[SalesForce] Embed Visualforce page in public website

I'm trying to embed a public page from a Force.com site in an iframe on a public website. The page works as expected when I load it in its own tab, but doesn't load in the iframe — instead, I get the following error:

Refused to display 'https://DOMAIN.cs9.force.com/PREFIX/PAGE' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

This question implies that you can turn off same-origin policy checking on Visualforce pages by disabling click-jack protection, but I have already turned off click-jack protection and am still seeing this error.

enter image description here

Any tips or suggestions?

Best Answer

Force.com Sites have click-jack settings set up on a per-site basis. You need to change yours to "Allow framing by any page (no protection)"

  1. Go to Salesforce Setup > Develop > Sites
  2. Click "Edit" next to your Site
  3. Change the "Clickjack Protection Level"

enter image description here

Related Topic