1

I've noticed that when I embed an iframe into a post then save the update, the iframe will not be saved. It seems to be a security feature, but how can I embed the iframe anyway? and set it to accept only url source from specific domain?

Any idea?

1
  • It's strange because if you try to embed a google map there is no problem, about this problem I can't help you. For the source of scripts and other resources, you can set the content security policy. I use it on all my wordpress project and works fine, the hook you can use is the send_header
    – sialfa
    Dec 4, 2019 at 19:57

2 Answers 2

2

iframes get stripped out for security reasons, you shouldn't be trying to put embed codes directly into post content, there are other methods, such as oembed or shortcodes.

If you have the unfiltered_html capability, you can add them via the classic editor, but this capability is extremely dangerous. It also means any users who don't have this ability will strip the iframes out, as might any automated processes.

So How Do I Embed Things In My Site?

There are a few options

OEmbed

If you take the URL of a Youtube video and copy paste it into the editor on its own line, it'll auto-magically turn into an iframe embed. This is OEmbed at work.

You can use OEmbed with lots of services, and there are APIs for adding your own severices. Some 3rd parties act as go betweens adding support for lots of places that don't normally support OEmbed, such as iframely

Shortcodes

You can add shortcodes in code that lets you embed things into post content. This is how plugins place forms and other complicated markup into the middle of posts.

You could even build an [iframe] shortcode

Content Security Policies and iframes

Note that some things just can't be put in iframes due to their content security policies, this isn't a WP limitation but a is fundamental to how iframes and browsers work.

7
  • Thanks Tom, but what about other visitors when they need to embed my website service into their website? What is the easiest method to provide for non technical people? Assuming they too have a word press website?
    – simo
    Dec 5, 2019 at 5:32
  • By the way, visit dcaclab.com/en/users_experiments then click on any experiment, and then in the experiment, click share, you will see how İ try to provide my visitors a code to embed the experiment on their website
    – simo
    Dec 5, 2019 at 5:34
  • Allowing other people to embed your site into theirs is a different problem with a different solution, keep in mind though that WP already provides OEmbeds for your posts that work the same as youtube embeds but with your post URLs, just make sure your content security policy allows it, and use filters to adjust what they look like
    – Tom J Nowell
    Dec 5, 2019 at 11:37
  • So, what about allowing other people to embed my service on their website? What do you recommend?
    – simo
    Dec 5, 2019 at 11:43
  • Unfortunately, your site does not support OEmbed discovery, give oembed.frdnspnzr.de a go to test it, as far as I can tell, your site has no OEmbed discovery tags. You might also need to implement a plugin to add your site as an oembed provider, or to provide a block that allows embedding those user experiments. Eitherway, this is all outside the scope of your question, and unrelated to your question. Ask a new question about it, comments are a poor and frustrating way to answer it
    – Tom J Nowell
    Dec 5, 2019 at 11:43
0

If you're using the Classic Editor, you are probably logging in as a user who does not have the unfiltered_html capability. On a regular site, an Administrator has this capability; on a MultiSite, only Super Administrators do.

One option is to give yourself the capability. For example, if you're an Editor:

<?php
/* Plugin Name: Allow Iframes */
// Update "editor" role when this plugin is updated
register_activation_hook( __FILE__, 'wpse_add_unfiltered_html' );
function wpse_add_unfiltered_html() {
    // Get whichever role you want to affect
    $role = get_role('editor');
    // Give editors "unfiltered_html" capability
    $role->add_cap('unfiltered_html');
}
?>

Another option, depending on what type of iframes you're embedding, is to use the Block Editor. It allows you to embed many iframes such as YouTube videos without any additional code needed, and this will work for users of any role.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.