I am attempting to add an iFrame to an Adobe AEM published content to my Experience Cloud Site.

I keep getting exceptions: Refused to frame: https://...aemsite" because it violates the following Content Security Policy directive: "frame-src 'self'

I've added the domain to Trusted SitesTrusted Sites Configuration for domain

The AEM group has added my Experience Cloud Domain to their CSP allowed hosts to frame content, so I'm not sure what is going on?

The markup is relatively simple POC:

<iframe src="httpss://mydomain.../header.html"></iframe>

Note Salesforce Markup editor does not allow me to add tags such as:

<iframe src="httpss://mydomain.../header.html" referrerpolicy='same-origin'></iframe>

I think the AEM site needs to add a Access-Control-Allowed-Origin tag. with my domain! https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

  • 1
    Sites can choose to disallow framing. Salesforce does exactly that for the Salesforce UI. You can do nothing about it if that is the case.
    – Phil W
    Feb 23 at 22:56

1 Answer 1


We've discovered that we need to update our AEM Site to include the Access-Controlled-Allowed-Origin tag specifying the domain of our sandbox builder and published Experience Cloud Site so that content can be framed into our site.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .