Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Configure an <iframe> by choosing the right source, giving the frame an accessible title, sizing it for your layout, and granting only the permissions its content needs. Add lazy loading and a referrer policy when appropriate, then test the actual embed: sandbox requirements and browser behavior vary by provider and use case.
Build a usable, accessible iframe
For a remote page or widget, set src to its URL. Give the frame a concise title that identifies its content; screen-reader users need to understand what the frame contains before entering it. The width and height attributes are expressed in CSS pixels. If omitted, MDN documents defaults of 300 by 150 pixels. Use CSS to make the frame fit different viewport widths.
<iframe
src="https://example.org/widget"
title="Example organization widget"
width="600"
height="400"
loading="eager"
referrerpolicy="strict-origin-when-cross-origin"
sandbox="allow-scripts">
</iframe>This is a starting example, not a universally safe or functional recipe. The required sandbox tokens depend on what the embedded application does. Check the provider’s documentation and test the exact embed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a basic responsive layout, put the dimensions in CSS rather than relying on a fixed width:
#1 Best Overall
- HTML CSS Design and Build Web Sites
- Comes with secure packaging
- It can be a gift option
iframe {
display: block;
width: 100%;
max-width: 100%;
border: 0;
}
.embed {
width: 100%;
aspect-ratio: 16 / 9;
}<div class="embed">
<iframe
src="https://example.org/widget"
title="Example organization widget"
loading="lazy">
</iframe>
</div>Choose an aspect ratio suited to the content; a form or document may need a different height. An iframe creates a separate browsing context and uses memory and other resources, so avoid adding frames that the page does not need. (Sources: MDN; WHATWG HTML Standard.)
What do the iframe attributes do?
| Attribute | Purpose and important behavior |
|---|---|
src |
URL of the remote resource loaded in the frame. |
srcdoc |
Inline HTML for the frame. When both srcdoc and src are specified, srcdoc takes precedence. Relative URLs in the inline markup resolve against the embedding page’s URL. |
width, height |
Frame dimensions in CSS pixels. CSS can override them for responsive presentation; MDN lists defaults of 300 by 150 pixels when the attributes are omitted. |
title |
Short description that lets assistive-technology users identify the frame. |
sandbox |
Applies restrictions to the embedded document. Optional tokens lift specific restrictions, so include only those required by the embed. |
allow |
Applies Permissions Policy restrictions to features available to the frame. It cannot override the embedding page’s policy. |
loading |
eager is the default; lazy lets the browser defer an offscreen frame until it judges the frame near the viewport. |
referrerpolicy |
Controls referrer information sent when fetching the frame resource. |
For inline markup, treat user-supplied srcdoc as untrusted HTML. Use appropriate sandboxing and isolation; relative links may also behave differently if the embedding page moves.
Restrict embedded content with sandbox
An empty sandbox attribute applies sandbox restrictions without enabling the optional capabilities represented by tokens. Add capabilities only as required—for example, allow-forms for form submission or allow-scripts for scripts within the embedded document. The right combination depends on the application.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDo not casually combine allow-scripts and allow-same-origin for same-origin content. MDN warns that scripts in the frame can remove the sandbox attribute and reload the frame without those restrictions. If potentially malicious content must be embedded, serving it from a domain separate from the main site provides important isolation; sandboxing alone does not protect visitors who can access that content directly.
Sandbox restrictions can affect related browsing contexts too. A popup or new tab opened from a sandboxed frame inherits restrictions unless allow-popups-to-escape-sandbox is included; forms in the new context may fail as a result. Sandboxing can also prevent a browser’s built-in PDF viewer from loading, so it is not a portable way to restrict a native PDF preview. (Sources: MDN; MDN embedding guide.)
Limit browser features with allow
The allow attribute can set a Permissions Policy for the frame, controlling features such as camera, microphone, or fullscreen for selected origins. It adds restrictions on top of the embedding document’s Permissions-Policy header; it does not grant a feature that the parent policy disallows.
Rank #4
- Brand: Wiley
- Set of 2 Volumes
- A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers
MDN describes allowfullscreen as a legacy attribute, redefined as allow="fullscreen *". Prefer the current policy syntax where it suits the embed. The WHATWG HTML Standard notes that allow and allowfullscreen affect the active embedded document when it navigates; changing either after the document has loaded does not update permissions for that already-loaded document. (Sources: WHATWG HTML Standard; MDN.)
Choose loading and referrer settings deliberately
Defer offscreen frames when useful
loading="lazy" can defer an offscreen frame until the browser judges it near the viewport, reducing initial network work for content that is not immediately visible. Use loading="eager" or omit the attribute when the frame needs to load without that deferral. MDN notes that lazy loading is deferred only when JavaScript is enabled, as an anti-tracking measure.
Best Value
Decide what referrer information to send
MDN lists strict-origin-when-cross-origin as the default referrer policy. For same-origin requests it sends the full URL; for secure cross-origin requests it sends only the origin; for HTTPS-to-HTTP requests it sends no referrer. Set referrerpolicy="no-referrer" to omit the referrer header entirely. Avoid unsafe-url where it could disclose a page path to a less secure destination.
Handle failures, fallback access, and cross-origin communication
Do not treat an iframe’s load event as proof that its resource succeeded. For security reasons, browsers suppress iframe error events and fire load even when content fails to load. If the embedded resource matters, provide a separate link to it so visitors have another way to open the content. MDN specifically recommends an external link for PDF access; iframe elements themselves do not have fallback content.
Browser same-origin policy restricts script access between a page and a frame from another origin. For intentional cross-origin messaging, use postMessage and validate the message origin rather than assuming the other document is trustworthy.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →MDN documents responsive sizing through an opt-in from the embedded document and the CSS frame-sizing property. Browser support may vary, so check compatibility with the browsers your site supports before relying on it in production. (Sources: WHATWG HTML Standard; MDN.)
Or skip the browser setup
If you need an image or PDF capture of a page rather than a live embed, ScreenshotNeo is a website screenshot API and MCP server. A GET request can return a PNG, JPEG, WebP, or PDF; its optional cleanup removes cookie banners, newsletter popups, and chat widgets before capture. Bot checks, blank pages, and failed loads are never billed, and AI agents can take screenshots through its MCP server.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.org -o shot.webpSee the ScreenshotNeo API documentation for setup and parameters. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. Sign up for a free account.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
