dont strip iframes for sanitation. If this should prevent clickjacking, websites should send the clickjacking prevention headers. This default setting filters out youtube videos for instance