sandbox

How it works

Add sandbox with no value to get the strictest limits. The framed page can still show HTML and CSS. It cannot run scripts, submit forms, open popups, or change the URL of the top page. Its origin is unique, so it cannot read its own cookies or localStorage.

Each allow-* token removes one limit. The sandbox only removes powers. It cannot give a frame a power that a header or the browser already blocks.

Tokens

Token	What it gives back
allow-scripts	Run JavaScript.
allow-same-origin	Keep the real origin, with its cookies and storage.
allow-forms	Submit forms.
allow-popups	Open new windows and tabs.
allow-popups-to-escape-sandbox	Open popups without the sandbox limits.
allow-modals	Use alert(), confirm(), prompt(), and print().
allow-downloads	Start file downloads.
allow-top-navigation-by-user-activation	Change the top page URL after a click or tap.
allow-top-navigation	Change the top page URL at any time.

Other tokens are allow-pointer-lock, allow-orientation-lock, allow-presentation, allow-top-navigation-to-custom-protocols, and allow-storage-access-by-user-activation.

<!-- All limits: no scripts, no forms, no popups -->
<iframe src="https://widget.example/ad" sandbox title="Ad"></iframe>

<!-- Scripts and forms only -->
<iframe src="https://widget.example/form" sandbox="allow-scripts allow-forms" title="Form"></iframe>

<iframe
  src="https://widget.example/form"
  sandbox="allow-scripts allow-forms allow-popups"
  title="Partner form"
></iframe>