It sounds like the webserver configuration is adding x-frame-options headers despite Moodle's configuration. You should be able to confirm that in the network tab of your browser's developer tools.
How to get rid of those depends on the web server you're using.
How to get rid of those depends on the web server you're using.
(And if you don't see those headers, the linked page has a link to content-security-policy header documentation that would be the next place to look.)