Iframe sandbox securityWhat it checks and how to fix it

What it checks

Parses each page for iframes. An iframe loading another host without a sandbox attribute fails. A sandbox that combines allow-same-origin with allow-scripts, or allows allow-top-navigation, gets a warning. Pages with no iframes, or only safely sandboxed ones, pass.

Why it matters

An embedded third-party page runs with whatever freedom you give it: it can run scripts, open popups, submit forms and navigate your whole page away to somewhere else. The sandbox attribute takes those powers away by default. Allowing both allow-scripts and allow-same-origin lets the framed page remove its own sandbox, so the attribute no longer protects anything.

How to fix it

Add a sandbox attribute to third-party iframes and grant only what the embed needs.

<!-- Most restrictive: no scripts, no forms, no navigation -->
<iframe src="https://widget.example/embed" sandbox title="Widget"></iframe>

<!-- A widget that needs scripts and popups, but cannot reach your page -->
<iframe src="https://widget.example/embed"
        sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox"
        title="Widget"></iframe>

Avoid allow-scripts allow-same-origin together, and prefer allow-top-navigation-by-user-activation over allow-top-navigation. Video embeds (YouTube, Vimeo) usually need allow-scripts allow-same-origin allow-presentation; that is acceptable for a trusted provider, but limit features with the allow attribute and add frame-src to your CSP so only those providers can be framed.