iframe Sandboxing and Permissions Policy

Untrusted content in an iframe (third-party widgets, user-submitted HTML previews, embedded games) should not have full browser capabilities. The sandbox attribute restricts what the iframe can do, reducing the damage if it turns out to be malicious.

<iframe sandbox src="..."> with no value applies every restriction: no scripts, no forms, no popups, no top-level navigation, no plugins, treated as a unique origin. Use this as the starting point and add only what the embedded content needs.