Salesforce Sites: Site Fails to Display in an iFrame Due to X-Frame-Options Header

Understanding X-Frame-Options Values

The X-Frame-Options header has three possible values:

• DENY: The page cannot be displayed in any iframe, regardless of origin.
• SAMEORIGIN: The page can only be displayed in an iframe on the same domain as the page itself.
• ALLOW-FROM uri: The page can only be displayed in an iframe on the specified domain (deprecated in modern browsers).

If a Salesforce page carries SAMEORIGIN, it cannot be embedded in an iframe on a non-Salesforce domain, because the domain of the embedding site differs from the Salesforce domain.

Why There Is No Universal Solution

The X-Frame-Options header is a browser-enforced security control. Salesforce cannot override the X-Frame-Options settings of a third-party site, and third-party sites cannot override Salesforce's settings. The behavior is enforced at the browser level based on HTTP response headers.

Options If You Own the Site Being Embedded

If you own the site you want to display within a Salesforce iframe:

1. Configure the X-Frame-Options header on your site's server to permit Salesforce domains (for example, set it to `ALLOW-FROM <REDACTED> or remove the restriction entirely).
2. Add salesforce.com or force.com to your site's crossdomain.xml file to permit cross-domain access.

Note: Modern browsers have deprecated ALLOW-FROM in favor of the Content-Security-Policy: frame-ancestors directive. Consider using Content-Security-Policy for broader browser compatibility.