Uncaught DOMException: Permission denied to access property "hostname" on cross-origin object

It seems that adding the class "seckit-clickjacking-no-body" to the Page body inside the Webform's share settings was all I needed.

I've realized that the solution I found and mentioned in my previous comment is just a workaround. The actual issue still remains as the external site cannot see the top.location.hostname from seckit.document_write.js.