The sandbox Attribute
The sandbox attribute restricts what the iframe can do. Without any values it disables scripts, forms, popups, and same-origin access.
Add specific allow-* tokens to re-enable features you need.
HTML
Intermediate
5 min read
The iframe sandbox Attribute
Example
<!-- Completely sandboxed — no scripts, no forms -->
<iframe src="user-content.html" sandbox></iframe>
<!-- Allow scripts and same-origin access only -->
<iframe
src="widget.html"
sandbox="allow-scripts allow-same-origin"
></iframe>
<!-- Allow form submission and popups -->
<iframe
src="form.html"
sandbox="allow-scripts allow-forms allow-popups"
></iframe> Pro Tip
Never combine allow-scripts and allow-same-origin on user-generated content — it defeats the sandbox security model.