diff --git a/app.js b/app.js
index e84eb4b79..dd58e9883 100644
--- a/app.js
+++ b/app.js
@@ -22,7 +22,10 @@ if (app.get('env') !== 'test') {
 //==============================================================================
 
 app.set('trust proxy', 1);
-app.use(helmet());
+// We disable frameward on helmet to allow crossdomain injection of the embed
+app.use(helmet({
+  frameguard: false
+}));
 app.use(bodyParser.json());
 app.use('/client', express.static(path.join(__dirname, 'dist')));
 app.set('views', path.join(__dirname, 'views'));