Issue

When I edit a receipt template, the content shows an unhappy face.

In Chrome’s developer tools, the following error appears:

Refused to frame ‘https://DomainName—SandboxName–dryad.sandbox.vf.force.com/’ because an ancestor violates the following Content Security Policy directive: “frame-ancestors ‘self’ “.

Reason

This is a common Content Security Policy (CSP) issue in Salesforce when embedding Visualforce pages in LWCs across different domains. 

The problem occurs because sandboxes often have different domain configurations than others. 

Solution

There are two options.

Option 1: Disable Clickjack Protection

1. Go to Setup > Session Settings
2. In the section “Clickjack Protection”, set “Enable clickjack protection for customer Visualforce pages with headers disabled” to False

Option 2: Configure Trusted Domains for Inline Frames

If disabling Clickjack Protection isn’t desirable or doesn’t resolve the issue, you need to explicitly tell the sandbox that its own domains are safe for framing.

1. Go to Setup > Session Settings
2. In the section “Trusted Domains”, click “Add Domain”
3. Add the following domain
   1. In Production : https://domainName.lightning.force.com
   2. In Sandbox: https://DomainName—SandboxName.sandbox.lightning.force.com
4.     Set the IFrame Type to “Visualforce Pages”