# Control user(s): ability to use / access to \<iframe\> - how?

**URL:** <https://meta.discourse.org/t/control-user-s-ability-to-use-access-to-iframe-how/277327>\
**Category:** Support\
**Created:** [August 31, 2023, 10:35am UTC](https://meta.discourse.org/t/control-user-s-ability-to-use-access-to-iframe-how/277327 "2023-08-31T10:35:07Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)\
**Post date:** [September 18, 2023, 10:18pm UTC](https://meta.discourse.org/t/control-user-s-ability-to-use-access-to-iframe-how/277327/8 "2023-09-18T22:18:41Z")

</div>

> [@lejeczek](#):
>
> I set to 0 yet users created posts with **iframes** do show up as expected

The `max oneboxes per post` setting controls the number of oneboxes that can be added to a post. The terminology could be confusing here, but a “onebox” is the way that Discourse handles links from a variety of sources. For example, if the link from the browser’s address bar for a Youtube or Vimeo video is added to a line of its own in a post, Discourse will generate a onebox video player for the link.

If you set `max oneboxes per post` to `0`, users will not be able to create these types of oneboxes.

I think what you are finding is that the setting does not prevent users from adding `iframe` elements to posts. To prevent users from adding iframes to posts, remove any of the iframe sources that are listed in your site’s `allowed iframes` site setting. Here are that setting’s default values:

 ![image](https://global.discourse-cdn.com/meta/original/4X/a/8/3/a8310d2db272276610464ee72b3941921b0fc0f4.png)

---

_[View the full topic](https://meta.discourse.org/t/control-user-s-ability-to-use-access-to-iframe-how/277327)._