Iframe Sanitizer
Liferay DXP 2025.Q4+
Liferay DXP includes an iframe sanitizer that controls how iframes are handled across each instance. Iframes can introduce security risks if they load external content from untrusted domains. With this sanitizer, administrators can define which iframes are allowed and under what conditions.
The configuration applies at the instance level, giving administrators fine-grained control per instance and domain.
Configuring the Iframe Sanitizer
By default, the iframe sanitizer removes <iframe> tags from most user-submitted content to prevent unsafe embeds but allows them in trusted types like web content (JournalArticle) and fragments (FragmentEntry).
You can adjust this behavior using the whitelist and blacklist settings. The whitelist defines where iframes are allowed, and the blacklist defines where they are always removed. Configure these lists according to your trust model. For example, you can allow embeds in editorial content and block them in user-generated areas such as message boards or wikis.
When iframes are allowed, you can control their behavior with the Sandbox Attribute Values field. This field specifies HTML sandbox flags like allow-scripts, allow-forms, or allow-same-origin. Leaving it blank fully sandboxes the iframe, blocking scripts, forms, and navigation for maximum security. See Mozilla’s Iframe Sandbox reference for details on these attributes.
To configure the iframe sanitizer,
-
Open the Global Menu (
), go to the Control Panel tab, and click Instance Settings. -
Click Security Tools under Security and select the Iframe Sanitizer menu on the left.
-
Adjust the configuration options as needed. Changes affect the current instance and domain only.
-
Use the plus (+) button to add further fields if you need them.
-
Click Save to apply your settings.
Default values appear until the configuration is saved for the first time.
Configuration Options
| Option | Description |
|---|---|
| Enabled | Activates the sanitizer for the current instance. |
| Remove IFrame Tags | Removes all <iframe> tags from content when enabled. |
| Sandbox Attribute Values | Defines allowed sandbox attributes applied to iframes that pass sanitization (e.g., allow-scripts, allow-same-origin, allow-presentation). |
| Blacklist | Lists asset classes or domains that must always have iframes removed. |
| Whitelist | Lists asset classes or domains where iframes are permitted. |