There are a couple reasons why your iframe might be blocked:
1) Security Headers
By default, Sucuri Firewall enables the “Additional Security Headers” option on the Security tab to add recommended security headers to your site and protect you against some forms of XSS and clickjacking attacks. However, this option might block external source iframes.
To solve this problem, you need to deselect the “Additional Security Headers added to your site” option on the Security tab of the Firewall dashboard.
2) Mixed Content Issue
If you try to iframe a page or file using HTTP on an HTTPS page, it won’t work. The iframe must be HTTPS as well. You can read more about mixed content warnings here.
3) PHP Iframe
When possible, use require(), include(), or require_once() functions instead of iframing for PHP files. If unable to use an alternative method, you may need to allow the PHP file due to the backdoor filter.
If your iframe still doesn’t work after following these steps and waiting a couple minutes, please open a support ticket so we can investigate further.