Iframe sandbox playground
Turn sandbox flags on and off, see what the framed page can still do, and copy the attribute.
Updated
On: everything below is blocked unless checked.
allow
Browser features the frame may use.
Enter a URL to load the page in the sandbox.
What this frame allows
no sandbox- No sandbox: the page gets the normal rights of a cross-origin frameno sandbox attribute
<iframe src="https://your-site.com/embed"></iframe>
How the sandbox attribute works
Read the sandbox guide- 01
An empty sandbox blocks almost all
With sandbox="" the page cannot run scripts, submit forms, open windows, or keep its cookies.
- 02
Each flag gives back one power
Add only the flags the page needs. A form needs allow-forms. A video player may need allow-scripts.
- 03
One pair cancels the sandbox
allow-scripts with allow-same-origin lets a same-site page remove the attribute. Do not use both for pages you do not trust.