External content won’t load in iframe in Safari

X-Frame-Options: sameorigin

By itself (and in older browsers) this would certainly deny access. However, in compliant browsers you would expect the Content-Security-Policy: header to override this.

Assuming you have control over this external content, have you tried setting this header to:

 X-Frame-Options: allow-from https://example.com

Or

 X-Frame-Options: sameorigin, allow-from https://example.com

(Although Safari may not support the allow-from directive.)

Or, removing this header altogether?

I’m wondering if the issue is related to my WordPress install being located in a subdirectory.

I don’t see how having WordPress installed in a subdirectory would have anything to do with this?