I have several new SS installations that all have the same issue: the page previews are blank. Installation details: SS 3.5 and 3.6 installed using Composer; Ubuntu 16.04 (on an Amazon EC2 instance); PostgreSQL DBMS. Is this a permissions issue? I've chowned the files to root:www-data and chmodded files to 664 and directories to 775.
It turns out that iframes were being blocked by my web server. The relevant Apache2 default is the X-Frame-Options response header, which is set in the ssl-params.conf file (Debian/Ubuntu installation). The directive "Header always set X-Frame-Options DENY" prevents rendering of iframes. Changing this to "Header always set X-Frame-Options SAMEORIGIN" allows iframes from the same site to load content.