--- Issue ---
I have a LWC inside my Managed Package which dynamically opens a Visualforce Page by its name inside iframe.

It worked ok in all orgs, However for the last 3-4 months I noticed that if org has:

  • Lightning Web Security enabled
  • Enable clickjack protection for customer Visualforce pages with headers disabled - checked ( see it in Setup -> Session Settings ).

than I get next error when opening a Visualforce Page inside iframe:

Refused to frame 'https://{domainName}--c.vf.force.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".

What I see:

enter image description here

If I disable Lightning Web Security or "Enable clickjack protec..." it shows me Visualforce Page as expected.

I tried to add next URLs to CSP Trusted Sites, however it not helps:

  • https://{domainName}.lightning.force.com
  • https://{domainName}--c.vf.force.com
  • https://{domainName}.my.salesforce.com

--- Question ---

Is there anything I need to add to my Visualforce Page to make it work without disabling these Settings ?

Maybe add some other configurations in the Session Settings ?

Any help will be appreciated.
Thank you.

1 Answer 1


Ok, the answer is right there on a Session Settings page in Setup.
See Trusted Domains for Inline Frames Section:

Visualforce Pages: Allow iframes of Visualforce pages with clickjack protection on external domains. To enable this feature, add external domains where you allow framing. Then, turn on one of the “Enable clickjack protection for customer Visualforce pages” preferences under Clickjack Protection.

So I added the next Trusted Domains there, with IFrame Type = "Visualforce Pages"

  • https://{myDomain}.my.salesforce.com
  • https://{myDomain}.lightning.force.com

And it now shows me Visualforce Page as expected.

Useful link: Visualforce page note displaying in iframe: Content Security Policy

  • 1
    Note that if you have enabled the 2 clickjack protection in Session Settings and your User has the 'Development Mode' then you would need to turn off one of them. Commented Oct 27, 2023 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .