Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to embed a public page from a site in an iframe on a public website. The page works as expected when I load it in its own tab, but doesn't load in the iframe -- instead, I get the following error:

Refused to display '' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

This question implies that you can turn off same-origin policy checking on Visualforce pages by disabling click-jack protection, but I have already turned off click-jack protection and am still seeing this error.

enter image description here

Any tips or suggestions?

share|improve this question Sites have click-jack settings set up on a per-site basis. You need to change yours to "Allow framing by any page (no protection)"

  1. Go to Salesforce Setup > Develop > Sites
  2. Click "Edit" next to your Site
  3. Change the "Clickjack Protection Level"

enter image description here

share|improve this answer
Thanks a lot for this, very useful! – codeulike Oct 22 '14 at 14:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.