iframe sandbox builder
The sandbox attribute locks down an embedded frame, then lets you grant
capabilities back one at a time. Toggle the tokens you need, read what each one does, and
copy a tag that grants the least privilege the embed requires.
Common
Navigation & popups
Advanced
Frame URL optional
src of the example tag — it is never loaded.How sandbox works
An <iframe> with a sandbox attribute starts with
everything turned off — scripts, forms, popups, top navigation, and a real
origin. Each allow-* token adds one capability back.
Add tokens one at a time, only as the embed needs them. The most important rule:
never combine allow-scripts with allow-same-origin for
content you don't fully trust — together they let the frame remove its own sandbox.
About the sandbox attribute
Adding sandbox to an
<iframe>
drops the frame into a highly restricted context: no scripts, no forms, no popups, no
top-level navigation, and a unique opaque origin that can't touch its own cookies or
storage. Each allow-* token re-enables exactly one of those capabilities, so
you build up from "deny everything" to the minimum the embed actually needs.
Start from deny-all
A bare sandbox is the safest baseline. Only add a token once you've
confirmed the embed breaks without it.
The one combination to avoid
allow-scripts together with allow-same-origin lets the frame
remove its own sandbox. Safe for your own content, dangerous for anything untrusted.
Prefer gesture-gated navigation
Use allow-top-navigation-by-user-activation instead of the unrestricted
allow-top-navigation so a frame can't redirect the tab without a click.