HTML Validation

Bad value “allow-storage-access-by-user-activation” for attribute “sandbox” on element “iframe”: The string “allow-storage-access-by-user-activation” is not a valid keyword.

About This HTML Issue

The value allow-storage-access-by-user-activation is not a valid keyword for the sandbox attribute of the iframe, as it’s still an experimental value.

The sandbox attribute enables an extra set of restrictions for the content in an iframe. You can add specific keywords to relax certain restrictions, such as allow-scripts, allow-forms, allow-popups, and others.

The experimental value allow-storage-access-by-user-activation is not yet a part of the official list of allowed keywords recognized by the W3C validator or the WHATWG HTML standard.

Learn more:

Last reviewed: July 15, 2025

Was this guide helpful?

Find issues like this automatically

Rocket Validator scans thousands of pages in seconds, detecting HTML issues across your entire site.

Start Free Trial See Pricing

Ready to validate your site?

Find Accessibility and HTML issues in your large sites, in seconds. Get your site scanned by Axe Core and W3C Validator with just one click.

Pro Trial Free Trial

Reading time

1 min read

Category

HTML Validation

Engine

W3C Validator

Last reviewed

July 15, 2025

Resources

Related W3C Validator Issues (17)

Bad value “X” for attribute “sandbox” on element “iframe”: Setting both “allow-scripts” and “allow-same-origin” is not recommended, because it effectively enables an embedded page to break out of all sandboxing.

The sandbox attribute is used with the iframe element to isolate the content of the embedded document from the rest of the page. It helps prevent malicious code from running on your website. However, the value assigned to the sandbox attribute in your iframe element includes both the allow-scripts and allow-same-origin options. This combination essentially removes all the protections that the sandbox attribute provides and allows the embedded document to break out of the sandbox.

To fix this issue, you should remove the allow-scripts and allow-same-origin values from the sandbox attribute. Instead, you should explicitly enable only the permissions that the embedded document requires.

Here’s an example iframe element with the proper use of sandbox:

<iframe src="https://example.com" sandbox="allow-forms allow-popups"></iframe>

This iframe element loads the https://example.com URL and has its sandbox attribute set to only allow-forms and allow-popups. This explicitly enables only the permissions that the embedded document may need, while also retaining the protections of the sandbox attribute.

Attribute “seamless” not allowed on element “iframe” at this point.

Bad start tag in “iframe” in “noscript” in “head”.

There is an iframe tag inside a noscript tag that is itself inside the head section of the HTML document. This is not allowed because an iframe cannot be nested inside the head section.

To fix this issue, you may move the noscript section that contains the iframe tag outside of the head section, and ensure that it is placed within the body section of the HTML document.

For example, this is invalid HTML because the head section cannot contain iframe elements:

<!DOCTYPE html>
<html lang="en">
  <head>
    <title>My webpage</title>
    <noscript>
      <p>Please enable JavaScript to view this website</p>
      <iframe src="https://example.com/"></iframe>
    </noscript>
<!-- Other meta tags and styles go here -->

  </head>
  <body>
<!-- Rest of your webpage content goes here -->

  </body>
</html>

Moving the noscript inside the body section fixes the issue, as that’s where iframe elements belong:

<!DOCTYPE html>
<html lang="en">
  <head>
    <title>My webpage</title>
<!-- Other meta tags and styles go here -->

  </head>
  <body>
    <noscript>
      <p>Please enable JavaScript to view this website</p>
      <iframe src="https://example.com/"></iframe>
    </noscript>
<!-- Rest of your webpage content goes here -->

  </body>
</html>

Bad value for attribute “src” on element “iframe”: Illegal character in query: “[” is not allowed.

Illegal character “[” in the iframe src URL requires percent-encoding or removal.

The iframe element’s src must be a valid URL. According to URL syntax, characters like [ and ] are not allowed in the query unless percent-encoded. If your src contains array-like parameters (e.g., filters[category]=news), encode reserved characters: [ becomes %5B and ] becomes %5D. Avoid spaces and encode other reserved characters as needed. Alternatively, adjust the server to accept dot or bracketless notation (e.g., filters.category=news or filters_category=news) so the URL stays valid without encoding.

HTML Examples

Example causing the validator error

<!DOCTYPE html>
<html lang="en">
<head>
  <title>Iframe URL Error</title>
</head>
<body>
<!-- [ and ] are illegal in URLs unless encoded -->

  <iframe src="https://example.com/embed?filters[category]=news&filters[tags]=web"></iframe>
</body>
</html>

Fixed example with percent-encoding

<!DOCTYPE html>
<html lang="en">
<head>
  <title>Iframe URL Fixed</title>
</head>
<body>
<!-- Encode [ as %5B and ] as %5D -->

  <iframe src="https://example.com/embed?filters%5Bcategory%5D=news&filters%5Btags%5D=web"></iframe>
</body>
</html>

Bad value “” for attribute “src” on element “iframe”: Must be non-empty.

An <iframe> element allows to embed an HTML document inside another HTML document, and its src attribute is indicated the source URL of the embedded web page. The src attribute is a required attribute, so it cannot be blank.

Example:

<iframe src="https://example.com/map.html"></iframe>

Bad value “” for attribute “(width|height)” on element “iframe”: The empty string is not a valid non-negative integer.

Bad value “true” for attribute “allowfullscreen” on element “iframe”.

The allowfullscreen attribute is used to allow an iframe to activate fullscreen mode. As a boolean attribute, it should only be declared without any value.

Here is an example of correct usage:

<iframe src="https://example.com" allowfullscreen></iframe>

However, this is now a legacy attribute, and has been redefined as allow="fullscreen", as part of the more general Permissions Policy:

<iframe src="https://example.com" allow="fullscreen"></iframe>

Bad value X for attribute “height” on element “iframe”: Expected a digit but saw Y instead.

The value used in the height attribute on element iframe is not a valid integer. Remove any leading or trailing spaces from the attribute value.

Here’s an example:

<iframe width="560" height="315" src="your-video-link" frameborder="0" allowfullscreen></iframe>

Bad value X for attribute “name” on element “iframe”: Browsing context name started with the underscore.

The value of the name attribute on an <iframe> should not start with an underscore (_).

Browsing context names that begin with an underscore are reserved keywords in HTML, like _blank, _self, _parent, and _top. Using these reserved names or any custom name starting with an underscore for the name attribute of an <iframe> can lead to unexpected behavior and is considered invalid HTML.

Here’s how to fix the issue:

Problematic Code

<iframe src="https://example.com" name="_example"></iframe>

Solution

To resolve this issue, you should use a valid value for the name attribute that does not start with an underscore.

Corrected Code

<iframe src="https://example.com" name="example"></iframe>

Steps:

Identify the iframe element with the invalid name attribute value that starts with an underscore.
Replace the name value with a valid identifier that does not start with _. Use letters, numbers, hyphens (-), and underscores (_) (but not at the beginning).

Bad value X for attribute “src” on element “iframe”: Illegal character in fragment: “#” is not allowed.

The URL in the src attribute value for an iframe is invalid as it contains an unexpected hash (#) character.

There’s an unexpected, possibly duplicate, hash character in the URÑ.

Examples:

Incorrect:

<iframe src="https://example.com/#?secret=123#abc"></iframe>

Correct (using only the query string):

<iframe src="https://example.com/#?secret=123"></iframe>

Correct (using the query string and a hash fragment) :

<iframe src="https://example.com/?secret=123#abc"></iframe>

Ready to validate your sites?
Start your free trial today.

Pro Trial Free Trial