@korg007 you need to install a plugin that allows you to see and modify user roles.
By default, I think the Administrator and Editor roles have unfiltered_html enabled. You may want to disable this feature for all roles.
unfiltered_html is useful if you must add iframes in your design – which are considered dangerous. However, that would also be the case when your website allows visitors to leave comments (a hacker could insert a malicious iframe and other visitors would be in danger).
Obviously, this is the simplest , most common scenario, there may be others I am not aware of – I just did some research and found the above.
Hope it helps.
