To meet compliance requirements, the embed by code feature in ArcGIS Experience Builder’s Embed widget will be restricted to a limited set of HTML formats. Only a standard HTML iframe with URL content, HTML from five popular social media websites, and a subset of HTML tags and attributes will be allowed. These restrictions will apply to new apps created in the online edition of ArcGIS Experience Builder after March 28, 2023. For existing Experience Builder apps created before March 28, the embed by code feature will not be restricted from them until September 28, 2023. As a result, you should make recommended changes to affected apps in the online edition before September 28, 2023. Otherwise, they may not load or display as expected after that date.
What apps are affected by this change?
Existing apps built with the ArcGIS Experience Builder online edition that use the Embed widget’s embed by code feature.
What is the impact to affected apps?
The Embed widget in these apps may not load or display as expected after September 28, 2023.
What HTML formats are supported after this change?
Only a standard HTML iframe with URL content, HTML from YouTube, Facebook, Twitter, Instagram, and Vimeo, and a subset of HTML tags and attributes are supported.
When will the change take effect?
The restrictions will apply to new apps created in the online edition of ArcGIS Experience Builder after March 28, 2023. For existing apps created before March 28, 2023, the embed by code feature will not be restricted until September 28, 2023.
What changes should you make?
Depending on the kind of content you are embedding, we recommend the following four solutions.
Case 1
The format is a standard HTML iframe with URL content. For example,
<iframe width=”100%” height=”900px” src=”https://www.arcgis.com/apps/dashboards/bda7594740fd40299423467b48e9ecf6″/>
Solution: As only the src, width, and height attributes in the code will take effect after the restrictions are applied, you should configure the style of the Embed widget to replace the rest of styles defined in the code if there is any.
Case 2
You have HTML from YouTube, Facebook, Twitter, Instagram, or Vimeo. Keep in mind, only the exact code shared from these sites is supported. If the code is modified by adding a <style> tag for instance, it will not work.
Solution: The Embed widget in these apps should work after the restrictions are applied if the exact shared code from the social media site is used.
Case 3
You have embedded content that can be replaced by other widgets or features. For example, embedded Business Analyst Infographics, contact emails, or phone numbers.
<link href=”https://bao.arcgis.com/InfographicsPlayer/BAMobile/9.2/reportPlayer/scripts/esri/themes/light/main.css” rel=”stylesheet” />
<h4 style=”color: rgb(0, 74, 107);”>John Smith- <a href=”mailto:jsmith @esri.com “>jsmith@esri.com </a></h4>
<a href=”tel:19412636793″>941-263-6793</a>
Solution: Re-configure these apps by replacing the Embed widget with other widgets like Business Analyst, Text, Image, and Button etc., as well as features like the URL option to link to an email address, phone number.
Case 4
The embed content is not supported and cannot be replaced by other widgets or features. For example, the script tag is not supported.
Solution: Host the HTML on a web server, then embed it by URL or in a supported HTML formats. There are many hosting platforms, for example
We strongly recommend that you make changes to affected apps as soon as possible. Please reach out to ExperienceBuilderCompliance@esri.com with questions.
Thank you,
The ArcGIS Experience Builder Team
Article Discussion: