Unsafe attempt to initiate navigation: the frame is sandboxed

The page in your frame tries to change the URL of the top page, for example to leave the frame. Your sandbox attribute does not have allow-top-navigation, so the browser stops it.

  • Chrome
  • Edge
  • Safari

Updated

Console error · Chrome and Edge, exact text

Unsafe attempt to initiate navigation for frame with origin 'https://your-site.com' from frame with URL 'https://example.com/'. The frame attempting navigation of the top-level window is sandboxed, but the flag of 'allow-top-navigation' or 'allow-top-navigation-by-user-activation' is not set.

Chrome, EdgeExact text

The click in the frame does nothing.

Unsafe attempt to initiate navigation for frame with origin 'https://your-site.com' from frame with URL 'https://example.com/'. The frame attempting navigation of the top-level window is sandboxed, but the flag of 'allow-top-navigation' or 'allow-top-navigation-by-user-activation' is not set.

SafariExact text

The click in the frame does nothing.

Unsafe JavaScript attempt to initiate navigation for frame with URL 'https://your-site.com/' from frame with URL 'https://example.com/'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.

On this page

What it means

The page in the frame wants to replace your page with another one. The sandbox of your iframe does not allow that, so the browser blocks the move and writes this message. Your page stays as it is.

Why it happens

A script or a link in the frame targets the top page:

window.top.location = "https://example.com/account";
  1. Links with target="_top" and scripts that set top.location both count.

  2. Sign-in and payment pages often do this to leave the frame.

  3. With allow-top-navigation-by-user-activation, Chrome allows it only right after a click. Without a click, the message says the frame “has no user activation”.

Check the page

See the headers the page sends now

Fix it if you own the site

Add allow-top-navigation-by-user-activation to the sandbox attribute. It lets the frame change the top page only after a click of the user. The sandbox guide lists each flag.

HTML
<iframe
  src="https://example.com/"
  sandbox="allow-scripts allow-forms allow-top-navigation-by-user-activation"
></iframe>

Prefer allow-top-navigation-by-user-activation over allow-top-navigation. The second flag lets the frame move the top page at any time, with no click.

If you do not own the site

The sandbox attribute is on your iframe tag, so you can change it. If the tag comes from another site, use one of these.

  1. Ask for the flag

    Ask the owner of the embed code to add allow-top-navigation-by-user-activation to the sandbox attribute.

  2. Open the page in a new tab

    Link to the page so it runs with no sandbox.

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.