Index: src/wp-includes/class-wp-customize-manager.php
===================================================================
--- src/wp-includes/class-wp-customize-manager.php	(revision 42984)
+++ src/wp-includes/class-wp-customize-manager.php	(working copy)
@@ -1895,9 +1895,8 @@
 	 * @return array Headers.
 	 */
 	public function filter_iframe_security_headers( $headers ) {
-		$customize_url                      = admin_url( 'customize.php' );
-		$headers['X-Frame-Options']         = 'ALLOW-FROM ' . $customize_url;
-		$headers['Content-Security-Policy'] = 'frame-ancestors ' . preg_replace( '#^(\w+://[^/]+).+?$#', '$1', $customize_url );
+		$headers['X-Frame-Options']         = 'SAMEORIGIN';
+		$headers['Content-Security-Policy'] = "frame-ancestors 'self'";
 		return $headers;
 	}
 
Index: tests/phpunit/tests/customize/manager.php
===================================================================
--- tests/phpunit/tests/customize/manager.php	(revision 42984)
+++ tests/phpunit/tests/customize/manager.php	(working copy)
@@ -846,15 +846,16 @@
 	 * Test WP_Customize_Manager::filter_iframe_security_headers().
 	 *
 	 * @ticket 30937
+	 * @ticket 40020
 	 * @covers WP_Customize_Manager::filter_iframe_security_headers()
 	 */
 	function test_filter_iframe_security_headers() {
-		$customize_url = admin_url( 'customize.php' );
 		$wp_customize  = new WP_Customize_Manager();
 		$headers       = $wp_customize->filter_iframe_security_headers( array() );
 		$this->assertArrayHasKey( 'X-Frame-Options', $headers );
 		$this->assertArrayHasKey( 'Content-Security-Policy', $headers );
-		$this->assertEquals( "ALLOW-FROM $customize_url", $headers['X-Frame-Options'] );
+		$this->assertEquals( 'SAMEORIGIN', $headers['X-Frame-Options'] );
+		$this->assertEquals( "frame-ancestors 'self'", $headers['Content-Security-Policy'] );
 	}
 
 	/**