Iframe Sandbox Tester
Select sandbox permissions, preview the iframe, and generate the exact sandbox attribute your embed needs.
Loading a preview connects to the destination. Use a URL you trust. Permission changes reload an open preview.
<iframe src="https://example.com/" title="Sandbox test" sandbox="" width="100%" height="600" ></iframe>
Sandbox an iframe by restoring only required capabilities
Adding an empty sandbox attribute applies a broad set of restrictions. Each allow-* token restores one category of behavior. The safest practical approach is to start restrictive and add only the capabilities that your embed genuinely needs.
Common permission decisions
Interactive applications often need allow-scripts. Forms may need allow-forms. OAuth or help widgets may need popups. Downloads, top-level navigation and modal dialogs should be granted only when they are part of the expected workflow.
Sandbox does not make every iframe safe
Sandboxing is one layer. You still need to consider the source of the content, delegated browser permissions, referrer policy, the parent page's Content Security Policy and whether the destination is even allowed to be framed.
Technical references
Common questions
What does the iframe sandbox attribute do?
sandbox applies a set of restrictions to framed content. Tokens such as allow-scripts, allow-forms and allow-popups selectively restore capabilities that the embed needs.
Is sandbox the same as X-Frame-Options?
No. sandbox is set by the parent page to restrict the framed document. X-Frame-Options and CSP frame-ancestors are sent by the framed site to control whether a parent is allowed to embed it.
Why is allow-scripts plus allow-same-origin worth reviewing carefully?
For same-origin content, restoring both script execution and normal origin behavior can greatly reduce the isolation sandbox was intended to provide. The correct policy depends on who controls the framed content and what it needs to do.