The <iframe> tag
The <iframe> tag embeds another HTML document inside the current page as a separate nested browsing context.
Syntax
<iframe src="https://example.com/widget" title="Content description"></iframe>Attributes
| src / srcdoc | The URL of an external document, or srcdoc to embed HTML directly as an attribute value. |
| sandbox | Restricts what the frame's content can do. An empty sandbox="" applies maximum restrictions (no scripts, no same-origin access); individual tokens (allow-scripts, etc.) relax specific restrictions. |
| allow | A Permissions Policy for the frame: camera, microphone, geolocation, etc. |
| loading | "lazy" defers loading the frame until it's near the viewport. |
| title | Required for accessibility — describes what the frame's content is. |
Example
<iframe src="https://www.youtube.com/embed/VIDEO_ID" title="Video" loading="lazy"></iframe>
Notes
- Even without the sandbox attribute, cross-origin frame content is already isolated by the browser's same-origin policy — sandbox adds extra explicit restrictions, even for same-origin content.
- sandbox="allow-scripts allow-same-origin" together effectively removes the isolation — avoid that combination for untrusted content.
Accessibility
- Without a title, screen readers just announce the frame as "iframe" with no explanation of its content.