The Custom Code block runs your own HTML, CSS, and JavaScript, for a widget or a small script none of the built in blocks cover. It's the one block that runs arbitrary code, so it's built with a real security boundary rather than just trusting whatever you paste in.
How the sandbox works
Your code runs inside a sandboxed frame with its own isolated origin. Concretely, that means it cannot:
- Read or set your site's cookies or local storage.
- See or modify any other block on the page.
- Access your visitors' data from any other part of your site.
It can still make its own network requests to wherever you point it (an API, an analytics script, a third party widget), the same as any embedded third party code would. We don't inspect or control that traffic, see our Privacy Policy for what that means for your visitors' data.
When to use Embed instead
If you just need to show a URL someone else already built (Spotify, Figma, Calendly), the Embed block is simpler; reach for Custom Code when you're writing the HTML/CSS/JS yourself.
Tip: Only paste code from a source you trust. The sandbox protects your site and visitors from what the code CAN'T do, it doesn't review what the code actually does.