Blocked form submission: the frame is sandboxed without allow-forms

Your iframe has a sandbox attribute without allow-forms. A form in the frame does not send when the user submits it, and the browser writes this message.

  • Chrome
  • Edge
  • Firefox
  • Safari

Updated

Console error · Chrome, Edge and Safari, exact text

Blocked form submission to 'https://example.com/login' because the form's frame is sandboxed and the 'allow-forms' permission is not set.

Chrome, Edge, SafariExact text

The form shows, but nothing happens when you submit it.

Blocked form submission to 'https://example.com/login' because the form's frame is sandboxed and the 'allow-forms' permission is not set.

FirefoxWhat you see

The form shows, but nothing happens when you submit it.

On this page

What it means

The sandbox of your iframe does not let forms in the frame send data. A sign-in, a search, or a contact form in the frame then does nothing. This is a choice in your iframe tag.

Why it happens

Your iframe tag has a sandbox attribute without allow-forms:

<iframe src="https://example.com/" sandbox="allow-scripts"></iframe>
  1. The URL in the message is the action of the form: where it would send the data.

  2. allow-scripts alone does not allow forms. Each flag allows one thing.

Check the page

See the headers the page sends now

Fix it if you own the site

Add allow-forms to the sandbox attribute. The sandbox guide lists each flag.

HTML
<iframe src="https://example.com/" sandbox="allow-scripts allow-forms"></iframe>

Do not add allow-scripts and allow-same-origin together to a frame from your own origin. The page in the frame can then remove its own sandbox.

If you do not own the site

The sandbox attribute is on your iframe tag, so you can change it. If the tag comes from another site, use one of these.

  1. Ask for the flag

    Ask the owner of the embed code to add allow-forms to the sandbox attribute.

  2. Open the page in a new tab

    Link to the page so it runs with no sandbox.

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.