Glossary · Internet & Web

iframe (Inline Frame)

An iframe is an HTML element that embeds another web page inside the current one, commonly used for maps, videos and third-party widgets.

Updated October 6, 2026

An iframe (inline frame) is an HTML element, <iframe>, that displays a separate document inside a page. The embedded page runs in its own browsing context, with its own scripts and styles.

Why it matters

Iframes make it easy to include YouTube videos, maps, payment forms and ads. They also bring performance and security concerns: the embedded site can be slow or down, and a malicious site can try to frame yours for clickjacking. Headers let you control who may frame your pages.

If an embedded widget is slow or its provider has an outage, only that frame fails, but visitors still see an empty box on your page, so critical content should not depend on third-party frames.

Example

<iframe src="https://www.example.com/embed/42" width="560" height="315" loading="lazy" sandbox="allow-scripts"></iframe>

To prevent others framing your page, send Content-Security-Policy: frame-ancestors 'self'.

Common mistakes

  • Embedding untrusted content without the sandbox attribute.
  • Letting your pages be framed by any site, enabling clickjacking.
  • Loading many iframes above the fold and slowing the page.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCSP (Content Security Policy)Content Security Policy is an HTTP header that lists which sources a page may load scripts, styles and other resources from, limiting the damage of XSS attacks.Glossary · SecurityCSP NonceA CSP nonce is a random, single-use token that marks specific inline scripts or styles as allowed under a Content Security Policy.Glossary · SecuritySubresource Integrity (SRI)Subresource Integrity lets a page declare a cryptographic hash for a script or stylesheet so the browser refuses to run the file if it has been altered.Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min readGuide · E-commerceE-commerce Site Security Checklist: 30 Checks for Online StoresA practical security checklist for online stores covering HTTPS, headers, payment pages, third-party scripts, admin access, updates, backups and monitoring.7 min readGuide · SSL & SecurityMixed Content Warnings: How to Find and Fix HTTP Resources on HTTPSUnderstand active vs passive mixed content, hunt down http:// references in HTML, CSS, JS and databases, fix them with wp-cli or CSP, and verify the result.8 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.