This explains why that is in violation of a security measure Calling ERPNext in iframe from WordPress - #10 by revant_one