9

I'm trying to embed a public page from a Force.com site in an iframe on a public website. The page works as expected when I load it in its own tab, but doesn't load in the iframe -- instead, I get the following error:

Refused to display 'https://DOMAIN.cs9.force.com/PREFIX/PAGE' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

This question implies that you can turn off same-origin policy checking on Visualforce pages by disabling click-jack protection, but I have already turned off click-jack protection and am still seeing this error.

enter image description here

Any tips or suggestions?

1 Answer 1

16

Force.com Sites have click-jack settings set up on a per-site basis. You need to change yours to "Allow framing by any page (no protection)"

  1. Go to Salesforce Setup > Develop > Sites
  2. Click "Edit" next to your Site
  3. Change the "Clickjack Protection Level"

enter image description here

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .