And if you are using Matomo 4 or above, and want to be able to use token_auths of users with write or admin access with your iframe URLs, you will have to add the setting:
Again, we don’t recommend using these settings, unless you absolutely need to and are aware of the risks.