HTML <iframe> sandbox Attribute
An <iframe> with extra restrictions:
More "Try it Yourself" examples below.
Definition and Usage
The sandbox attribute enables an extra set of restrictions for the content in the iframe.
When the sandbox attribute is present, and it will:
- treat the content as being from a unique origin
- block form submission
- block script execution
- disable APIs
- prevent links from targeting other browsing contexts
- prevent content from using plugins (through <embed>, <object>, <applet>, or other)
- prevent the content to navigate its top-level browsing context
- block automatically triggered features (such as automatically playing a video or automatically focusing a form control)
The value of the sandbox attribute can either be just sandbox (then all restrictions are applied), or a space-separated list of pre-defined values that will REMOVE the particular restrictions.
The numbers in the table specify the first browser version that fully supports the attribute.
Differences Between HTML 4.01 and HTML5
The sandbox attribute is new in HTML5.
|(no value)||Applies all restrictions|
|allow-forms||Re-enables form submission|
|allow-same-origin||Allows the iframe content to be treated as being from the same origin|
|allow-top-navigation||Allows the iframe content to navigate its top-level browsing context|
An <iframe> sandbox allowing form submission:
An <iframe> sandbox allowing scripts and access to server content:
❮ HTML <iframe> tag