An iframe is a webpage inside your webpage. Powerful, occasionally dangerous, and behind every embedded map and video.
The two everyday embeds
<!-- YouTube: Share → Embed --> <iframe src="https://www.youtube.com/embed/VIDEO_ID" width="560" height="315" title="Demo video" loading="lazy" allowfullscreen></iframe> <!-- Google Maps: Share → Embed a map --> <iframe src="https://www.google.com/maps/embed?pb=..." width="600" height="450" loading="lazy"></iframe>
Security in one attribute
<iframe src="untrusted.html" sandbox="allow-scripts allow-forms"></iframe> <!-- sandbox blocks EVERYTHING; allow back only what's needed -->
Our Playground runs your code in exactly this kind of sandboxed iframe — that's why it's safe.
Why some sites won't embed
Sites send X-Frame-Options: DENY to prevent clickjacking (invisible iframes over fake buttons). You cannot iframe google.com — by design. Always loading="lazy" on embeds below the fold; each iframe is a full page load.