What do you need in order to configure a Web Content widget?

• A. A non-secure HTTP URL that can be embedded.
• B. A secure (HTTPS) URL, and the URL you reference must support and allow being iFramed.
• C. A local file URL.
• D. A URL that does not require embedding permission.

Answer: (B)

The Web Content widget loads external pages inside an iframe, so you need a URL that the browser is allowed to embed. That means the page must be served over HTTPS to avoid mixed-content issues in the widget’s secure context. In addition, the target site must permit being framed; many sites send headers like X-Frame-Options or use Content-Security-Policy frame-ancestors to block embedding. If a site doesn’t allow iframing, the widget can’t display it, even if it’s secure. A local file URL wouldn’t be reachable by the widget, and a URL that “doesn’t require embedding permission” would still be blocked if the site explicitly forbids embedding. So the needed requirements are a secure HTTPS URL that the target site allows to be embedded in an iframe.