Embedding a page

You can embed another page with an iframe.

<iframe
  src="https://example.com"
  title="Preview of an example page"
  loading="lazy"
  sandbox>
</iframe>

To be precise: the target page can forbid embedding with the CSP frame-ancestors directive or X-Frame-Options. The same-origin policy limits a script's access to a document from another origin.

In practice: I give sandbox the minimum permissions that fit how much I trust the embed and what it needs to do. The example has a strict sandbox — it can disable scripts and forms.

Pitfall: embedding a page doesn't automatically give you the right to read its content or control it.