Tool

Iframe Sandbox Tester

Select sandbox permissions, preview the iframe, and generate the exact sandbox attribute your embed needs.

Iframe sandbox permissionsStart strict, then add only what is needed

Loading a preview connects to the destination. Use a URL you trust. Permission changes reload an open preview.

Enter a valid http:// or https:// URL.
<iframe
  src="https://example.com/"
  title="Sandbox test"
  sandbox=""
  width="100%"
  height="600"
></iframe>
Security model

Sandbox an iframe by restoring only required capabilities

Adding an empty sandbox attribute applies a broad set of restrictions. Each allow-* token restores one category of behavior. The safest practical approach is to start restrictive and add only the capabilities that your embed genuinely needs.

Common permission decisions

Interactive applications often need allow-scripts. Forms may need allow-forms. OAuth or help widgets may need popups. Downloads, top-level navigation and modal dialogs should be granted only when they are part of the expected workflow.

Sandbox does not make every iframe safe

Sandboxing is one layer. You still need to consider the source of the content, delegated browser permissions, referrer policy, the parent page's Content Security Policy and whether the destination is even allowed to be framed.

Technical references

FAQ

Common questions

What does the iframe sandbox attribute do?

sandbox applies a set of restrictions to framed content. Tokens such as allow-scripts, allow-forms and allow-popups selectively restore capabilities that the embed needs.

Is sandbox the same as X-Frame-Options?

No. sandbox is set by the parent page to restrict the framed document. X-Frame-Options and CSP frame-ancestors are sent by the framed site to control whether a parent is allowed to embed it.

Why is allow-scripts plus allow-same-origin worth reviewing carefully?

For same-origin content, restoring both script execution and normal origin behavior can greatly reduce the isolation sandbox was intended to provide. The correct policy depends on who controls the framed content and what it needs to do.

Keep testing

Related tools and guides