Intermediate
Lock down an embedded widget
This page embeds a poll widget from another team in an iframe. It needs scripts to work, but must not be able to submit forms, open popups or act as your page's origin.
Give the iframe: a descriptive title; a sandbox that allows only scripts; referrerpolicy that sends no referrer; lazy loading; and a size of 400 × 200 pixels.
What Check tests
- The iframe has a descriptive title
- The sandbox allows scripts and nothing else
- No referrer is sent
- The iframe lazy-loads
- The iframe is 400 × 200 pixels
Stuck? One hint at a time
The solution unlocks after your first Check. Try first: that is where the learning happens.
Runs in your browser. Your code is saved here.
Your page
Press Run to see the page.
Console
Nothing logged yet.