My problem is that I cannot view an image loaded from an external site into an img tag in my lightning component. The URL is with 'http' protocol not 'https', but when I see the Chrome Console, it tells that failed to load resource and I noticed that Salesforce try to go to the external site with the 'https' protocol and so it not find the resource. Why all this happens?

4 Answers 4


Try going to settings > search for Remote Site Settings, click New Remote Site > Give it a Name, type in the FULL URL of the image including the 'http://' BE SURE to check the box: Disable Protocol Security since this is not an 'https', make it active and try your image then Good luck!

  • I have several images to show. Can I only add the domain to the whitelist? Why you say to add the full URL?
    – CRK
    Commented Oct 12, 2018 at 13:22
  • Oh yes, sorry, just the domain works. I said FULL meaning include http
    – ryangreene
    Commented Oct 12, 2018 at 13:25
  • Also, if Remote Sites doesn't work you can try adding it to CSP Trusted Sites. CSP just doesn't give you the option of Disabling Protocol Security
    – ryangreene
    Commented Oct 12, 2018 at 13:26
  • I tried to add the domain to remote sites, but nothing changed. If it can be a plus, the component is shown into a community. Can this be a problem?
    – CRK
    Commented Oct 12, 2018 at 13:50
  • 1
    – ryangreene
    Commented Oct 12, 2018 at 14:03

As @ryangreene has commented in a different answer the solution may be found in https://help.salesforce.com/articleView?id=000334127&type=1&mode=1

Chrome has a security feature to block insecure content (HTTP) which is being loaded via a secure page (HTTPS). In order to avoid this error, the content being loaded must be in secure form (HTTPS).

How to bypass the Chrome limitation could be found here: https://stackoverflow.com/questions/18321032/how-to-get-chrome-to-allow-mixed-content


This helped me

  1. Go to Settings->Security in Experience Builder
  2. Choose "Allow Inline Scripts and Script Access to Whitelisted Third-party Hosts"
  3. Add the sites in Trusted Sites for Scripts part

Reference: https://help.salesforce.com/articleView?id=networks_security_csp_scriptlevel.htm&type=5


If you are displaying those images from Static Resources. Then you don't have to include 'https'. Simply go to your Static Resources > Your resource file (image) > click on View FIle link And copy the URL from /resource/....

And your <IMG> will look like this => <img src='/resource/1638263749/Your_Logo?'/>

  • While this is helpful for those displaying images from Static Resources, this does not answer the original question where the title and question both explicitly concern image(s) from an external site.
    – Moonpie
    Commented Jan 11, 2022 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .