Error 'Load denied by X-Frame-Options: URL does not permit framing'

Communities have their own Clickjack protection settings that must be adjusted to allow the use of iFrames in the Visualforce pages.

To check the Clickjack settings in the community follow these steps:

In Salesforce Classic

1. Go to Setup | Customize | Digital Experiences | All Sites
2. Click on Workspaces (next to the community name).
3. Click on Administration tile.
4. Click on Pages.
5. Under Advanced Customizations, click Go to Force.com.
6. In the Site detail, on the right-hand side, you can see the 'Clickjack Protection Level' for the community.
7. Click the Edit button and adjust the Clickjack Protection Level.

In Lightning Experience

1. Navigate to gear icon | Setup | Feature Settings | Digital Experiences | All Sites
2. Click on Workspaces (next to the community name).
3. Click on Administration tile.
4. Click on Pages.
5. Under Advanced Customizations, click Go to Force.com.
6. In the Site detail, on the right-hand side, you can see the 'Clickjack Protection Level' for the community.
7. Click the Edit button and adjust the Clickjack Protection Level.

Salesforce Communities have two Clickjack protection parts. One is for the Lightning Platform Communities site, which is set from the Lightning Platform site detail page. The other is for the Site.com communities site, which is set from the Site.com configuration page. It’s recommended to set both to the same value.

For community sites, if you set Clickjack protection to the level for the most protection, certain pages appear as blank pages. To avoid this problem, use the recommended setting.

See also:

Review Enable Clickjack Protection Communities
Enable Clickjack Protection in Site.com