Adding a picture or video is the easy part. Making it load efficiently and understandable to every visitor is the real goal.
What You Need to Know
Sandbox permissions should match the embedded content's actual tasks. Allowing scripts, forms, or same-origin access changes what the frame can do, so avoid copying a long list of tokens without understanding them.
Try the Example
Take a look at the example. We’ll explain the important lines right below it.
<iframe src="/embeds/preview.html" title="Untrusted example preview"
sandbox="allow-scripts" loading="lazy"></iframe>Let’s Read the Code
- <iframe>: An iframe embeds a separate document with its own URL and security context.
- src: Src identifies a resource path for images, frames, or media.
- sandbox: Sandbox places restrictions on what an embedded frame is allowed to do.
Read the named elements and attributes together. They explain how the browser connects this feature to the rest of the page.
What Happens in the Browser?
The paths shown here refer to files in your own example project. Put real images and recordings in those locations before expecting them to load.
Remember the boundary. Embedded content may be a separate document, sometimes provided by another company. Give it a readable title or alternative, and check what permissions and information its request may expose.
Your Turn
Try changing one file path or attribute. Notice whether the browser falls back to another source or shows missing content.
Common Beginner Mistakes
- Leaving out real media files or understandable text alternatives.
- Media and remote embeds can use significant bandwidth or reveal a visitor’s network information to another provider.
Key Takeaways
- Sandbox permissions should match the embedded content's actual tasks.
- <iframe>: An iframe embeds a separate document with its own URL and security context.
- If the resource cannot load, users still need enough text to understand what was meant to be there.