iframe-shield logo iframe-shield Developer SDK
Engine Active
Star
OPEN-SOURCE WEB SECURITY SDK

Protect your application
from hostile iframes.

Block rogue ads, popups, redirects, and unsafe third-party frames before they reach your users. A client-side security layer that neutralizes threats at the DOM boundary.

View Documentation Open Playground GitHub npm v1.0.1
Size: < 4 KB gzipped
Dependencies: Zero
Runtime: Client-side
Types: TypeScript Included
License: MIT
EXECUTION PIPELINE • DOM INTERCEPTION MODEL REAL-TIME ANALYSIS
Boundary Hook
Iframe Creation
Intercepts createElement, appendChild, and dynamic mutations.
→
Classifier Engine
Security Evaluation
Checks whitelist, blacklist, 1×1 pixels, and clickjack overlays.
→
ALLOW
YouTube, Stripe, verified providers
SANDBOX
Disarm popups & top-redirects
BLOCK
Detach from DOM / about:blank
SDK CAPABILITIES

Engineered for deterministic iframe control.

Pre-emptive Interception

Wraps DOM creation APIs before the browser initiates network requests, preventing malicious scripts from starting execution.

Mutation Monitoring

Continuous background MutationObserver inspection catches elements dynamically injected via innerHTML, React, or Vue.

Safe Sandboxing

Strictly omits allow-top-navigation and allow-popups, preventing embedded video player click hijacks and spam tabs.

Trusted Whitelist

Pre-calibrated support for YouTube, Vimeo, Stripe, PayPal, reCAPTCHA, and Cloudflare Turnstile without breaking user workflows.

Tracking Pixel Defense

Identifies and neutralizes hidden 0×0 and 1×1 surveillance frames and affiliate tracking scripts.

Security Telemetry

Comprehensive real-time reporting via getStats() and onBlocked() callbacks for telemetry streaming and audit logging.

ARCHITECTURE

Security at the DOM boundary

Unlike network firewalls or DNS ad-blockers, iframe-shield operates inside the client browsing context, evaluating every frame element as it enters the page lifecycle.

STEP 01

Boundary Interception

document.createElement('iframe') and Node.prototype.appendChild are wrapped synchronously.

STEP 02

Threat Classification

Source URL, hostname patterns, overlay opacity, and standard ad dimensions are evaluated.

STEP 03

Policy Enforcement

Safe sandbox flags are attached, neutralizing top-level navigation and unrequested popups.

INTERACTIVE WORKBENCH

Live Attack Simulator & Console

Frames Scanned
0
Threats Blocked
0
Frames Sandboxed
0
Active Mode
SANDBOX
Attack Simulator
Simulate Hostile Frames & Ad Networks
Verify Legitimate Embeds
LIVE FRAME INSPECTOR WAITING FOR INPUT
URL —
DOMAIN —
CLASSIFICATION —
ACTION —
No iframes mounted. Click any test action above to simulate.
Security Event Console
LIVE
IFRAME_SHIELD_MONITOR.log
SYSTEM INIT READY
IframeShield engine active. Monitoring DOM boundaries...
All events stream from client runtime. Zero synthetic metrics.
INTEGRATION

Drop-in security across frameworks.

index.html 
<!-- Drop this into your <head> tag to protect the entire page -->
<script src="https://cdn.jsdelivr.net/npm/@jojin1709/iframe-shield/dist/iframe-shield.min.js"></script>