diff --git a/advanced/lighttpd.conf.debian b/advanced/lighttpd.conf.debian
index a58b5a88..8966dc32 100644
--- a/advanced/lighttpd.conf.debian
+++ b/advanced/lighttpd.conf.debian
@@ -92,5 +92,10 @@ $HTTP["url"] =~ "/teleporter\.php$" {
     }
 }
 
+# allow API qr code iframe on settings page
+$HTTP["url"] =~ "/admin/settings\.php$" {
+    setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" )
+}
+
 # Default expire header
 expire.url = ( "" => "access plus 0 seconds" )
diff --git a/advanced/lighttpd.conf.fedora b/advanced/lighttpd.conf.fedora
index ad336a93..6bf9e683 100644
--- a/advanced/lighttpd.conf.fedora
+++ b/advanced/lighttpd.conf.fedora
@@ -100,5 +100,10 @@ $HTTP["url"] =~ "/teleporter\.php$" {
     }
 }
 
+# allow API qr code iframe on settings page
+$HTTP["url"] =~ "/admin/settings\.php$" {
+    setenv.add-response-header = ( "X-Frame-Options" => "SAMEORIGIN" )
+}
+
 # Default expire header
 expire.url = ( "" => "access plus 0 seconds" )