Third-Party Iframe Service Detection Scanner

Web applications routinely embed content from external services using HTML iframe elements, allowing third-party video players, maps, forms, chat widgets, payment processors, and analytics dashboards to be displayed within the application's own pages. These integrations are used by organizations of all sizes to extend functionality without building every feature in-house, relying on platforms such as YouTube, Google Maps, Vimeo, Calendly, Stripe, Typeform, and Zendesk. Iframe-based embedding is a fundamental pattern in modern web development and is supported by every major browser and web framework. Marketing, support, and product teams often introduce new iframe integrations independently of security review, leading to a fragmented and sometimes undocumented dependency landscape. Each embedded iframe represents a channel through which external content is loaded and rendered within the trusted context of the hosting application. Understanding the full inventory of iframe sources across a web application is essential for managing third-party risk and maintaining a coherent content security policy.

Iframe detection refers to the automated identification of embedded frame elements within a web application and the classification of the external or internal sources they load. While individual iframe integrations are typically intentional, the cumulative set of third-party services loaded across an application's pages may not be fully known to the security team responsible for that application. Each third-party iframe introduces a dependency on an external provider whose security posture, data handling practices, and availability directly affect the hosting application. Iframes loading content over unencrypted HTTP within an HTTPS page create mixed-content conditions that degrade transport security and may expose user sessions to interception. Third-party providers embedded via iframes can introduce tracking pixels, session recording scripts, and behavioral analytics without explicit disclosure to end users, creating privacy and regulatory compliance concerns. Unauthorized or unexpected iframes, particularly those loading content from unknown external domains, may indicate a content injection attack or a supply chain compromise affecting a third-party widget provider.

The scanner fetches the root page of the target asset via a headless browser with a fallback to a plain HTTP request, then crawls up to five additional same-domain pages identified through keyword-matched anchor tags including contact, about, map, harita, and location. On each collected HTML document, iframe tag attributes are extracted using a regex that targets src, data-src, and data-lazy-src values to capture both standard and lazy-loaded frames. Each resolved absolute iframe URL is matched against a library of over forty known service patterns covering providers such as YouTube, Google Maps, Vimeo, Spotify, Typeform, Google Forms, Calendly, HubSpot, Stripe, Iyzico, TradingView, OpenStreetMap, Yandex Maps, Microsoft Teams, and Zoom. URLs that do not match a known service are classified as External if the hostname differs from the base domain or Internal if they originate from the same domain. Placeholder and non-URL src values such as about:blank, javascript:, and data: URIs are filtered out before classification. Results are emitted as labelled entries pairing the service name or classification with the full resolved iframe source URL, associated with their source pages in the detailed output.

An unreviewed iframe loading content from a compromised third-party provider can deliver malicious JavaScript into the context of the hosting application, enabling credential theft, session hijacking, or drive-by download attacks against visiting users. Iframes from unknown or unexpected external domains may represent a successful content injection attack where an attacker has modified page content through a CMS vulnerability, CDN compromise, or DNS hijacking incident. Third-party iframes from analytics, CRM, and support platforms routinely collect behavioral data, keystrokes, and session recordings from users who have not been informed of this data collection, creating GDPR and privacy regulation exposure for the organization. Frames loading over HTTP within an HTTPS application trigger mixed-content warnings that can be exploited by network-level attackers to intercept or modify the framed content before it reaches the user. A poorly sandboxed iframe from a malicious source can attempt clickjacking attacks, framing the hosting page inside its own content to deceive users into unintended interactions. Overly permissive iframe allow policies, such as those granting access to camera, microphone, geolocation, or payment APIs, can be abused by a compromised third-party provider to access sensitive device capabilities without user awareness.