I'm trying to embed a public page from a Force.com site in an iframe on a public website. The page works as expected when I load it in its own tab, but doesn't load in the iframe -- instead, I get the following error:

Refused to display 'https://DOMAIN.cs9.force.com/PREFIX/PAGE' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

This question implies that you can turn off same-origin policy checking on Visualforce pages by disabling click-jack protection, but I have already turned off click-jack protection and am still seeing this error.

enter image description here

Any tips or suggestions?

1 Answer 1


Force.com Sites have click-jack settings set up on a per-site basis. You need to change yours to "Allow framing by any page (no protection)"

  1. Go to Salesforce Setup > Develop > Sites
  2. Click "Edit" next to your Site
  3. Change the "Clickjack Protection Level"

enter image description here


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .