HTML Iframes
An iframe gives an embedded document its own browsing context. It is useful for a contained preview, but embedding adds accessibility, privacy, and security responsibilities.
How it works
- Provide a concise title describing the frame’s purpose. The embedded page needs its own accessible structure too.
- Use the sandbox attribute to restrict capabilities. An empty sandbox grants none of the optional sandbox permissions.
- Only grant individual permissions you need. Combining allow-scripts and allow-same-origin for untrusted same-origin content can undermine isolation.
A practical example
<iframe src="preview.html"
title="Workshop poster preview"
width="640" height="360"
sandbox="" loading="lazy"
referrerpolicy="no-referrer"></iframe>
Create preview.html in the same local project. This configuration allows a document preview while withholding sandbox permissions such as script execution.