Legacy Salesforce URL Redirection Retires – Salesforce Announcement

Security Notification

At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business, and we take the protection of your data very seriously. We’re writing to remind you that redirections for some of your Salesforce orgs’ URLs stop in the Winter ’25 release, starting in August 2024 for sandboxes and in September 2024 for production orgs. We highly encourage you to test for this change and update all references to your previous URLs before those redirections stop.

Why the Change?

To comply with the latest browser and security standards, Salesforce recently required that customers deploy enhanced domains. This feature updated the hostname formats for the domains that serve Salesforce orgs. To reduce the impact of this change, your previous hostnames are redirected by default. However, to meet Salesforce security standards, some of the previous domains will be retired in 2024. The corresponding redirections stop in the Winter ’25 release.

Actions Required

Review the affected hostnames and how you can disable the redirections for testing. For details, see Prepare for the End of Redirections for Non-Enhanced Domains in Salesforce Help.

Additional Resources

Salesforce Enhanced Domains FAQSalesforce Help: Prepare for the End of Redirections for Non-Enhanced DomainsSalesforce Help: Log My Domain Hostname RedirectionsSalesforce Help: Enhanced Domains TimelineTo ask questions about enhanced domains, visit our monitored My Domain and Enhanced Domains group in the Trailblazer Community. We appreciate your trust in us as we continue to make your success and security our top priorities.

Legacy Salesforce URL Redirection Retires

Prepare for the End of Redirections for Non-Enhanced Domains

After enhanced domains are deployed, your previous non-enhanced hostnames are redirected. Those redirections stop in Winter ’25, starting in August 2024 for sandboxes.. Review the affected hostnames and how you can disable the redirections to test before Salesforce disables them.

REQUIRED EDITIONS

Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience

Available in: Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer Editions

After enhanced domains are deployed, Salesforce redirects two categories of non-enhanced hostnames.

• Your previous *.force.com site hostnames are redirected until you disable these redirections or until Salesforce disables these redirections in Winter ’25.
• Other previous non-enhanced hostnames are redirected until you disable those directions or until Salesforce disables those redirections in Winter ’25. Also, if you deploy another change to your My Domain, these redirections stop.

To see if redirections are in place for a previous My Domain, check the Redirections section of the My Domain Setup page.

NOTE My Domain URL redirections help prevent disruption, but they’re not intended as a permanent solution. Not all services work well with redirections, and a redirection adds a step to the process of loading the final web page. When you deploy enhanced domains, we highly recommend that you disable redirections during testing and update all references to your old URLs.

Track the Source of Redirections

You can search the metadata for your org to determine where the impacted URLs are used in Salesforce, but discovering all the other places that your URLs are used can be more complex. For example, site URLs and content URLs can be used on your website, social media pages, marketing materials, and templates such as email signatures and automated responses. To help you identify these locations outside of Salesforce, the Hostname Redirects log includes the referrer and origin sent with each request that Salesforce redirects. For more information, see Log My Domain Hostname Redirections.

Notify Users During Redirections

To help your users update outdated links and bookmarks, display a brief message during the redirection that provides the current URL. See Manage My Domain Redirections.

Previous *.force.com Site Hostnames

When you enable and deploy enhanced domains, the hostname formats change for your Experience Cloud sites and Salesforce Sites. To minimize potential disruption, the *.force.com hostnames that Salesforce hosted for your sites are redirected to your current site hostnames. Those redirections remain in place until Winter ’25 or until you disable these redirections.

To disable these redirections for testing purposes, use an option in the Redirections section of the My Domain page and test. For more information, see Disable Redirections for Your Previous Force.com Site URLs. For the replacement format for each of these hostnames, see My Domain URL Format Changes When You Enable Enhanced Domains. To better understand the purpose of each hostname type and whether it applies to you, see My Domain Hostnames.

Here are the *.force.com site hostnames for a production org that are temporarily redirected after you enable and deploy enhanced domains.

• ExperienceCloudSiteSubdomain.force.com
• SitesSubdomainName.force.com
• SitesSubdomainName.secure.force.com

Here are the .*force.com site hostnames for a sandbox that are temporarily redirected after you enable and deploy enhanced domains.

• SandboxName-ExperienceCloudSiteSubdomain.InstanceName.force.com
• SandboxName-SitesSubdomainName.InstanceName.force.com

Other Non-Enhanced My Domain Hostnames

When you enable and deploy enhanced domains, your other previous non-enhanced My Domain hostnames are redirected. Those redirections remain in place until Winter ’25 or until you disable these redirections.

For the type and the replacement format for each of these hostnames, see My Domain URL Format Changes When You Enable Enhanced Domains. To better understand the purpose of each hostname type and whether it applies to you, see My Domain Hostnames.

NOTE If you deploy another My Domain change after you enable and deploy enhanced domains, these hostnames are no longer redirected. For more information, see Understand Redirections for Previous My Domain Hostnames.

To disable the redirections of these non-enhanced My Domain hostnames for testing purposes, you can temporarily disable your previous My Domain. For more information, see Disable or Remove Your Previous My Domain.

Here are the non-enhanced hostnames for a production org that are temporarily redirected after you enable and deploy enhanced domains.

• MyDomainName--PackageName.container.lightning.com¹
• MyDomainName--c.documentforce.com
• MyDomainName.builder.salesforce-communities.com
• MyDomainName.livepreview.salesforce-communities.com
• MyDomainName.preview.salesforce-communities.com
• MyDomainName--UniqueID.a.forceusercontent.com
• MyDomainName--UniqueID.c.my.force-user-content.com
• MyDomainName--PackageName.visualforce.com¹
• MyDomainName--c.InstanceName.content.force.com
• MyDomainName--sitestudio.InstanceName.force.com
• MyDomainName--livepreview.InstanceName.force.com
• MyDomainName--sitepreview.InstanceName.force.com
• MyDomainName--PackageName.InstanceName.visual.force.com¹
• MyDomainName--sitestudio.InstanceName.sfdc-HyperforceInstanceName.force.com
• MyDomainName--livepreview.InstanceName.sfdc-HyperforceInstanceName.force.com
• MyDomainName--sitepreview.InstanceName.sfdc-HyperforceInstanceName.force.com
• MyDomainName--c.InstanceName.content.sfdc-HyperforceInstanceName.force.com
• MyDomainName--PackageName.InstanceName.visual.sfdc-HyperforceInstanceName.force.com¹

Here are the non-enhanced hostnames for a sandbox that are temporarily redirected after you enable and deploy enhanced domains.

• MyDomainName--SandboxName.my.salesforce.com
• MyDomainName--SandboxName.lightning.force.com
• MyDomainName--SandboxName--PackageName.container.lightning.com¹
• MyDomainName--SandboxName--UniqueID.b.forceusercontent.com
• MyDomainName--SandboxName--UniqueID.c.forceusercontent.com
• MyDomainName--SandboxName--c.documentforce.com
• MyDomainName--SandboxName.builder.salesforce-communities.com
• MyDomainName--SandboxName.livepreview.salesforce-communities.com
• MyDomainName--SandboxName.preview.salesforce-communities.com
• MyDomainName--SandboxName.InstanceName.my.salesforce.com
• MyDomainName--SandboxName--PackageName.visualforce.com¹
• MyDomainName--SandboxName--c.InstanceName.content.force.com
• MyDomainName--SandboxName--sitestudio.InstanceName.force.com
• MyDomainName--SandboxName--livepreview.InstanceName.force.com
• MyDomainName--SandboxName--sitepreview.InstanceName.force.com
• MyDomainName--SandboxName--PackageName.InstanceName.visual.force.com¹
• MyDomainName--SandboxName--c.InstanceName.content.sfdc-HyperforceInstanceName.force.com
• MyDomainName--SandboxName--sitestudio.InstanceName.sfdc-HyperforceInstanceName.force.com
• MyDomainName--SandboxName--livepreview.InstanceName.sfdc-HyperforceInstanceName.force.com
• MyDomainName--SandboxName--sitepreview.InstanceName.sfdc-HyperforceInstanceName.force.com
• MyDomainName--SandboxName--PackageName.InstanceName.visual.sfdc-HyperforceInstanceName.force.com¹

¹ If your installed package is unmanaged, the package name is c.

Instanced URLs Without My Domain

If your org was created before October 2020, you didn’t get a My Domain by default. In that case, your users accessed Salesforce with these hostnames that contained your instance name but not your My Domain name. These hostnames are redirected if the Instanced URL setting in the Redirections section on the My Domain Setup page is set to Redirect to the same page within the domain or Redirect with a warning to the same page within the domain.

Redirections for these hostnames also stop in Winter ’25. To disable the redirections of these hostnames for testing purposes, disable the redirections by updated the Instanced URL redirection setting to Don’t redirect (recommended). For more information, see Set the My Domain Login Policy.

• InstanceName.lightning.force.com
• ExperienceCloudSiteSubdomainName--builder.InstanceName.force.com
• ExperienceCloudSiteSubdomainName--preview.InstanceName.force.com
• ExperienceCloudSiteSubdomainName--live.InstanceName.force.com
• sitestudio.InstanceName.force.com
• sitepreview.InstanceName.force.com
• livepreview.InstanceName.force.com
• InstanceName--UniqueID.a.forceusercontent.com
• InstanceName--UniqueID.b.forceusercontent.com
• InstanceName--UniqueID.c.forceusercontent.com
• c.InstanceName.content.force.com
• PackageName.InstanceName.visual.force.com¹
• Region.scrt.sfdc.sh

¹ If your installed package is unmanaged, the package name is c.

Should you require assistance preparing your Salesforce org for this change, contact Tectonic today.

Configure Your Domain Settings

Customize the user experience when accessing your Salesforce organization through your domain. Manage user logins and authentication methods, and tailor your login page to reflect your brand. Decide on user redirection when they visit URLs previously served by Salesforce for your organization.

REQUIRED EDITIONS Available in: both Salesforce Classic (not available in all organizations) and Lightning Experience Available in: Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer Editions Note

NOTE: My Domain settings apply to domains deployed and provisioned for your organization. Set My Domain Login Policies Control how users and API calls interact with your Salesforce organization. Define whether logins to your organization necessitate your domain and determine user experiences when accessing bookmarks or links containing your instance-specific domain. Customize Your My Domain Login Page with Your Branding My Domain offers a user-friendly interface to personalize the page prompting users to log into your Salesforce organization. Replace the default Salesforce logo with your own branding elements, adjust background and login button colors, and integrate content adjacent to the login form. These branding options extend across the entire login process, including identity verification and password reset pages, as well as login flows.

Implement Interview-Based Login Page with My Domain Login Discovery Streamline user login procedures by configuring My Domain with Login Discovery, a two-step authentication process. Users first provide an email address or phone number, and then verify their identity through various means such as password entry, single sign-on (SSO) credentials, or Lightning Login. Set up Login Discovery through the My Domain Setup page after creating an Apex class that implements the MyDomainLoginDiscoveryHandler interface. Incorporate Identity Providers into My Domain Login Page Enhance authentication options by allowing users to authenticate through alternative identity providers directly from your My Domain login page. If single sign-on (SSO) via SAML is enabled or if external authentication providers are configured, users can choose these options on the login page. Upon selection, users are directed to the respective identity provider’s login screen for authentication before being redirected back to Salesforce.

Tailor My Domain Login Page for Mobile Authentication Methods By default, mobile apps developed with Salesforce Mobile SDK utilize standard authentication. For enhanced security and mobile app performance, configure advanced browser-based authentication from the My Domain Setup page. This setup redirects mobile users to their native browser for authentication. Upon successful authentication and approval of data access, users are seamlessly redirected back to the mobile app.