8

I'm running a site that only communicates over SSL/https so if I embed a youtube video using http I will get an error message saying the site is'nt fully secure. Is it possible to rewrite something so that WordPress accepts https and still auto embeds youtube links added to the content area? Cause now, when I try to embed a https youtube link, all that is shown is the URL, no movie.

Update

I've tried to add providers using this code in functions.php but it does nothing:

wp_oembed_add_provider('https://youtu.be/*', 'https://youtube.com/oembed' );
wp_oembed_add_provider('#https://(www\.)?youtube.com/watch.*#i', 'https://youtube.com/oembed', true);
wp_oembed_add_provider('http://youtu.be/*', 'https://youtube.com/oembed' );
wp_oembed_add_provider('#http://(www\.)?youtube.com/watch.*#i', 'https://youtube.com/oembed', true);
2

4 Answers 4

5

http://core.trac.wordpress.org/ticket/18719 has a working patch now.

Edit: Plugin code to do similar until patch gets in:

wp_oembed_add_provider('#https://(www\.)?youtube.com/watch.*#i', 'http://youtube.com/oembed?scheme=https', true);
wp_oembed_add_provider('https://youtu.be/*', 'http://youtube.com/oembed?scheme=https', false );
1
  • Yes, I've commented in that trac ticket as well. Thanks!
    – Richard B
    Commented Feb 6, 2012 at 20:07
7

Otto's solution doesn't work in WP 3.6, presumably because the oembeds have changed in core and now do match https://, so the added providers never get matched. Although https:// matches in core now, it always provides an http:// embed even if the original URL is https://, so we still have the same problem here.

I've decided to just convert all oembeds protocol-relative:

function my_embed_oembed_html( $html ) {
    return preg_replace( '@src="https?:@', 'src="', $html );
}
add_filter( 'embed_oembed_html', 'my_embed_oembed_html' );
2
  • 1
    Looking for some temporary solution for this bug until it's fixed in core, this was the only working one. Thanks! Never got the wp_oembed_add_provider() variants to work, for example. Commented Sep 13, 2013 at 18:56
  • It's 2015, this bug doesn't seem to be resolved yet??
    – bart
    Commented Sep 21, 2015 at 3:16
2

you could hack a forced https return in the functions.php file to search for iframes that have a src starting with http and replace https. [I left off the 'be' of these urls since some of the share urls are youtu.be and youtube.com]

//Embed Video Fix
function add_secure_video_options($html) {
   if (strpos($html, "<iframe" ) !== false) {
        $search = array('src="http://www.youtu','src="http://youtu');
        $replace = array('src="https://www.youtu','src="https://youtu');
        $html = str_replace($search, $replace, $html);

        return $html;
   } else {
        return $html;
   }
}
add_filter('the_content', 'add_secure_video_options', 10);
1
  • Thanks - you could also sumply change http:// to just // to follow the schema of the hosting site. Note sure why WP doesn't do this by default (where the host supports both protocols)
    – Adam
    Commented Jun 15, 2014 at 20:26
1

Youtube supports https urls for videos (just add the "s" into the regular url). However, they also state that:

In particular, only the YouTube player code is accessible via HTTPS at this time. The actual video bitstream, and some additional content loaded by the YouTube player may still be accessed via standard HTTP connections when you use an HTTPS URL in your embed code.

So it looks like you won't be able to get https video feeds just yet. This appears to be confirmed by the trac link you posted: (Comment 7 by Otto42) "Until YouTube returns https results in the iframe, embedding such a link would just result in a broken page in most browsers, since the iframe isn't SSL."

Reference: http://apiblog.youtube.com/2011/02/https-support-for-youtube-embeds.html

You might also check out this solution: http://www.adammershon.com/display-youtube-videos-on-ssl-page/ (This would essentially "serve" the video as if it were on your page.)

(I don't see anything newer about the subject.)

1
  • But that doesn't mean the iframe can't be https so that at least the player code is loaded that way. The page you link says it can. in my testing putting a https src on the iframe works fine on a https site whereas a http src does not display - but even if I put a https link the [embed] I get an iframe with http.
    – Adam
    Commented Jun 15, 2014 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.