Skip to main content
no code neededunlimited viewsfree forever

Free Facebook Review Widgets via iFrame

Embed Facebook reviews on environments that strip <script> tags — locked-down CMSes, SharePoint, ServiceNow, WordPress.com Free, intranet portals. Facebook has no official embed at all; BlooTrue's iframe URL works wherever HTML is allowed.

Build Your Facebook Review Widget

Facebook

Key facts: universal <script>-tag fallback · fills Facebook's missing embed gap · no Facebook API key required · works on script-restricted CMSes · same renderer as the script embed · manual min-height (600–800px typical)

Last updated ·by Mike Ragimov

SEO + AI schema · paid plans

Star ratings in search results, on paid plans

Paid widgets add schema.org Review and AggregateRating JSON-LD to the page they sit on, so search engines and AI answer engines can read your Google reviews as structured data. The free plan shows the reviews without the schema. See how the schema works

Why Use the iFrame Embed for Facebook Reviews?

Facebook publishes no embed at all. The iframe approach works wherever HTML is allowed — including the places scripts can't run.

Bypasses Script-Stripping CMSes

Locked-down enterprise CMSes and intranet portals strip <script> tags by policy. The iframe is a static HTML element — it always survives. SharePoint, ServiceNow, WordPress.com Free, custom IT-locked CMSes.

Fills Facebook's Missing Embed

Facebook doesn't publish any embed widget — script or iframe. BlooTrue's iframe-direct URL is the only Facebook-display option for script-restricted hosts (and one of very few even on hosts where scripts work).

No Facebook API Key Required

Works with any public Facebook Page. No Facebook Fusion application, no API quotas, no business-level claim. Just paste your facebook.com/yourpage-slug URL into the BlooTrue builder on this page.

Same Renderer as Script Embed

The iframe URL is the same endpoint the script loader mounts internally. Pixel-identical Facebook review output — same theme, same styles, same data refresh cadence.

What makes a Facebook widget different from a Google review widget?

Facebook's recommendation system works differently from star-based platforms like Google. Knowing how recommendations become stars, and how Page moderation works, avoids surprises after you embed.

How BlooTrue turns Facebook recommendations into star ratings

Facebook retired numeric star ratings in 2018. Instead, visitors tap Recommends or Doesn't recommend and write a short comment, and the Page shows a percentage of people who recommend it. BlooTrue normalizes that into the star format your other widgets use: each “Recommends” renders as a 5-star review, each “Doesn't recommend” as 1 star, and the Page's overall recommendation percentage becomes a clean 0–5 star header rating. The result is a Facebook widget that looks and reads exactly like your Google or Yelp widget — no confusing percentages on your site. The header rating always comes from Facebook's own published aggregate, never from averaging the individual cards.

Where the recommendations come from and how often they refresh

BlooTrue fetches the publicly-visible recommendations from your Facebook Page on a server-side schedule — roughly once every 24 hours on paid plans — and caches the result. Your site never calls Facebook directly, so visitor traffic to your page doesn't depend on Facebook being reachable, and the widget loads instantly from cache. Only recommendations that are public on your Page are included; anything set to private or hidden by the Page owner is never pulled. Each recommendation keeps its reviewer name, photo, and comment, and links back to your Facebook Page.

Turning on recommendations and what shows up in the widget

Recommendations only appear if your Page has the Reviews / Recommendations section enabled and public. If your Page is brand new or has recommendations switched off, there's nothing for the widget to import yet — turn the section on in your Page settings and the widget will populate as soon as your first public recommendation lands. Once enabled, the widget shows whatever your Page shows publicly: no more, no less. If a recommendation disappears from your widget after a sync, it almost always means the reviewer deleted it or Facebook removed it — the widget simply follows your Page's public state.

Moderation, Community Standards, and attribution

Facebook moderates recommendations under its Community Standards and removes spam, hate speech, and content that violates its policies. Because BlooTrue reads only your Page's public recommendations, the widget automatically reflects those removals on the next sync — you never display content Facebook has already taken down. Every card keeps the Facebook mark and the reviewer's name, and clicking a review links back to your Facebook Page, so attribution stays intact. BlooTrue never fabricates a rating: an empty “Recommends” with no comment is still shown as a real recommendation, and the header number is always Facebook's own aggregate.

Facebook tips for plain HTML / iframe embed

  • For raw HTML sites, the Facebook widget loads inside its own iframe so it cannot pollute or be polluted by parent-page CSS.
  • If your site uses Content Security Policy (CSP), add `frame-src https://www.blootrue.com` to allow the Facebook widget iframe.
  • The Facebook widget works inside an iframe even on sandboxed HTML environments (e.g. CodePen embeds, MDN-style sandboxes).

Want more on Facebook itself? See the Facebook widget overview or our guide to the best review widgets for websites.

How Do I Embed Facebook Reviews via iFrame?

Four steps. The only manual bit is extracting your widget ID from the standard snippet.

1

Build Your Widget and Get the Embed Code

Use the BlooTrue builder on this page. Paste your Facebook Page URL (e.g. facebook.com/yourpage-slug), pick a style, then click Get Embed Code below to grab the standard snippet.

You only need a single value out of that snippet — the widget ID. Step 2 covers it. No Facebook API key required.

2

Pull the Widget ID Out of the Snippet

Read the snippet — your ID is the part after blootrue-widget- in the <div> class.

Example — given class="blootrue-widget-abc123", the ID is abc123. Copy just that string.

3

Replace the Snippet with an iFrame Tag

Replace the standard <script> + <div> snippet with this iframe instead:

<iframe
 src="https://api.blootrue.com/api/widgets/embed/YOUR_ID/render"
 style="border:0;width:100%;min-height:600px;"
 frameborder="0"
 title="Reviews">
</iframe>

Swap YOUR_ID for the ID you grabbed in step 2. The iframe URL is the same endpoint the script loader mounts internally — same Facebook widget, just a different mount strategy.

4

Paste the iFrame Wherever You Can Write Raw HTML

Paste the iframe wherever you can write raw HTML — locked-down CMSes, SharePoint web parts, ServiceNow content blocks, Notion HTML embeds, headless CMS rich-text fields, intranet portal pages.

Heads-up: iframe mode loses auto-resize, so set min-height generously. 600–800px is typical for Facebook widgets — pick the higher end for Grid or Masonry styles. If you set min-height too low you'll see internal scrollbars in the widget.

Reviews still auto-sync from Facebook every 24 hours.

Where Does iFrame-Only Embed Make Sense for Facebook?

Whenever the host environment strips <script> tags. Facebook has no official embed at all, so the iframe URL is the only Facebook-display option in these cases.

Locked-Down Enterprise CMSes

IT departments often configure CMSes to strip <script> tags as a baseline security policy. Iframe always survives the filter — and there's no Facebook-first-party fallback that works there at all.

SharePoint and ServiceNow Intranets

Intranet portals frequently block third-party scripts via Content Security Policy. They typically allow iframes via a dedicated "Embed" or "Page Viewer" web part. Paste the iframe URL there directly.

WordPress.com Free Plan

WordPress.com on the Free plan strips inline scripts. Self-hosted WordPress.org has no such restriction. If you're on WordPress.com Free, the iframe embed is the only path to displaying Facebook reviews.

URL-Only Embed Slots

Notion, some wikis, and headless CMSes whitelist embeds by domain rather than by script. The iframe URL pastes directly into their "Add an embed" or "Embed URL" field — no HTML editing required.

HTML Newsletters and Email Signatures

Most email clients strip both scripts and iframes, but some preserve iframes (HubSpot signatures, certain Apple Mail templates). When iframes survive, BlooTrue's iframe is the only Facebook-display option that works in that channel.

Compliance-Strict Environments

Healthcare, legal, and government sites that audit every <script> on a page often prefer iframes because the JavaScript surface area is fully sandboxed. Easier security review, fewer audit exceptions.

How BlooTrue iFrame Compares to Other Facebook-Embed Options

Facebook doesn't offer an embed. Most third-party widgets are script-only. Here's how the iframe path compares.

CapabilityBlooTrue iFrameFacebook officialScript-only widgets
Facebook embed available at all
Direct iframe URL published
Works on script-stripping CMSes
No Facebook API key needed
Sometimes
Free embed
Higher tier
No widget view caps
Pricing for full features$9/moN/A$15+/mo

Facebook Review Widget for iFrame — Universal Embed for Script-Restricted Environments

BlooTrue's Facebook Review Widget for iFrame is a free embed for environments that don't allow <script> tags — locked-down CMSes, intranet portals, email-style HTML, and any platform that strips JavaScript loaders. It's the universal escape hatch when the standard script embed is blocked. For Facebook specifically this matters more than for any other source: Facebook publishes no embed at all (neither a script widget nor an iframe URL), so on script-restricted hosts there is literally no Facebook-shipped option that works. The iframe approach works wherever HTML is allowed. Common targets: locked-down enterprise CMSes that strip <script> tags as a security policy; email signature platforms (HubSpot, Apple Mail templates) where iframes sometimes survive but scripts almost never do; intranet portals like SharePoint and ServiceNow CMS where IT blocks third-party scripts; the old WordPress.com Free plan (which strips scripts); platforms with a "URL-only" embed slot like Notion, some wikis, and headless CMSes that whitelist by domain; and HTML newsletters where the recipient's email client strips scripts but preserves iframes.

Same renderer, different mount point

The iframe URL https://api.blootrue.com/api/widgets/embed/YOUR_ID/render is the same endpoint the standard <script> loader mounts internally. iframe mode renders the exact same widget, just without the auto-resize and the script-driven mounting. Tradeoff: simpler integration, fixed height (you setmin-height manually). Visually pixel-identical to the script-embed output.

Why doesn't Facebook have an iframe embed of its own?

Facebook's Fusion API is positioned as a partner-channel product (used by sites like Apple Maps and Trivago) rather than as a merchant self-service product. Facebook does not publish a paste-ready widget the way Google publishes Place Cards — and they don't publish a direct iframe URL either. Third-party widgets are the only way to surface Facebook reviews on your own pages. BlooTrue's iframe-direct mode is the free option in that category, and the only one that works on script-restricted hosts.

About Facebook reviews in this widget

The Facebook widget embeds the recommendations left on your Facebook Page. Facebook retired star ratings for Pages in 2018, so there is no native Facebook star average; the widget shows each Recommends as a 5-star card and turns the Page's overall recommendation percentage into a 0 to 5 star figure for the header, both read from your Page. A customer leaves a recommendation by tapping Recommends or Doesn't recommend and writing a comment, which only works once Reviews are switched on in your Page settings. Many owners reach for Facebook's Page Plugin instead, an iframe of your timeline with no way to feature recommendations.

Frequently Asked Questions

Facebook only lets people click Recommends, so what rating does my widget display?

Facebook dropped numeric stars for Pages in 2018, so the widget does not invent a Facebook star average. Each Recommends becomes a 5-star card, and the header converts the Page's overall recommendation percentage into a 0 to 5 star figure. Both come from your Page, not from a calculation over the cards on your site.

Can I use Facebook's own Page Plugin to embed my recommendations?

No. The Page Plugin drops your whole Page timeline into an iframe and has no setting to show only recommendations, and Facebook's own tools cannot place them on an external site at all. The BlooTrue builder takes your Page URL instead and gives you a one-line embed, with no Facebook ad spend and no plugin required.

My Page has no Reviews tab, so where would the recommendations come from?

They only exist once you turn them on: open your Facebook Page settings, find the Reviews or Recommendations option and switch it on. Until then customers cannot tap Recommends and the builder finds nothing to import. A free widget holds the recommendations found that day; paid plans check the Page daily and drop the BlooTrue badge.

Why use the iframe embed for Facebook instead of the standard script embed?

Use the iframe embed when the host environment strips <script> tags. The standard script loader is the recommended path because it auto-resizes and mounts inline. But on locked-down enterprise CMSes, SharePoint, ServiceNow, WordPress.com Free, intranet portals, and HTML newsletters, scripts get stripped as a security policy. For Facebook specifically this matters even more: Facebook has no official embed widget at all, so there is literally no first-party fallback. BlooTrue's iframe-direct mode is the only path on those hosts. The iframe URL is the same endpoint the script loader mounts internally, so the widget itself is identical.

What environments require the iframe-only embed for Facebook?

Common ones include: locked-down enterprise CMSes that strip <script> tags as a security policy; SharePoint and ServiceNow intranet portals where IT blocks third-party scripts; the WordPress.com Free plan; Notion and other headless CMSes that whitelist embeds by domain; some wikis that allow only iframe URLs; and HTML newsletters where the recipient's email client preserves iframes but strips scripts. Since Facebook itself doesn't publish any embed (script or iframe), BlooTrue's iframe-direct is the only realistic path on these hosts.

Does Facebook offer its own iframe embed widget?

No. Facebook does not publish any embed widget — neither a script-driven one nor an iframe-direct URL. Facebook's Fusion API is gated for partner apps, not for merchant self-embedding. BlooTrue's iframe URL fills the entire gap: it pulls reviews from any public Facebook business page and renders them inside an iframe that pastes anywhere HTML is allowed.

Do I need a Facebook API key or Facebook Fusion access?

No. BlooTrue works with any public Facebook Page — no Facebook API key, no Facebook Fusion application, no business-level claim required. Just paste your facebook.com/yourpage-slug URL into the BlooTrue builder and BlooTrue pulls your real reviews from the public profile.

How do I find my widget ID after generating an embed code?

Generate the standard embed code in the BlooTrue builder, then read the <div> class. Your ID is the part after blootrue-widget- — for example, in class="blootrue-widget-abc123" the ID is abc123. Copy that string into the iframe src URL: https://api.blootrue.com/api/widgets/embed/abc123/render.

Can I auto-resize the iframe to match the widget content?

No — and this is the main tradeoff of iframe mode. Cross-origin iframes can't communicate their natural height back to the parent page without postMessage, and most script-restricted environments also strip postMessage handlers. So you have to set a manual min-height on the iframe. For Facebook review widgets, 600–800px is a reasonable default. If you need true auto-resize, use the standard script embed instead.

Does the iframe embed have the same SEO benefits as the script embed?

No — and this is a meaningful tradeoff. The schema.org Review and AggregateRating JSON-LD lives inside the iframe document, not on the host page. Google does not bubble schema from a cross-origin iframe up to the parent page, so star rich snippets won't fire on the host URL via the iframe embed. If you need rich snippets on the host page, use the standard script embed — it injects the JSON-LD directly into the host page's DOM. The iframe embed is purely a visual display option for environments where scripts aren't allowed.

Ready to Embed Facebook Reviews via iFrame?

Build your free widget in 60 seconds, swap the snippet for an iframe, and paste anywhere HTML is allowed — including the places Facebook has no first-party answer.

Build Your Widget