Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I'm trying to embed a public page from a Force.com site in an iframe on a public website. The page works as expected when I load it in its own tab, but doesn't load in the iframe -- instead, I get the following error:

Refused to display 'https://DOMAIN.cs9.force.com/PREFIX/PAGE' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

This question implies that you can turn off same-origin policy checking on Visualforce pages by disabling click-jack protection, but I have already turned off click-jack protection and am still seeing this error.

enter image description here

Any tips or suggestions?

share|improve this question

1 Answer 1

Force.com Sites have click-jack settings set up on a per-site basis. You need to change yours to "Allow framing by any page (no protection)"

  1. Go to Salesforce Setup > Develop > Sites
  2. Click "Edit" next to your Site
  3. Change the "Clickjack Protection Level"

enter image description here

share|improve this answer
    
Thanks a lot for this, very useful! –  codeulike yesterday

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.