I am trying to embed an external webpage in vfp using Iframe or canvas. However, in both the cases I am not able to display the content. It appears blank.

As per my search, that it might not be possible due to the X-Frames.

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a , or . Sites can use this to avoid click jacking attacks, by ensuring that their content is not embedded into other sites.

Practically, almost all the browsers support the feature.

Browsers Supporting X-Frame-Options • IE8+ • Opera 10.50+ • Safari 4+ • Chrome (Allow-From not yet supported) • Firefox 3.6.9 (or earlier with No Script)

I have option of using the link in webpage layout but that will not serve the purpose.

  • Thats a browser security implementation for websites you can not do this. Actually you are trying to hack this.
    – Ashwani
    May 14, 2014 at 19:44
  • @regal Is there any other way. Actually I am supposed to open a tab of external website in salesforce on click of a link. but I am not able to do so. It appears blank for some websites May 15, 2014 at 6:31
  • Xframe options don't allow accessing site page as a child in any case.
    – Ashwani
    May 15, 2014 at 6:36

2 Answers 2


Any mechanism that displays a page wrapped inside a Salesforce page will be using a iframe, and all modern browsers will respect the X-Frame-Options header and refuse to display the page. There is no workaround for this, as you would have to force the browser not to respect the header and allow the content to be included. Even going the JavaScript route, using something like jquery.load, is likely to fail due to the browser same origin policy.

If you want to display the content of a single page from an external system, you can access it server side and then make the content available through a Visualforce page. The following code snippet accesses the google home page:

 HttpRequest req = new HttpRequest();

 Http http = new Http();
 HTTPResponse res = http.send(req);

note that you need to add the target site (http://www.google.co.uk) as a remote site for this to work correctly. However, this wouldn't allow you to navigate off of the page or carry out an HTTP post etc, as at that point the browser will receive the X-Frame-Options header and block access again. You could in theory rewrite all links on the page so that they made the request back to your controller and you pulled in the next page from the remote site etc, but that would be a huge amount of effort for very little return.

  • Thanks Bob for the input.but I need to access another website and probably it won't work this way. Is there anything other than Iframes that can work? May 15, 2014 at 10:06
  • Nothing that I'm aware of - you'll have to open the page in a new window I think. May 15, 2014 at 10:10
  • Yes Bob, I had created a link on standard webpage for that. But just wanted to check if we have some way out to embedd it in salesforce only. May 15, 2014 at 10:13
  • Only by content scraping as above. If you access it directly from the browser, it has to be a top level page. May 15, 2014 at 10:23
  • Can I use Salesforce Console Integration Toolkit in console app May 20, 2014 at 4:51

As I understand it, you can use Visualforce Sites in iFrames if you 'Enable clickjack protection for non-setup Salesforce pages' in 'Session Settings'. The problem is you then open yourself to clickjacking. But you can use X-FRAME setting such as ALLOW-FROM uri to stop it working as an iFrame in anything other than your own website.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .