---
schema_version: "1"
id: ebd921c63988a7993add2734c91915e548946ac75257ccc387088bcad4c68b6b
title: Enable Clickjack Protection in Site.com
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/siteforce_clickjacking_enable.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.siteforce_clickjacking_enable.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b9ab87d8606dee41558ba89ce108a6fc90079d60e2f3193e2f04f6e1b747dc47
description: Clickjacking is a type of attack that tricks users to click something, such as a button or link, because they perceive they are clicking something safe. Instead, the button or link performs malicious actions on your site, leading to data intrusion, unauthorized emails, changed credentials, or other site-specific results. Hidden iframes can be placed maliciously on site pages and entice users to click a button or link that appears below the hidden iframe. With clickjack protection, you can configure whether your browser allows external domains to frame your Site.com site pages.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Enable Clickjack Protection in Site.com

Clickjacking is a type of attack that tricks users to click something, such as a button or link, because they perceive they are clicking something safe. Instead, the button or link performs malicious actions on your site, leading to data intrusion, unauthorized emails, changed credentials, or other site-specific results. Hidden iframes can be placed maliciously on site pages and entice users to click a button or link that appears below the hidden iframe. With clickjack protection, you can configure whether your browser allows external domains to frame your Site.com site pages.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Available for purchase in: <strong>Enterprise</strong>, <strong>Performance</strong>,
                and <strong>Unlimited</strong> Editions</p>
              <p style="margin-bottom:0;">Available (with limitations) in:
                <strong>Developer</strong> Edition
              </p>
            </td>

          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d188713e74">User
              Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d188713e74 ">To build, edit, and manage Site.com sites:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d188713e74 ">
              <p><samp class="parmname">Site.com Publisher User</samp> field enabled on the
                user detail page</p>
              <p>AND</p>
              <p style="margin-bottom:0;">Site administrator or designer role
                assigned at the site level</p>
            </td>

          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)

Note To configure clickjack protection for Experience Cloud sites, see [Enable Clickjack Protection in Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=experience.networks_clickjack_protection.htm&type=5&language=en_US).

1. In Site.com Studio, click **Site Configuration** | **Edit**.
2. Select your preferred level of clickjack protection.
    - **Allow framing by any page (no protection)**: The least secure level. All external domains can frame your site pages.
    - **Allow framing of site pages on external domains (good protection)**: Only trusted external domains can frame your site pages. You specify the domains that you trust in the Trusted Domains for Inline Frames list.
    - **Allow framing by the same origin only (recommended)**: The default level for Site.com sites. Allows framing of site pages by pages with the same domain name and protocol security.
    - **Don’t allow framing by any page (most protection)**: The most secure level, but this option can cause certain pages to appear as blank pages. To avoid this issue, use the default setting instead.
3. Save your changes.
4. If you chose to allow framing of your site pages on external domains, specify the domains that you trust to frame each site’s pages.
    1. From Setup in Salesforce Classic, enter Sites in the Quick Find box, and then select **Sites**.
    2. Click the site label to open the Site Details page.
    3. Click **Add Trusted Domain** in the Trusted Domains for Inline Frames section and enter the domain you want to allow iframes on.
        
        You can add up to 512 domains.
        
        Some infrastructure limits the maximum size of HTTP headers. If you allow multiple domains to frame your site pages, keep the size of the CSP header under 12 KB. Salesforce customers report issues when the header size approaches 16 KB, and third parties often add to the header during processing.
        
        ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_tip.png)
        
        Tip Added domains take effect only when **Allow framing of site pages on external domains (good protection)** is selected.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)

Note Internet Explorer supports clickjack protection through the legacy X-Frame-Options HTTP Header only. This header supports `sameorigin`, `deny` (none), `allowall`, and `allow-from` uri. In particular, `allow-from` uri supports only one URI.

To support a list for IE users, the framing site must identify itself to the site domain by passing in a query parameter in the `iframe` tag. For example, if you add https://www.example.com as a trusted external domain and your site URL is https://MyDomainName.my.site.com, then the page on https://www.example.com must make its iframe as follows:

```
<iframe src="https://MyDomainName.my.site.com?_iframeDomain=https://www.example.com"></iframe>
```

You can also set the trusted external domain in the `iframeDomain` cookie. This method allows iframes if the `_iframeDomain` URL variable isn’t saved when navigating between pages in IE.

```markup
Cookie iframeDomainCookie = ApexPages.currentPage().getCookies().get('iframeDomain');

if (iframeDomainCookie == null) {
    iframeDomainCookie = new Cookie('iframeDomain','www.example.com');

    // Set the new cookie for the page
    ApexPages.currentPage().setCookies(new Cookie[]{iframeDomainCookie});
}
```

#### See Also

- [Configure Site Properties](https://help.salesforce.com/s/articleView?id=platform.siteforce_website_properties.htm&release=264.0.0&type=5 "Set properties for the site, such as the home page, site name, and error page, and create an anonymous preview URL that allows other users to review the site before it goes live. The URL is always valid (unless you disable it) and shows the latest work in progress. It's only available to the people you send it to, and can't be found by search engines.")
- [Enable Clickjack Protection in Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=experience.networks_clickjack_protection.htm&type=5&language=en_US)
- [Create and Edit Salesforce Sites](https://help.salesforce.com/s/articleView?id=platform.sites_creating_and_editing_sites.htm&release=264.0.0&type=5 "After you enable Salesforce Sites, create a Salesforce Site. Or, update an existing site.")