Drupal is a registered trademark of Dries Buytaert
drupal 11.3.7 — Update released for Drupal core (11.3.7)! drupal 11.2.11 — Update released for Drupal core (11.2.11)! drupal 10.6.7 — Update released for Drupal core (10.6.7)! drupal 10.5.9 — Update released for Drupal core (10.5.9)! cms 2.1.1 — Update released for Drupal core (2.1.1)! drupal 11.3.6 — Update released for Drupal core (11.3.6)! drupal 10.6.6 — Update released for Drupal core (10.6.6)! cms 2.1.0 — Update released for Drupal core (2.1.0)! bootstrap 8.x-3.40 — Minor update available for theme bootstrap (8.x-3.40). menu_link_attributes 8.x-1.7 — Minor update available for module menu_link_attributes (8.x-1.7). eca 3.1.1 — Minor update available for module eca (3.1.1). layout_paragraphs 2.1.3 — Minor update available for module layout_paragraphs (2.1.3). ai 1.3.3 — Minor update available for module ai (1.3.3). ai 1.2.14 — Minor update available for module ai (1.2.14). node_revision_delete 2.0.3 — Minor update available for module node_revision_delete (2.0.3). moderated_content_bulk_publish 2.0.52 — Minor update available for module moderated_content_bulk_publish (2.0.52). klaro 3.0.10 — Minor update available for module klaro (3.0.10). klaro 3.0.9 — Minor update available for module klaro (3.0.9). layout_paragraphs 2.1.2 — Minor update available for module layout_paragraphs (2.1.2). geofield_map 11.1.8 — Minor update available for module geofield_map (11.1.8).
← All modules

iframeremove

340 sites Security covered
View on drupal.org

IFrames are great old way to embed content of another site to yours. This also make it a good way to start a cross-site attack.

It's both good and bad thing to let your site users to add iframe in their contents. On one hand, if a users is doing "Full HTML" in their content, they would certainly want to embed iframe (YouTube, Google Maps). But if one of your users is naughty, or if your site is somehow hacked, they would want to sneak malicious iframe attack in, too.

Can we remove all the iframe(s), except the ones we trust?

That's what this module does.

It provides a filter that you may add to text formats (Full HTML, Filtered HTML). The filter will remove every iframe it found except "src" from the whitelist.

Easy to config. Easy to use.

Usage

  1. Open your site's admin interface
  2. Go to "Configruation" > "Text formats"
  3. Open "configure" of the text format that you want to apply the filter
  4. Check "iFrame removing filter"
  5. At "Filter Settings" > "iFrame removing filter", fill-in the whitelist domains. You need to put in 1 domain per line. You may use wildcard character "*" to match multiple characters
  6. Click "Save Configurations"

Activity

Total releases
1
First release
May 2025
Latest release
11 months ago
Release cadence
—
Stability
100% stable

Releases

Version Type Release date
2.0.5 Stable May 7, 2025