diff --git a/client/commonFramework/code-uri.js b/client/commonFramework/code-uri.js
index bbb84239b2..e676f3ff11 100644
--- a/client/commonFramework/code-uri.js
+++ b/client/commonFramework/code-uri.js
@@ -133,6 +133,7 @@ window.common = (function(global) {
   });
 
   common.codeUri = codeUri;
+  common.shouldRun = () => codeUri.shouldRun();
 
   return common;
 }(window));
diff --git a/client/commonFramework/update-preview.js b/client/commonFramework/update-preview.js
index 9ba986d6a0..ab99e46a6f 100644
--- a/client/commonFramework/update-preview.js
+++ b/client/commonFramework/update-preview.js
@@ -34,6 +34,11 @@ window.common = (function(global) {
   body { padding: 0px 3px 0px 3px; }
 </style>
   `;
+  const codeDisabledError = `
+    <script>
+      window.__err = new Error('code has been disabled');
+    </script>
+  `;
 
   const iFrameScript$ =
     common.getScriptContent$('/js/iFrameScripts.js').shareReplay();
@@ -74,7 +79,7 @@ window.common = (function(global) {
         preview.write(
           libraryIncludes +
           jQuery +
-          (common.codeUri.shouldRun() ? code : '' ) +
+          (common.shouldRun() ? code : codeDisabledError) +
           '<!-- -->' +
           iframeScript
         );
diff --git a/client/iFrameScripts.js b/client/iFrameScripts.js
index 2fc6ac8b69..e9d1456f88 100644
--- a/client/iFrameScripts.js
+++ b/client/iFrameScripts.js
@@ -11,6 +11,9 @@ window.$(document).ready(function() {
   var common = parent.common;
 
   common.getJsOutput = function evalJs(code = '') {
+    if (window.__err || !common.shouldRun()) {
+      return window.__err || 'code disabled';
+    }
     let output;
     try {
       /* eslint-disable no-eval */