Enable Clickjack Protection in Site.com

To support a list for IE users, the framing site must identify itself to the site domain by passing in a query parameter in the iframe tag. For example, if you add https://www.example.com as a trusted external domain and your site URL is https://MyDomainName.my.site.com, then the page on https://www.example.com must make its iframe as follows:

<iframe src="https://MyDomainName.my.site.com?_iframeDomain=https://www.example.com"></iframe>

You can also set the trusted external domain in the iframeDomain cookie. This method allows iframes if the _iframeDomain URL variable isn’t saved when navigating between pages in IE.

Cookie iframeDomainCookie = ApexPages.currentPage().getCookies().get('iframeDomain');

if (iframeDomainCookie == null) {
    iframeDomainCookie = new Cookie('iframeDomain','www.example.com');

    // Set the new cookie for the page
    ApexPages.currentPage().setCookies(new Cookie[]{iframeDomainCookie});
}