Issue: We get CSP (Content Security Policy) error with our Visualforce page integration.

The issue is that when we access this in sandbox testing, we find that our content is wrapped in an iframe, and that iframe also contains an iframe.

The outer iframe does not seem to have a URL, and so we cannot exclude it from our CSP whitelist.

apex putting the iframe dynamically inside another iframe that is not having any src, that is why we are not able to whitelist the domain that can open our site into iframe.

  • VisualForce page code
<apex:page standardController="Opportunity" extensions="CustomOpportunityController">
  <apex:iframe src="https://my-site.com" width="100%" height="900px" scrolling="true" id="theIframe" />
  • Below is the sample iframe inside the iframe.
<iframe allow="geolocation *; microphone *; camera *" frameborder="no" height="1000px" id="0661b0000004nmw" marginheight="0" marginwidth="0" name="0661b0000004nmw" scrolling="yes" title="HelloWorld" width="100%">
  <iframe src="https://my-site.com"> </iframe>
  • Error log from developer console of browser.
    [Report Only] Refused to display 'https://my-site.com' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' *.salesforce.com".

Please let me know if there is a way to resolve the content security error in this case!

3 Answers 3


From what you've written, I believe you're embedding your Visualforce page in a record page layout in the Classic interface. Visualforce in a page layout is always wrapped in that iframe with the size and other attributes you set in the page layout editor. That iframe's presence is not the issue.

The CSP Trusted Sites documentation specifies that these settings only apply to the Lightning UI, and says:

NOTE To enable corresponding access for Visualforce or Apex, create a Remote Site.

So you need to add https://my-site.com as a Remote Site, under Remote Site Settings in Setup.

If you are trying to use this Visualforce page inside of Lightning, the recommendation is basically, don't. From Understanding the Salesforce App Container in the Visualforce Developer Guide:

Avoid using <apex:iframe> on a Visualforce page within the Salesforce app container. Only use this tag if you really understand iframes and how they affect the DOM and JavaScript.


There are perfectly valid scenarios to embed VisualForce within Lightning. To ensure this works, you simply need to disable "Clickjack" enforcement for VisualForce pages in Setup > Session Settings.

If you do not disable these, you will get the error (in Javascript developer console on your browser):

Content Security Policy directive: "frame-ancestors 'self'

It is also worth reviewing Setup > CSP Trusted Sites and Setup > Remote Sites.

Session Settings


you can use simply window.open('www.youraddress.com','_top') . In my case this doesn't through error. It redirected to the URL.

  • Welcome to Salesforce Stack Exchange (SFSE)! I am unfamiliar with CSP, but just reading the question and other answers in context, It seems to me that your answer might address a different question and a different type of error. So please edit your answer to explain exactly how this addresses the original issue of the Content Security Police (CSP) violation pertaining to an iframe.
    – Moonpie
    Commented Oct 20, 2022 at 11:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .