Safe Iframe

Safe Iframe provides a controlled way to embed external HTTPS content using the [iframe] shortcode, without granting users unrestricted HTML access.

The plugin does not allow users to paste raw <iframe> or <script> code into a Custom HTML block. Instead, users add the iframe URL using the Safe Iframe shortcode, and the plugin generates the iframe when the page is displayed.

This is particularly useful on networks where Custom HTML and JavaScript is restricted.

Note: Safe Iframe is an on-request plugin and can only be enabled by the CampusPress team. If you would like to use Safe Iframe on your network, contact CampusPress Support to request that it be enabled.

For information about restricting Custom HTML and JavaScript and other related network security controls, see Security Headers, Robots.txt and Advanced Network Settings

Add an iframe

  1. Edit the post or page where you want to add the embed.
  2. Add a Shortcode block.
  3. Add the iframe using the following format:

[iframe src="https://example.com/embed/demo" title="Demo"]

  1. Save or publish the page.


Safe Iframe checks the source URL and generates the iframe on the front end.

Supported attributes include:

AttributePurpose
srcHTTPS URL of the content to embed
widthiframe width
heightiframe height
loadingiframe loading behaviour
titleAccessible title for the embedded content
allowfullscreenAllows fullscreen display where supported
referrerpolicyControls referrer information sent by the browser
classAdds a CSS class to the iframe

What Safe Iframe does not allow

Safe Iframe applies only to content added using the [iframe] shortcode.

It does not:

  • Allow raw <iframe> code in a Custom HTML block.
  • Allow <script> tags or JavaScript embeds.
  • Automatically convert existing iframe HTML to the Safe Iframe shortcode.

If a site or user requires unrestricted HTML or JavaScript, this can instead be managed using Restrict Custom Code under Advanced Network Settings.

HTTPS and URL safety

Safe Iframe applies several checks before rendering an embed:

  • Only HTTPS URLs are supported.
  • URLs containing embedded usernames or passwords are rejected.
  • Shortcode attributes are sanitized before the iframe is rendered.

Accessible iframe titles

Where possible, provide a descriptive title attribute for your iframe.

If no title is supplied, Safe Iframe provides a fallback title. It can also identify Google Calendar and Google Maps embeds and provide an appropriate title automatically.

Restrict allowed iframe sources

Network Administrators can restrict which external sources users are permitted to embed.

Go to:

Network Admin → Settings → Safe Iframe Sources

By default, if the allowlist is empty, HTTPS sources are permitted.

Once one or more sources are added, iframe URLs must match an approved rule.

You can approve:

  • An entire host, for example https://example.com
  • A specific path prefix, for example https://example.com/embed/

Subdomains are not automatically included when a host is approved.

Source rules cannot contain custom ports, query strings, fragments, or embedded credentials.

Examples

Allowlist ruleAllows
https://example.comHTTPS embeds from the approved host
https://example.com/embed/URLs beginning with the approved path