onebox visits the destination page and checks for Open Graph or oEmbed tags, including:
- site address
- title
- feature image
- description (mandatory)
- product price
Please note that Discourse does require the description tag to be present and contain enough text to summarize the page, or the target link will not onebox.
Another good explanation is at Rich link previews with Onebox.
Advanced iFrames
By default <iframe> is blocked for security reasons, but if they are from a highly trusted source, a Discourse admin can explicitly whitelist that domain as an <iframe> target in the site settings.