Bhylu

HTML Iframes

An iframe gives an embedded document its own browsing context. It is useful for a contained preview, but embedding adds accessibility, privacy, and security responsibilities.

How it works

  • Provide a concise title describing the frame’s purpose. The embedded page needs its own accessible structure too.
  • Use the sandbox attribute to restrict capabilities. An empty sandbox grants none of the optional sandbox permissions.
  • Only grant individual permissions you need. Combining allow-scripts and allow-same-origin for untrusted same-origin content can undermine isolation.

A practical example

HTML

<iframe src="preview.html"
        title="Workshop poster preview"
        width="640" height="360"
        sandbox="" loading="lazy"
        referrerpolicy="no-referrer"></iframe>

Create preview.html in the same local project. This configuration allows a document preview while withholding sandbox permissions such as script execution.