Imagine opening this page on a slow phone connection. The media should still be worth the wait and have a sensible fallback.
What You Need to Know
The sandbox attribute can limit what an embedded document is allowed to do. Start with fewer permissions and grant only the capabilities it needs; combining broad permissions can weaken the protection.
In this example: sandbox a demonstration page.
Try the Example
Take a look at the example. We’ll explain the important lines right below it.
<iframe src="/embeds/preview.html" title="Untrusted example preview"
sandbox="allow-scripts" loading="lazy"></iframe>Let’s Read the Code
- <iframe>: An iframe embeds a separate document with its own URL and security context.
- src: Src identifies a resource path for images, frames, or media.
- sandbox: Sandbox places restrictions on what an embedded frame is allowed to do.
Read the named elements and attributes together. They explain how the browser connects this feature to the rest of the page.
What Happens in the Browser?
The paths shown here refer to files in your own example project. Put real images and recordings in those locations before expecting them to load.
Remember the boundary. Embedded content may be a separate document, sometimes provided by another company. Give it a readable title or alternative, and check what permissions and information its request may expose.
Your Turn
Try changing one file path or attribute. Notice whether the browser falls back to another source or shows missing content.
Common Beginner Mistakes
- Leaving out real media files or understandable text alternatives.
- Media and remote embeds can use significant bandwidth or reveal a visitor’s network information to another provider.
Key Takeaways
- The sandbox attribute can limit what an embedded document is allowed to do.
- <iframe>: An iframe embeds a separate document with its own URL and security context.
- If the resource cannot load, users still need enough text to understand what was meant to be there.