--- schema_version: "1" id: 79c2418b05be07d245dfaf81874cc2bb2148a3d182e0247817a859ec6f6c3103 title: Enable Clickjack Protection in Experience Cloud Sites collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/experience/264-0-0/networks_clickjack_protection.md canonical_url: https://help.salesforce.com/s/articleView?id=experience.networks_clickjack_protection.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 478f756bd56496709654984fe8ca8433931beb54e0362a551070fc64b7c7511d description: Clickjacking is a type of attack that tricks users into clicking something, such as a button or link, because they perceive it to be safe. By creating hidden iframes pointing to your Experience Cloud site pages, hackers can entice users to click an element that appears to be on a different web page. But instead of the visible element handling the click, the click is hijacked and some element of the invisible site iframe on top receives it. Clickjacking can potentially lead to data intrusion, unauthorized emails, changed credentials, or other malicious site-specific results. With clickjack protection, however, you can secure your site by controlling whether browsers allow frames pointing to your pages. products: - Experiences release: "264" --- # Enable Clickjack Protection in Experience Cloud Sites Clickjacking is a type of attack that tricks users into clicking something, such as a button or link, because they perceive it to be safe. By creating hidden iframes pointing to your Experience Cloud site pages, hackers can entice users to click an element that appears to be on a different web page. But instead of the visible element handling the click, the click is hijacked and some element of the invisible site iframe on top receives it. Clickjacking can potentially lead to data intrusion, unauthorized emails, changed credentials, or other malicious site-specific results. With clickjack protection, however, you can secure your site by controlling whether browsers allow frames pointing to your pages. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_note.png) Note To configure clickjack protection for Site.com sites, see [Enable Clickjack Protection in Site.com](https://help.salesforce.com/s/articleView?id=platform.siteforce_clickjacking_enable.htm&type=5&language=en_US). You can set clickjack protection for your Experience Cloud site pages to one of these levels. - **Allow framing by any page (no protection)**: The least secure level. All external domains can frame your site pages. - **Allow framing of site pages on external domains (good protection)**: Only trusted external domains can frame your site pages. You specify the domains that you trust in the Trusted Domains for Inline Frames list. - **Allow framing by the same origin only (recommended)**: The default level for Experience Cloud sites. Allows framing of site pages by pages with the same domain name and protocol security. - **Don’t allow framing by any page (most protection)**: The most secure level. However, for Salesforce Tabs + Visualforce sites and for Experience Builder sites, this option prevents pages in the Administration section of Experience Workspaces from opening. To avoid this issue, select a different clickjack protection level. ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_tip.png) Tip The location for enabling clickjack protection differs for Experience Builder sites and Salesforce Tabs + Visualforce sites. If your site has a mixture of both Experience Builder and Visualforce pages, enable clickjack protection in both locations. ## Enable Clickjack Protection for Experience Builder Sites 1. In Experience Builder, select **Settings** | **Security & Privacy**. 2. Under Clickjack Protection Level, select a clickjack protection level. 3. If you chose to allow framing of site pages external domains, specify the domains that you trust to frame your site. For each trusted domain, take these steps. 1. In the Trusted Domains for Inline Framing section, click **Add Trusted Domain**. 2. Enter the domain that can frame your site pages. You can add up to 100 trusted domains for each Experience Builder site. Some infrastructure limits the maximum size of HTTP headers. If you allow multiple domains to frame your site, keep the size of the CSP header under 12 KB. Salesforce customers report issues when the header size approaches 16 KB, and third parties often add to the header during processing. ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_tip.png) Tip Added domains take effect only when Allow framing of site pages on external domains (good protection) is selected. ## Enable Clickjack Protection for Salesforce Tabs + Visualforce Sites 1. To access the Site Details page, use one of these methods. - In Experience Workspaces, select **Administration** | **Pages** | **Go to Force.com** - From Salesforce Setup, enter Sites and Domains in the Quick Find box, select **Sites**, and select the site from the Sites list. 2. Click **Edit** on the Site Details page. 3. Select your preferred level of clickjack protection and save your changes. 4. If you chose to allow framing of your site pages on your external domains, specify the domains that you trust to frame your page. For each domain, take these steps. 1. In the Trusted Domains for Inline Framing section, click **Add Domain**. 2. Enter the domain that can frame your site pages. You can add up to 512 trusted domains for each Salesforce Tabs + Visualforce site. Some infrastructure limits the maximum size of HTTP headers. If you allow multiple domains to frame your site pages, keep the size of the CSP header under 12 KB. Salesforce customers report issues when the header size approaches 16 KB, and third parties often add to the header during processing. ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_tip.png) Tip Added domains take effect only when **Allow framing of site pages on external domains (good protection)** is selected. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-experience-communities-264-0-0-production-enus/bf7df212-91a1-4fa3-a007-4d6f3e3b470b/images/icon_note.png) Note Internet Explorer supports clickjack protection through the legacy X-Frame-Options HTTP Header only. This header supports `sameorigin`, `deny` (none), `allowall`, and `allow-from` uri. In particular, `allow-from` uri supports only one URI. To support a list for IE users, the framing site must identify itself to the site domain by passing in a query parameter in the `iframe` tag. For example, if you add https://example.com as a trusted external domain, then the page on https://example.com must make its iframe as follows: `` You can also set the trusted external domain in the `iframeDomain` cookie. This method allows iframes if the `_iframeDomain` URL variable isn’t saved when navigating between pages in IE. `Cookie iframeDomainCookie = ApexPages.currentPage().getCookies().get('iframeDomain'); if (iframeDomainCookie == null) { iframeDomainCookie = new Cookie('iframeDomain','www.example.com'); // Set the new cookie for the page ApexPages.currentPage().setCookies(new Cookie[]{iframeDomainCookie}); }`