A small piece of HTML can change what a visitor sees or how the browser understands a page. In this lesson, you will explore referrerpolicy on links, images, and iframes using a short example that you can inspect and change.
The Idea in Plain English
The iframe sandbox limits what embedded content can do. Start with the fewest permissions and add tokens only when an actual use case needs them.
You can test this using a small local HTML file. Change one part at a time and check the result in the browser before adding more code.
A Working Example
Read the sample once before copying it. Notice the element names and attribute values, then compare them with the explanation below.
<iframe title="Lesson preview"
src="/examples/lesson.html"
sandbox="allow-scripts"
loading="lazy">
</iframe>What Each Part Does
- An iframe embeds another page in a separate browsing context.
- title can provide supplementary information but is not a universal replacement for visible text.
- src points to the asset the browser should load.
- sandbox restricts actions an embedded document may perform.
The embedded page may display, but certain scripts, forms or navigation operations will be blocked.
Keep the example small while learning. Once it behaves as expected, try it inside a larger page and make sure the URLs, files and surrounding HTML are correct.
Try It Yourself
Try this next: demonstrate a safe and an unsafe snippet and validate behavior focused on Referrerpolicy on Links, Images, and Iframes, including a working example and an incorrect example to correct. Then inspect the page and explain what changed.
Common Beginner Mistakes
- Combining allow-scripts and allow-same-origin on a same-origin page and assuming it remains strongly isolated.
- Changing several parts of the example at once, making it difficult to see which part caused a different result.
- Choosing a tag only because its default appearance looks right, without checking whether it describes the content correctly.
Key Takeaways
- The iframe sandbox limits what embedded content can do. Start with the fewest permissions and add tokens only when an actual use case needs them.
- The embedded page may display, but certain scripts, forms or navigation operations will be blocked.
- Test the markup in a browser, and check accessibility and real-world behavior where relevant.