Sandbox Iframes From Untrusted Sites in Your Content
Adds a restrictive sandbox to iframes in posts that come from sites not on your trusted list, so an embedded page cannot redirect your visitors, open pop-ups or run scripts against your site.
Opens WPIDE on
Code
// Hosts whose iframes are left alone (subdomains included).
$wpide_trusted_frames = array( 'youtube.com', 'youtube-nocookie.com', 'vimeo.com', 'google.com', 'spotify.com', 'soundcloud.com' );
add_filter( 'the_content', function ( $content ) use ( $wpide_trusted_frames ) {
if ( false === stripos( $content, '<iframe' ) || ! class_exists( 'WP_HTML_Tag_Processor' ) ) {
return $content;
}
$own = wp_parse_url( home_url(), PHP_URL_HOST );
$tags = new WP_HTML_Tag_Processor( $content );
while ( $tags->next_tag( 'iframe' ) ) {
$host = strtolower( (string) wp_parse_url( (string) $tags->get_attribute( 'src' ), PHP_URL_HOST ) );
if ( ! $host || $host === $own || null !== $tags->get_attribute( 'sandbox' ) ) {
continue;
}
foreach ( $wpide_trusted_frames as $trusted ) {
if ( $host === $trusted || substr( $host, -strlen( '.' . $trusted ) ) === '.' . $trusted ) {
continue 2;
}
}
$tags->set_attribute( 'sandbox', 'allow-scripts allow-same-origin allow-forms' );
$tags->set_attribute( 'referrerpolicy', 'no-referrer' );
}
return $tags->get_updated_html();
}, 20 );Notes
Add every service you embed on purpose to $wpide_trusted_frames; sandboxed embeds from other sites may lose some features.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.