Matan · Security · Content

Iframe sandbox (Security)

Third-party iframes should be sandboxed so they cannot break out into your origin easily.

Pass condition in our engine: External iframes have a sandbox attribute, or none exist.

This Security check is part of SEO-GEO scoring 2.2.1, last updated 2026-09-18. About 90 percent of the evaluation runs on the HTML we crawl, so you can verify the same pass condition with a free report.

1. Problem description

We flag cross-origin iframes without a sandbox attribute. You may need allow-scripts allow-same-origin for some widgets — add the minimum flags, not an unsandboxed frame.

2. Most common causes

  • YouTube/maps embed copied without sandbox.
  • Payment iframe from a vendor that forbids sandbox (document the exception).

3. How to fix it

  1. Add sandbox with the smallest allow-* list that still works.
  2. Prefer official embed snippets that include sandbox when provided.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free website audit

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Analyze My Website — FreeView sample report