Blocked script execution: the frame is sandboxed without allow-scripts

Your iframe has a sandbox attribute without allow-scripts. The browser loads the page in the frame but does not run its JavaScript, so buttons, menus, and players do not work.

  • Chrome
  • Edge
  • Firefox
  • Safari

Updated

Console error · Chrome, Edge and Safari, exact text

Blocked script execution in 'https://example.com/' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.

Chrome, Edge, SafariExact text

The page shows, but nothing that needs JavaScript works.

Blocked script execution in 'https://example.com/' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.

FirefoxWhat you see

The page shows, but nothing that needs JavaScript works.

On this page

What it means

The sandbox of your iframe does not let the page in it run JavaScript. The browser still loads and shows the page. This is a choice in your iframe tag, not a block from the other site.

Why it happens

Your iframe tag has an empty sandbox attribute, or one without allow-scripts:

<iframe src="https://example.com/" sandbox></iframe>
  1. An empty sandbox turns on every limit. Each allow- flag removes one.

  2. Without allow-scripts, no script runs: not inline scripts, not files, not event handlers.

Check the page

See the headers the page sends now

Fix it if you own the site

Add allow-scripts to the sandbox attribute. Add only the other flags the page needs. The sandbox guide lists each flag.

HTML
<iframe src="https://example.com/" sandbox="allow-scripts"></iframe>

Do not add allow-scripts and allow-same-origin together to a frame from your own origin. The page in the frame can then remove its own sandbox.

If you do not own the site

The sandbox attribute is on your iframe tag, so you can change it. If the tag comes from another site, use one of these.

  1. Ask for the flag

    Ask the owner of the embed code to add allow-scripts to the sandbox attribute.

  2. Open the page in a new tab

    Link to the page so it runs with no sandbox.

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.