The iframe sandbox attribute strips an embedded page of most powers. An empty value applies every restriction, and each token you add lifts one. Start empty, add only what the embed needs, and never combine allow-scripts with allow-same-origin for content from your own origin.
What an empty sandbox does
Per MDN, without allow-same-origin the content gets a special origin that fails the same-origin policy, so storage, cookies and some APIs are blocked. Without allow-scripts, scripts do not run. Forms render but do not submit. Popups silently fail. Navigating the top window is blocked.
Common tokens
| Token | Lifts |
|---|---|
| allow-scripts | Script execution |
| allow-same-origin | The special origin, restoring the real one |
| allow-forms | Form submission |
| allow-popups | window.open and target blank |
| allow-downloads | Downloads |
| allow-modals | alert, confirm, prompt, print |
| allow-top-navigation | Navigating the top window |
| allow-top-navigation-by-user-activation | Same, after a user gesture |
| allow-popups-to-escape-sandbox | New windows leave the sandbox |
The combination to avoid
If the embedded document is same-origin with your page, allow-scripts plus allow-same-origin lets it remove its own sandbox attribute. MDN says this is strongly discouraged, since it is then no safer than no sandbox.
<iframe sandbox="allow-scripts" src="https://widget.example.net/embed"></iframe>
This form runs scripts but keeps the content on a unique origin. For user-generated HTML, serve it from a separate origin and keep it sandboxed.
Pair it with other controls
- The allow attribute sets a Permissions Policy for the frame, see Permissions-Policy.
- The referrerpolicy attribute limits what the frame request reveals, see Referrer-Policy.
- Your page's frame-ancestors setting controls who may embed you, see frame-ancestors vs X-Frame-Options.
A rollout approach
List every iframe in your templates. For each, write down what it must do, set sandbox empty, and add tokens until the feature works. Record the reason for each token in code review. Repeat when a vendor changes its embed.
Safeguard note
Embedded vendors are dependencies too. Safeguard's SBOM and dependency scanning and the free scan at gold.safeguard.sh/scan cover the packages you ship, while this checklist covers the frames.
Quick check
Does sandbox stop clickjacking?
No. It restricts the embedded page. Preventing your page from being framed is a job for frame-ancestors.
Why does my embed show a blank or broken page?
A missing token is the usual cause, often allow-scripts or allow-forms. Add one at a time and retest.
Sources
Last reviewed: 19 October 2026.
