iframe (Inline Frame)

An iframe (inline frame) is an HTML element, <iframe>, that displays a separate document inside a page. The embedded page runs in its own browsing context, with its own scripts and styles.

Why it matters

Iframes make it easy to include YouTube videos, maps, payment forms and ads. They also bring performance and security concerns: the embedded site can be slow or down, and a malicious site can try to frame yours for clickjacking. Headers let you control who may frame your pages.

If an embedded widget is slow or its provider has an outage, only that frame fails, but visitors still see an empty box on your page, so critical content should not depend on third-party frames.

Example

<iframe src="https://www.example.com/embed/42" width="560" height="315" loading="lazy" sandbox="allow-scripts"></iframe>

To prevent others framing your page, send Content-Security-Policy: frame-ancestors 'self'.

Common mistakes

• Embedding untrusted content without the sandbox attribute.
• Letting your pages be framed by any site, enabling clickjacking.
• Loading many iframes above the fold and slowing the page.

Related

• CSP
• HTML
• HTTPS
• CORS
• टूल: Security headers checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.