diff --git a/advanced/lighttpd.conf.debian b/advanced/lighttpd.conf.debian
index 8966dc32..37099ad7 100644
--- a/advanced/lighttpd.conf.debian
+++ b/advanced/lighttpd.conf.debian
@@ -93,8 +93,10 @@ $HTTP["url"] =~ "/teleporter\.php$" {
 }
 
 # allow API qr code iframe on settings page
-$HTTP["url"] =~ "/admin/settings\.php$" {
-    setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" )
+$HTTP["url"] =~ "/api_token\.php$" {
+    $HTTP["referer"] =~ "/admin/settings\.php" {
+        setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" )
+    }
 }
 
 # Default expire header
diff --git a/advanced/lighttpd.conf.fedora b/advanced/lighttpd.conf.fedora
index 6bf9e683..f4916422 100644
--- a/advanced/lighttpd.conf.fedora
+++ b/advanced/lighttpd.conf.fedora
@@ -101,8 +101,10 @@ $HTTP["url"] =~ "/teleporter\.php$" {
 }
 
 # allow API qr code iframe on settings page
-$HTTP["url"] =~ "/admin/settings\.php$" {
-    setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" )
+$HTTP["url"] =~ "/api_token\.php$" {
+    $HTTP["referer"] =~ "/admin/settings\.php" {
+        setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" )
+    }
 }
 
 # Default expire header