How to embed a PDF in Squarespace so it works on a phone

Squarespace will happily let you upload a PDF. What it won’t do is show it.

Add a file and you get a link — click it, the PDF opens in a browser tab or lands in a downloads folder, and your visitor is now somewhere that isn’t your website. If you wanted the document on the page, you need a Code Block and something worth putting in it.

The Code Block is the only real route

Add Block → Code, set the type to HTML, and paste your embed. That’s the mechanism. Everything below is about what you paste.

One Squarespace-specific note before you start: if you’re on a template where the Code Block sits in a narrow column, whatever you embed inherits that width. Check it in the editor’s mobile preview before you publish, not after.

What not to paste

<iframe src="/s/brochure.pdf" width="100%" height="800"></iframe>

This is the version in most forum answers, and it’s the one that breaks. Most mobile browsers will not render a PDF inside an iframe. On iOS Safari you’ll get a grey rectangle or a download prompt. It works perfectly on the laptop you built the site on, which is exactly why so many Squarespace sites have a broken document block nobody has noticed.

The fixed height="800" is the second problem. It’s a number that’s right on one screen size and wrong on all the others.

The Google Drive viewer trick has the same shape of flaw in a different place: it works until Google changes something, and you’ve handed your document to a third party to render.

What to paste instead

Stop embedding the file. Embed the pages.

Convert the PDF so each page becomes an image, and serve them in a viewer that’s an ordinary web page. The browser renders images and text — something it is extremely good at — rather than being asked to host a PDF reader inside a frame.

That’s what Living Page produces: upload the PDF, copy the embed snippet, paste it into the Code Block. The snippet is responsive, so it fits whatever column width your template gives it, and it drops to a single page on narrow screens rather than shrinking a spread until the text is a smudge.

The general case — and the reason this matters for every builder, not just Squarespace — is in how to embed a PDF on your website.

There’s a bonus here that catches people out later: a flipbook embed’s text can be rendered into the page, where a raw PDF embed’s can’t. Embed a 40-page catalogue as a file and all those product names and specs are invisible to search. That’s thousands of words doing nothing for the page they’re sitting on.

Controlling who reads it

Most people searching for this want more than “make it visible”. They want it visible to the right people — a trade price list, a client brochure, a book they’d rather not give away free.

Squarespace gives you one layer and the document gives you another. The useful thing is understanding which does what.

What Squarespace can do

A page-level password keeps visitors off the page unless they have it. A members area ties access to an account.

Both are solid, and both share one blind spot: they protect the page, not the embed. The iframe’s URL is public. Anyone who views the source of your protected page can copy that address and open it straight from a logged-out browser, having never seen your password.

That isn’t a Squarespace flaw — it’s true of every builder. It’s just rarely mentioned.

What the document can do

This is the layer that closes that gap.

Restrict the embed to your own domains. Name the sites allowed to frame the document, and the browser refuses to render it anywhere else. On Living Page that’s Solo and up. If someone lifts your iframe onto their own site, they get nothing. Worth being precise, though: this restricts framing, not reading — a person with the share link still opens it directly. It stops republishing, not determined access.

Put a password on the document itself. Now the lifted URL is worthless too, because the gate travels with the document rather than with the page. Shared passwords have the usual weakness — one secret for everyone, and you can’t tell who’s reading — which I went into in password-protecting a PDF.

Ask for an email. Good for building a list. Not access control: anyone can type anything and get in. Don’t confuse it with a lock, because the UI makes them look like siblings.

Charge for access. If the document is the product, selling access beats gating it — a buyer pays, reads, and there’s no file circulating. Studio and up. The long version: selling a document without a storefront.

The combination that actually works

For members-only content on Squarespace, use both layers: a members area or page password on the Squarespace side, and a domain restriction on the document side.

Squarespace handles who signs in. The domain restriction means the embed URL someone extracts from that page won’t work anywhere else. Neither alone is enough; together they close the obvious holes.

The part worth being honest about

You cannot stop someone sharing a document they are allowed to read. Not here, not with Issuu or Flipsnack, not anywhere.

Anyone who can see a page can screenshot it. Removing the download button means there’s no original file to pass around, which is a genuine improvement over emailing a PDF — but it is not the same as making something uncopyable, and nothing that renders in a browser ever will be.

What you’re actually buying with the controls above:

Control	What it stops	What it doesn’t
Domain restriction	Your embed appearing on other sites	Someone opening the share link
Document password	People without the password	The password being forwarded
Email gate	Nothing — it captures addresses	Anyone at all
Paid access	Reading without paying	A buyer screenshotting it
Members area	Visitors without an account	A member sharing what they see

Read that table before you decide, rather than after a customer asks why their colleague could open it.

A quick checklist

• Use a Code Block set to HTML — the file upload is a download link, not an embed
• Don’t point an iframe at a raw .pdf; check any embed on a real phone before publishing
• Keep it responsive; a fixed height is wrong everywhere but your monitor
• Add loading="lazy" for anything below the fold
• Protecting the Squarespace page does not protect the embed URL — restrict the document too
• If the document is the product, sell access rather than hiding it

Shortest version: Code Block, a flipbook embed rather than a raw file, and a domain restriction so the snippet only works on your site.