# Sandbox Iframes From Untrusted Sites in Your Content

> Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.

- Type: PHP
- Runs: Frontend only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: iframes, embeds, hardening
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-sandbox-untrusted-iframes/

## Code

```php
// Hosts whose iframes are left alone (subdomains included).
$wpide_trusted_frames = array( 'youtube.com', 'youtube-nocookie.com', 'vimeo.com', 'google.com', 'spotify.com', 'soundcloud.com' );

add_filter( 'the_content', function ( $content ) use ( $wpide_trusted_frames ) {
    if ( false === stripos( $content, '<iframe' ) || ! class_exists( 'WP_HTML_Tag_Processor' ) ) {
        return $content;
    }

    $own  = wp_parse_url( home_url(), PHP_URL_HOST );
    $tags = new WP_HTML_Tag_Processor( $content );

    while ( $tags->next_tag( 'iframe' ) ) {
        $host = strtolower( (string) wp_parse_url( (string) $tags->get_attribute( 'src' ), PHP_URL_HOST ) );

        if ( ! $host || $host === $own || null !== $tags->get_attribute( 'sandbox' ) ) {
            continue;
        }

        foreach ( $wpide_trusted_frames as $trusted ) {
            if ( $host === $trusted || substr( $host, -strlen( '.' . $trusted ) ) === '.' . $trusted ) {
                continue 2;
            }
        }

        $tags->set_attribute( 'sandbox', 'allow-scripts allow-same-origin allow-forms' );
        $tags->set_attribute( 'referrerpolicy', 'no-referrer' );
    }

    return $tags->get_updated_html();
}, 20 );
```

## Notes

Add every service you embed on purpose to $wpide_trusted_frames; sandboxed embeds from other sites may lose some features.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Sandbox Iframes From Untrusted Sites in Your Content" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/