Bypass CSP rules with iframe in Wordpress - wordpress

Question

I want to include an iframe of an other website.
I simply add some HTML in a wordpress page :
<iframe src="https://www.website.com/page.htm" height="2000"></iframe>
It works very well when i'm logged as an admin in wordpress.
But when i try in incognito mode like a normal visitor i can't see the iframe due to CSP protection. I have this errors :
Refused to display 'https://www.website.com/page.htm' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors *.website.com".
about:blank:1 [Report Only] Refused to display 'https://www.website.com/page.htm' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors *.website.com".
So my question is, why it works as an admin and not as a normal visitor ?
How can i make it works in both cases ?
Thanks
Edit with the Headers of both versions
Header when i'm logged as an admin
* General *
Request URL: https://www.website.com/shop.htm/
Request Method: GET
Status Code: 200 OK (from disk cache)
Remote Address: 193.164.196.82:443
Referrer Policy: no-referrer-when-downgrade
* Response Headers *
Cache-Control: public
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors *.website.com; report-uri https://api.website.com/api/csp-report/v1/report/;
Content-Security-Policy-Report-Only: object-src *.website.com; frame-ancestors *.website.com; report-uri https://api.website.com/api/csp-report/v1/report/;
Content-Type: text/html; charset=utf-8
Date: Thu, 05 Mar 2020 11:33:36 GMT
ETag: W/"1eea0-VxHcir7eEw4/DKj9v65JMo5WtVk"
Expires: Thu, 05 Mar 2020 11:43:36 GMT
Vary: Accept-Encoding
X-DataDome: protected
X-Protected-By: Sqreen
* Request Headers *
GET /shop.htm/ HTTP/1.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mainwebsite.com/
Header when i'm not logged
* General *
Request URL: https://www.website.com/shop.htm/
Request Method: GET
Status Code: 200 OK
Remote Address: 193.164.197.82:443
Referrer Policy: no-referrer-when-downgrade
* Response Headers *
Cache-Control: public
Content-Encoding: gzip
Content-Security-Policy: frame-ancestors *.website.com; report-uri https://api.website.com/api/csp-report/v1/report/;
Content-Security-Policy-Report-Only: object-src *.website.com; frame-ancestors *.website.com; report-uri https://api.website.com/api/csp-report/v1/report/;
Content-Type: text/html; charset=utf-8
Date: Thu, 05 Mar 2020 11:13:20 GMT
ETag: W/"1eea0-v04Wc+e633BYpAYDMk+pKbQ2M98"
Expires: Thu, 05 Mar 2020 11:23:19 GMT
Set-Cookie: datadome=OkladZXCp6qUlASDoPL-ilsKk1AqD_IWp4LCaQQvFHI3g4Hg~cA1OMfcUALlb-_mpwd844GnUmTU6QUXMStSPePr5U~3mMOlX8hY_gstZA; Max-Age=31536000; Domain=.website.com; Path=/; SameSite=Lax
Strict-Transport-Security: max-age=15768000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-DataDome: protected
X-Protected-By: Sqreen
* Request Headers *
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7
Connection: keep-alive
Host: www.leboncoin.fr
Referer: https://mainwebsite.com
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36
The big difference seems to be it generates a cookie when i'm not logged as an admin.
Set-Cookie: datadome=OkladZXCp6qUlASDoPL-ilsKk1AqD_IWp4LCaQQvFHI3g4Hg~cA1OMfcUALlb-_mpwd844GnUmTU6QUXMStSPePr5U~3mMOlX8hY_gstZA; Max-Age=31536000; Domain=.website.com; Path=/; SameSite=Lax
Strict-Transport-Security: max-age=15768000