> For the complete documentation index, see [llms.txt](https://docs.customiframe.com/llms.txt).
> Use it to discover all available pages before exploring further.

# Sandbox and Security in iFrame in Elementor

Control sandbox permissions and referrer policy for embedded iFrames in Elementor using the Custom iFrame WordPress plugin.


## Overview

Custom iFrame lets you control the security settings for any embedded iFrame in Elementor. Use sandbox permissions to restrict what the embedded content can do, and set a referrer policy to control what information is sent to the embedded site.

Custom iFrame is a WordPress plugin by CoderzStudio that embeds 100+ external sources in Elementor and Gutenberg without writing any code.

Basic sandbox and referrer policy settings are free. Advanced Embed Security options require Custom iFrame Pro.

Using Gutenberg? See [Sandbox and Security in iFrame in Gutenberg](/gutenberg/advanced/iframe-sandbox-security).

## Requirements

- [Custom iFrame plugin installed and active](/getting-started/installation)
- Elementor Free or Pro installed

## What Is the iFrame Sandbox?

The `sandbox` attribute restricts what an embedded page can do inside your site. By default, Custom iFrame embeds content without a sandbox, so the content behaves as it normally would.

Enabling sandbox restrictions can:

- Prevent the embedded page from running scripts
- Block the embedded page from submitting forms
- Stop popups and redirects from opening
- Prevent the embed from accessing top-level navigation

Enable restrictions only when you need them. Overly restrictive sandbox settings can break the embedded content.

## Step 1: Add the Custom iFrame Widget

<Steps>
  <Step title="Open your page in Elementor" icon="layout" title-type="p">
    Go to your WordPress dashboard. Open the page where you want the embed. Click **Edit with Elementor**.
  </Step>
  <Step title="Add the Custom iFrame widget" icon="search" title-type="p">
    In the Elementor widget panel, search for **Custom iFrame**. Drag the widget into your page layout.
  </Step>
  <Step title="Paste the embed URL" icon="clipboard" title-type="p">
    In the **Content** tab on the left panel, paste the URL of the content you want to embed into the **Source URL** field.
  </Step>
</Steps>

## Step 2: Configure Sandbox Permissions

<Steps>
  <Step title="Find the Security section" icon="shield" title-type="p">
    In the **Content** tab of the widget panel, scroll down to the **Security** or **Sandbox** section.
  </Step>
  <Step title="Enable sandbox restrictions" icon="toggle-right" title-type="p">
    Toggle **Enable Sandbox** to on. A list of permission toggles appears.
  </Step>
  <Step title="Allow only the permissions you need" icon="check-square" title-type="p">
    Turn on only the permissions the embedded content requires:

    - **Allow Scripts:** Let the embedded page run JavaScript.
    - **Allow Same Origin:** Treat the embed as same-origin. Required for many interactive embeds.
    - **Allow Forms:** Let the embedded page submit forms.
    - **Allow Popups:** Let the embed open new windows or tabs.
    - **Allow Modals:** Let the embed show alert, confirm, or prompt dialogs.
    - **Allow Top Navigation:** Let the embed redirect the top-level page.
    - **Allow Presentation:** Allow the embed to use the Presentation API.
  </Step>
</Steps>

<Callout kind="alert">
  Enabling sandbox without turning on **Allow Scripts** and **Allow Same Origin** will break most interactive embeds. Start with both enabled and remove permissions only if needed.
</Callout>

## Step 3: Set the Referrer Policy

<Steps>
  <Step title="Find the Referrer Policy setting" icon="eye-off" title-type="p">
    In the Security section of the widget panel, find the **Referrer Policy** dropdown.
  </Step>
  <Step title="Choose a policy" icon="sliders" title-type="p">
    Select the policy that fits your privacy requirements:

    - **No Referrer:** Send no referrer information to the embedded site.
    - **No Referrer When Downgrade:** Send referrer for HTTPS-to-HTTPS only. Default browser behavior.
    - **Origin:** Send only the origin (domain), not the full URL path.
    - **Origin When Cross Origin:** Send full URL for same-origin, domain only for cross-origin.
    - **Same Origin:** Send referrer only when the embed is on the same origin.
    - **Strict Origin:** Send origin for HTTPS-to-HTTPS only.
    - **Strict Origin When Cross Origin:** Recommended for most sites.
    - **Unsafe URL:** Always send the full URL. Not recommended.
  </Step>
</Steps>

## Step 4: Publish

<Callout kind="success">
  Click **Update** or **Publish**. Your sandbox and referrer policy settings are now active on the embedded iFrame.
</Callout>

For all widget settings, see the [Set Up Custom iFrame in Elementor](/getting-started/elementor-setup) guide.

This guide showed you how to configure sandbox permissions and referrer policy in Elementor using the Custom iFrame plugin. These settings let you control exactly what the embedded content can do inside your site.

## FAQ

<ExpandableGroup>
  <Expandable title="Will enabling the sandbox break my embed?" default-open="false">
    It can, if you restrict permissions the embed needs. Most interactive embeds require Allow Scripts and Allow Same Origin at minimum. Start with those enabled and test the embed before removing other permissions.
  </Expandable>
  <Expandable title="What is the difference between sandbox and referrer policy?" default-open="false">
    Sandbox controls what actions the embedded page can take inside your site (run scripts, open popups, submit forms). Referrer policy controls what URL information your site sends to the embedded domain when the iFrame loads.
  </Expandable>
  <Expandable title="Which referrer policy should I use for most sites?" default-open="false">
    **Strict Origin When Cross Origin** is the recommended default for most sites. It sends the origin (domain) for cross-origin requests but sends the full URL for same-origin requests.
  </Expandable>
  <Expandable title="Do sandbox settings affect performance?" default-open="false">
    No. Sandbox settings are security constraints applied by the browser. They do not affect page load speed or the rendering of the embedded content.
  </Expandable>
</ExpandableGroup>

---

## Related Guides

- [Set Up Custom iFrame in Elementor](/getting-started/elementor-setup)
- [Auto Refresh in iFrame in Elementor](/elementor/advanced/iframe-auto-refresh)
- [Custom Attributes in iFrame in Elementor](/elementor/advanced/iframe-custom-attributes)
- [Sandbox and Security in iFrame in Gutenberg](/gutenberg/advanced/iframe-sandbox-security)
- [Embed Blocked or Refused](/troubleshooting/embed-blocked)