Comma

Embed an HTML report in Confluence

The wiki page is where the report is supposed to live, and Confluence gives you three unsatisfying options for getting it there.

What doesn't work

Attaching the file. Confluence serves attachments as downloads. The reader gets report.html in their downloads folder, without the assets folder that shipped with it — see opening a local HTML file.

The HTML macro. It doesn't exist in Confluence Cloud, and in Data Center it's disabled by default. That default is correct: a macro that renders arbitrary markup inside your wiki's own origin is a stored-XSS surface with access to every reader's session.

Pasting a screenshot. Which is what most teams actually do, and why the wiki page says "as of March."

What does work

An iframe to a URL. Confluence Cloud has no native iframe macro, so that part needs one of the Marketplace iframe apps — but everything on the other side of the iframe is yours.

Publish the report to Comma, then point the iframe at:

https://commareports.com/embed/REPORT_ID

and add your Confluence origin to that report's allowed embed origins:

https://yourteam.atlassian.net

The endpoint renders only for origins on that list — frame-ancestors is built from the same list — so an embed URL that leaks is not a readable report anywhere else. Clearing the list revokes every existing embed on the next load.

What the report has to be

The embed path is anonymous by construction, so it's fail-closed. A report is embeddable only when all of these hold:

  • visibility is public and the share link isn't switched off,
  • it has at least one allowed embed origin,
  • it has no share password,
  • it isn't end-to-end encrypted,
  • it isn't archived.

Anything else returns a flat 404 — the endpoint won't even confirm that the id exists.

If the numbers can't be public-with-a-link, don't embed: put the share link on the page instead and let access control do its job on click.

Why this beats an exported copy

  • It doesn't go stale. The embed serves the current revision, so a report refreshed from CI or by a routine updates on the wiki page by itself.
  • It stays interactive. The report renders in a nested sandboxed iframe (allow-scripts, no allow-same-origin), so charts and filters work — see interactive HTML reports.
  • Approval gating, if you use it: the embed serves the approved revision, so a wiki page never shows an unreviewed number.
  • Comments live on the report, where the context is, rather than in Confluence's page-level comment box at the bottom.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history. Publish one report, allow one origin, paste one iframe.

Create a report to embed →

Related