Iframe recording

Last updated:

|Edit this page

PostHog can record iframes embedded in your website as long as:

  • ✅ The embedded iframe is from the same domain as the main page (e.g. https://posthog.com embeds https://posthog.com/iframe)
  • ✅ The embedded iframe is from a domain that you can install posthog-js on (e.g. https://posthog.com embeds https://app.posthog.com/iframe) - requires extra configuration

PostHog cannot record iframes embedded in your website if:

  • ❌ The embedded iframe is from a domain than is not under your control (e.g. https://posthog.com embeds https://google.com/iframe)

Recording same-origin iframes

There is nothing special that is needed if the iframe is from the same domain as the main page. As long as PostHog is installed on both the parent page and the iframe, the recording will work as expected.

Recording cross-origin iframes

🚧 Security warning: Before enabling the cross-origin recording, be aware that when using an iframe that communicates with the parent page, there are potential security risks. Ensure your Content Security Policy (CSP) only permits trusted domains and correctly employs directives like frame-src or frame-ancestors. Failure to do so can lead to security breaches where an attacker would embed your website on their domain, gaining access to the recorded content. If unsure about CSP configurations, consult your security team or reach out to PostHog support.

In order to record from a cross-origin iframe, you need to ensure that posthog-js is installed on both the parent domain and the iframe one.

In addition, PostHog needs to be initialized on both domains with an explicit configuration as below:

Web
posthog.init('<ph_project_api_key>', {
session_recording: {
// WARNING: Only enable this if you understand the security implications
recordCrossOriginIframes: true,
}
})

With this setting enabled, the child iframe will post events to the parent instead, resulting in a single replayable recording. If the parent page does not have this enabled, then the content of the embedded iframe will not be captured at all.

Make sure both domains are authorized domains for recordings.

Questions?

Was this page useful?

Next article

Console logs recording

PostHog can capture console logs from your application. This is useful for debugging and providing extra context on what is happening in your user's browser environment. As console logs can contain sensitive information, we do not capture these logs automatically. You can enable this feature globally from your project settings or client-side by setting enable_recording_console_log: true in our JavaScript web library config . Important: Console logs are recorded if either the project…

Read next article