# Embed an HTML Report in Confluence — Cloud Has No HTML Macro

Canonical: https://commareports.com/embed-html-report-in-confluence
Published: 2026-08-25

> Confluence Cloud won't render an attached HTML file and has no HTML macro. Publish the report to Comma and iframe the embed URL with your Atlassian origin allow-listed — the page stays current on its own.

# Embed an HTML report in Confluence

The wiki page is where the report is supposed to live, and Confluence
gives you three unsatisfying options for getting it there.

## What doesn't work

**Attaching the file.** Confluence serves attachments as downloads. The
reader gets `report.html` in their downloads folder, without the assets
folder that shipped with it — see
[opening a local HTML file](/open-html-file-online).

**The HTML macro.** It doesn't exist in Confluence Cloud, and in Data
Center it's disabled by default. That default is correct: a macro that
renders arbitrary markup inside your wiki's own origin is a stored-XSS
surface with access to every reader's session.

**Pasting a screenshot.** Which is what most teams actually do, and why
the wiki page says "as of March."

## What does work

An iframe to a URL. Confluence Cloud has no native iframe macro, so that
part needs one of the Marketplace iframe apps — but everything on the
other side of the iframe is yours.

Publish the report to Comma, then point the iframe at:

```
https://commareports.com/embed/REPORT_ID
```

and add your Confluence origin to that report's **allowed embed
origins**:

```
https://yourteam.atlassian.net
```

The endpoint renders only for origins on that list — `frame-ancestors`
is built from the same list — so an embed URL that leaks is not a
readable report anywhere else. Clearing the list revokes every existing
embed on the next load.

## What the report has to be

The embed path is anonymous by construction, so it's fail-closed. A
report is embeddable only when all of these hold:

- visibility is **public** and the share link isn't switched off,
- it has at least one allowed embed origin,
- it has no share password,
- it isn't end-to-end encrypted,
- it isn't archived.

Anything else returns a flat 404 — the endpoint won't even confirm that
the id exists.

If the numbers can't be public-with-a-link, don't embed: put the
[share link](/share-html-report) on the page instead and let
[access control](/docs/sharing) do its job on click.

## Why this beats an exported copy

- **It doesn't go stale.** The embed serves the current revision, so a
  report refreshed [from CI](/docs/ci) or by a
  [routine](/docs/routines) updates on the wiki page by itself.
- **It stays interactive.** The report renders in a nested sandboxed
  iframe (`allow-scripts`, no `allow-same-origin`), so charts and
  filters work — see [interactive HTML reports](/interactive-html-reports).
- **Approval gating**, if you use it: the embed serves the approved
  revision, so a wiki page never shows an unreviewed number.
- **Comments live on the report**, where the context is, rather than in
  Confluence's page-level comment box at the bottom.

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history. Publish one report, allow one origin, paste one
iframe.

**[Create a report to embed →](https://commareports.com/)**

### Related

- [Embed an HTML report in your own site](/embed-html-report) — the two-line script version
- [Embed a report in Notion](/embed-html-report-in-notion)
- [Share a report in Microsoft Teams](/share-html-report-in-teams)
- [Sharing model](/docs/sharing) · [Scheduled refreshes](/docs/routines)