Definitive Guide to HTML <iframe>
What is an Iframe?
The HTML <iframe> tag embeds another HTML document or webpage inside the current page. It creates a secondary, inline frame that can display content from external sources. The embedded document establishes a nested browsing context, meaning it operates independently of the parent document.
How to Embed Content using src
To display external content, the src attribute is mandatory. It specifies the direct URL of the page you intend to embed. You can customize the visual footprint by defining width and height attributes.
Accessibility Rule: Always include a descriptive title attribute to inform screen readers about the iframe's content.
Iframe Security & Sandbox Attribute
Embedding third-party content carries inherent security risks, such as clickjacking or malicious script execution. The sandbox attribute is the standard defense mechanism. When applied, it applies severe restrictions to the embedded content, disabling scripts, forms, and popups by default.
You can systematically re-enable specific capabilities using the sandbox attribute's space-separated values, like sandbox="allow-scripts allow-same-origin". Additionally, the allow attribute dictates access to browser features such as the camera or microphone.
