Sandbox / iframe limitations

linkembed shows embedded content inside a secure “sandbox”. That keeps your visitors safe but also means some things that work on a normal webpage may not work inside the embed. This page explains what to expect.

Why we use a sandbox

When you embed content from another site (e.g. Google Drive, Dropbox), it runs inside a confined area (an iframe with sandbox rules). That prevents the embedded page from doing things that could harm the visitor or your page—like running unexpected scripts or redirecting in unwanted ways. Sandboxing is a standard way to make embeds safer.

What might behave differently

• Pop-ups and new windows — Some embedded sites want to open new tabs or windows. The sandbox allows “pop-ups” in a controlled way, but strict browser or device settings can still block them. If something expects to open in a new window and doesn’t, the visitor may need to use a direct link to the source in a new tab.
• Downloads — Download links inside the embed can work, but again browser or device policies can restrict them. If a download doesn’t start, the visitor can try opening the link in a new tab or using the source site directly.
• Login or forms — Pages that require login or complex forms may work inside the embed, but some sites detect that they’re in an iframe and show a “open in new tab” message. That’s a choice the source site makes, not something we can change.

Blank or “refused to display”

If the embedded site sends headers that say “don’t allow framing” (X-Frame-Options or Content-Security-Policy frame-ancestors), the browser will refuse to show it in our embed. In that case you’ll see a blank area or a browser message. That’s the source platform blocking embedding. Use a redirect link to send visitors to the content instead, and see Limitations & platforms for which services we know don’t allow embedding.

What you can do

Prefer the platform’s official embed option or embed code when they offer one. If a platform blocks embedding entirely, create a redirect link so visitors still get a clean, branded URL that takes them to the content. For behavior that depends on the embedded site (e.g. login, downloads), we can’t change how that site behaves inside the sandbox; sharing the direct link with your audience is the fallback.