I am trying to build a simple visualforce page with an iframe.

my page:

    <apex:iframe src="http://my.website.com" scrolling="true" id="theIframe"/>
  • ("my.website.com" is a placeholder name for this question)

i have added the url to the "remote site settings" and checked the "Disable Protocol Security" box. When trying to preview the page i get a blank page and the following errors:

  1. Content Security Policy: Referrer Directive ‘origin-when-cross-origin’ has been deprecated. Please use the Referrer-Policy header instead.

  2. Blocked loading mixed active content “http://my.website.com/

  3. Content Security Policy: Not supporting directive ‘reflected-xss’. Directive and values will be ignored.

Can anyone shed some light on what i need to do next in order to get the iframe to display in my page?

  • You have to set X-Frame-Options in header in the webpages in my.website.com . Salesforce setting won't work. – Saroj Bera Apr 25 '17 at 13:02
  • Adding "Header always unset X-Frame-Options" to the ".htaccess" file in my "public_html" folder did the trick. If you want to add this as an answer i can mark it as correct – RealGigex Apr 25 '17 at 14:39
  • Glad it worked out for you. I have added my comments as an answer. – Saroj Bera Apr 26 '17 at 5:11

This is not an issue with Salesforce platform. You have to set X-Frame-Options in the header in the web pages in my.website.com. Salesforce setting won't work for this issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.