Iframe Sandbox Tester
Preview an iframe with sandbox permissions and copy the resulting code.
Sandbox an iframe by restoring only required capabilities
Adding an empty sandbox attribute applies a broad set of restrictions. Each allow-* token restores one category of behavior. The safest practical approach is to start restrictive and add only the capabilities that your embed genuinely needs.
Common permission decisions
Interactive applications often need allow-scripts. Forms may need allow-forms. OAuth or help widgets may need popups. Downloads, top-level navigation and modal dialogs should be granted only when they are part of the expected workflow.
Sandbox does not make every iframe safe
Sandboxing is one layer. You still need to consider the source of the content, delegated browser permissions, referrer policy, the parent page's Content Security Policy and whether the destination is even allowed to be framed.
Technical references
Why does a sandboxed iframe stop working?
If buttons no longer respond, check whether the application requires allow-scripts. If a form appears but cannot submit, review allow-forms. A login flow that opens a new window may need popup permissions. Restore a permission only after confirming that the action is part of the intended embed.
allow-same-origin preserves the document's normal origin behavior; it does not make two different websites share an origin. For content served from the parent's own origin, combining it with allow-scripts can undermine the sandbox boundary. Host untrusted content on a separate origin and review the complete integration.
Sandbox tokens versus browser feature permissions
The sandbox attribute and the iframe allow attribute do different jobs. Sandbox limits document behavior; allow controls delegated features such as fullscreen. Neither overrides X-Frame-Options or CSP frame-ancestors. Check framing permission first, then test the minimum capabilities the child needs.
Common questions
What does the iframe sandbox attribute do?
sandbox applies a set of restrictions to framed content. Tokens such as allow-scripts, allow-forms and allow-popups selectively restore capabilities that the embed needs.
Is sandbox the same as X-Frame-Options?
No. sandbox is set by the parent page to restrict the framed document. X-Frame-Options and CSP frame-ancestors are sent by the framed site to control whether a parent is allowed to embed it.
Why is allow-scripts plus allow-same-origin worth reviewing carefully?
For same-origin content, restoring both script execution and normal origin behavior can greatly reduce the isolation sandbox was intended to provide. The correct policy depends on who controls the framed content and what it needs to do.