I want to iframe a URL in the salesforce vf page or aura component. I have added the URL in remote site settings and CSP Trusted sites. When I access the component it is throwing an error Refused to display 'URL' in a frame because it set 'X-Frame-Options' to 'deny'. I have unchecked "Enable clickjack protection for customer Visualforce pages with standard headers". Does anyone have a workaround?

This is frustrating as iframe is the most common use-case and salesforce should allow iframe to third-party sites if the customer has to invoke their own websites in salesforce.


If X-Frame-Options is set to Deny that means you cannot show the site as an Iframe, no matter what setting you do in salesforce.

For more info read this

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.