HTML Safe Links, Embeds, and Content Security Policy

Links and embeds bring other people's code and pages into yours. A link that opens a new tab with target="_blank" should include rel="noopener noreferrer" so the new page cannot control the opener through window.opener and does not receive your page's address as the referrer. An iframe loads another page inside yours. The sandbox attribute removes its powers by default, and you add back only what it needs. A Content-Security-Policy, sent as a header or a meta tag, tells the browser where scripts, images, and other resources may come from, which limits the damage of an injected script. Password fields use type=password with the right autocomplete value so that password managers can work.

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self' https:">
<a href="https://example.com" target="_blank" rel="noopener noreferrer">External site</a>
<iframe src="https://example.com/widget" title="Widget"
        sandbox="allow-scripts" referrerpolicy="no-referrer"></iframe>
<input type="password" name="password" autocomplete="current-password">