Salesforce now excludes malformed URLs from generated Content Security Policy (CSP) HTTP headers. To keep your Trusted URLs list accurate, remove any malformed entries.
Where: This change applies to Lightning Experience and Salesforce Classic in Enterprise, Performance, Unlimited, and Developer editions.
Who: This change applies to orgs created before Spring ’25. Starting with that release, admins can’t save a malformed URL as a trusted URL. If an org has malformed URLs in its list, an admin added them before February 2025.
How: From Setup, in the Quick Find box, enter Trusted URLs, and then select Trusted URLs. Check for malformed URLs in the URL field. Or review the EndpointUrl field on the CspTrustedSite object. Delete or update any trusted URLs with a malformed URL.
To find all malformed URLs with an Apex class, see Identify Malformed Trusted URLs.