WordPress does not have one master “disable embeds” switch. To stop embeds, first decide whether you want to block one oEmbed provider, suppress WordPress’s host communication script, or change assets loaded inside embed iframes. Those are separate layers.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
For a single unwanted service, remove that provider from WordPress’s oEmbed registry. To suppress the legacy host script, unhook wp_oembed_add_host_js on init. Neither method rewrites iframe or block markup already saved in posts, and neither automatically removes scripts or styles loaded inside an embed iframe.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What “disable embeds” means in WordPress
WordPress uses the oEmbed protocol to turn a pasted URL into embeddable HTML. Providers can return videos, images, text and other media, while WordPress maintains an internal whitelist of providers it accepts. That architecture matters because an embed can involve several different operations:
- Provider discovery and registration: WordPress decides whether a URL belongs to an allowed provider and requests the provider’s embed response.
- Saved embed markup: A block, iframe or HTML returned during editing may already be stored in post content.
- Host-page communication: WordPress can load
wp-embedJavaScript so a parent page communicates with post-embed iframes. - Iframe assets: The iframe itself can receive scripts, styles and a custom embed template.
Consequently, removing one provider is not the same as removing wp-embed.js, and removing the host callback is not the same as deleting iframe assets. Choose the narrowest change that solves the problem.
#1 Best Overall
Choose the right control
| Goal | WordPress layer | What changes | What remains |
|---|---|---|---|
| Block one service while keeping other providers | Provider registry and oEmbed discovery | The selected provider can no longer be resolved through the removed registration. | Other whitelisted providers, saved markup and iframe assets remain. |
| Stop the legacy host communication script | wp_head callback for wp_oembed_add_host_js |
The host-side callback is removed before the head is rendered. | Saved iframe HTML, provider registration and iframe-side assets remain. |
| Change scripts or styles inside embed iframes | enqueue_embed_scripts and the iframe template |
Code specific to the iframe document can be changed. | Host-page provider discovery and unrelated front-end scripts remain. |
If your concern is one provider, use provider control. If a performance or policy audit specifically identifies wp-embed.js, use host-script control and verify it on a page that contains a real WordPress post embed.
Before changing hooks
Put custom code in a small site plugin or a child theme rather than editing WordPress core. A plugin is usually easier to keep active when the theme changes; a child theme is appropriate when the behavior belongs to that theme. Keep a copy of the current code and note which pages contain embeds.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Record the WordPress version and active plugins that create or transform embeds.
- Identify whether the unwanted output is generated by oEmbed, a block, a page builder or a plugin-rendered iframe.
- Back up the database and files before changing filters or content.
- Plan to clear page, object and CDN caches after deployment.
- Test an embedded post and a post with no embed; an empty page is not a useful test for conditional loading.
Disable one oEmbed provider
Provider removal is the narrowest option. WordPress exposes wp_oembed_remove_provider() for removing a provider from its internal registry. The important detail is that you must target the exact provider URL pattern and registration details used by your site. Provider registrations can differ between core and plugins, so inspect the registration before removing it.
1. Find the provider registration
Determine the URL pattern that matches the service you want to block and whether a plugin added or replaced the provider entry. A pattern that does not match the registered format will leave the provider active. If a plugin registers the service later in the request, your removal must run after that registration.
2. Remove the matching provider on initialization
Add the removal in your site plugin or child theme. Use the exact format value from the registration:
<?php
add_action( 'init', function () {
wp_oembed_remove_provider( $provider_format );
} );$provider_format represents the provider URL pattern registered by your site. Do not guess a pattern: confirm it first, then substitute the actual value in your implementation. If a custom provider registration also has a handler or plugin-specific callback, remove or disable that registration according to the way it was added.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Understand the result
This prevents WordPress from resolving new URLs through that provider’s oEmbed registration. It does not delete an iframe or block already saved in a post, and it does not stop a plugin from outputting its own iframe directly. A provider can therefore appear to remain active when you are looking at old content or plugin-generated markup.
4. Test an allowed provider
Open a post that uses the blocked service and confirm that it no longer receives the normal oEmbed result. Then test a different provider that should remain allowed. This catches an overbroad pattern that accidentally removes more than one service.
Suppress the WordPress host script
Historically, WordPress added a host-side callback that caused the oEmbed communication script to be printed in the page head. The compatibility-safe way to suppress that callback is:
<?php
add_action( 'init', function () {
remove_action( 'wp_head', 'wp_oembed_add_host_js' );
} );Place this code in a site plugin or child theme after WordPress has registered its default hooks. The init action is a practical location because core’s registrations are available by then.
Why the function is marked deprecated
WordPress documents wp_oembed_add_host_js() as deprecated since version 5.9.0. Core no longer uses the function as the normal implementation; it remains as a compatibility indicator so the legacy unhooking pattern continues to work. Deprecation here does not mean that the removal code is automatically harmful, but it does mean you should verify the generated page rather than assume a visible change.
Match the original hook and priority
remove_action() only removes a callback when the hook name, callback and priority match the registration. The example above uses the documented wp_head callback. If a theme or plugin registered a similar callback at a different priority, remove that specific registration with the same priority value.
What this does not disable
Unhooking the host callback does not remove provider registrations, rewrite post content or guarantee that no script named wp-embed.js appears. A plugin can enqueue its own copy, and iframe documents use a separate asset path. Treat this as a host-script change, not a universal embed switch.
Why wp-embed may still appear—or disappear without your change
Since the WordPress 5.9-era core change, wp-embed is conditionally enqueued. Core checks generated HTML for the wp-embedded-content marker before loading the script. Trac changeset 52132, recorded on 2021-11-11, documents the move away from unconditional loading.
This has two practical consequences:
- A page with no WordPress post embed may already have no
wp-embedrequest, so removing the callback appears to do nothing. - A page containing post-embed markup can still load the script, making it the correct page for verification.
Do not use a page without an embed as your only before-and-after comparison. Test both cases and inspect the actual source and network activity.
Rank #4
Iframe scripts, styles and templates are a separate layer
The enqueue_embed_scripts hook runs while WordPress queues scripts and styles for the embed iframe. The default iframe stylesheet is handled by wp_enqueue_embed_styles(). These assets belong to the iframe document, not the parent page’s host callback.
If your objective is to remove iframe CSS, replace an embed template or stop a plugin’s iframe script, inspect the callbacks attached to enqueue_embed_scripts and the template that renders the iframe. Removing wp_oembed_add_host_js alone will not remove those assets. Make the smallest change possible and verify the iframe itself, not just the outer page.
Saved content is not regenerated automatically
Hook changes affect future generation and enqueueing. They do not rewrite old post content. Existing posts may contain an iframe, a video block or other embed HTML saved by the editor. A provider can be removed today while yesterday’s posts still output the stored iframe.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Review representative posts
After deploying a hook change, inspect posts created before and after the change. Check the editor’s stored block markup and the rendered front end. If a policy requires removal from existing pages, update those posts deliberately and retain a backup; do not assume a filter will erase historical content.
Check plugin-generated markup
Some plugins and page builders render iframes directly instead of using WordPress’s oEmbed registry. In that case, provider removal may have no effect. Identify the component producing the markup before changing core hooks.
Best Value
Verification procedure
- Clear caches. Purge page, object and CDN caches so an older HTML response is not mistaken for current output.
- Open a real embed page. Use a post that contains a WordPress post embed or the specific provider you are testing.
- View page source. Search for
wp-embed,wp-embed.jsand the expected iframe markup. - Inspect network requests. Reload with browser developer tools open and check whether a host script or iframe request is made.
- Test a page without an embed. This confirms that conditional loading behaves as expected and gives you a clean comparison.
- Test an allowed provider. When blocking one service, confirm that another permitted provider still embeds.
- Test logged-out and logged-in views. Caching, editor previews and administrative toolbars can alter the generated response.
- Check plugin and theme enqueues. If the script remains, identify whether another component adds it independently.
Troubleshooting common outcomes
The script is still present on an embedded page
First confirm that your code runs and that caches are cleared. Then check whether another callback or plugin enqueues the script. Also verify that you removed the callback after registration and with the same priority. A custom embed template may load a similarly named asset independently.
Nothing changed on the test page
Confirm that the page actually contains post-embed markup. Since WordPress conditionally loads wp-embed, a page without that marker may never have requested the script in the first place.
The unwanted provider still embeds
Inspect whether the URL matches the exact registered provider pattern. A plugin may register the provider after your removal runs, or the page may contain saved iframe HTML rather than newly generated oEmbed output. Test a newly edited post and inspect the rendered source.
All embeds stopped working
Review the pattern you removed and restore the previous code if it was broader than intended. Provider removal should target one registration; host-script removal should not be used as a substitute for provider control. Check whether a plugin depends on the host communication script before keeping the change.
Iframe appearance or behavior changed unexpectedly
Inspect enqueue_embed_scripts, the default iframe stylesheet and any custom embed template. Those assets are independent of the host callback and may have been changed by another customization.
Security, privacy and performance considerations
Blocking a provider can support a privacy policy by preventing new oEmbed lookups for that service, but it does not remove URLs or iframes already stored in content. Audit historical posts when the requirement is comprehensive.
Recommended Free Tools
Suppressing a small host script can reduce one request on pages where it would otherwise load, but the modern conditional behavior means the saving only applies to pages that contain the relevant post-embed markup. Measure the real page source and network waterfall rather than assuming every page carries the asset.
Compatibility is the main trade-off. A plugin or theme may rely on embed communication or add its own scripts. Apply changes in staging first, test representative content and retain a quick rollback by disabling the custom plugin or reverting the child-theme change.
Quick Recap
A practical decision sequence
- Need to block one service? Remove only that provider registration with
wp_oembed_remove_provider(). - Need to stop the legacy host callback? Unhook
wp_oembed_add_host_jsfromwp_headduringinit, matching the registered priority. - Need to change iframe resources? Inspect
enqueue_embed_scriptsand the iframe template instead of changing host-page hooks. - Seeing old embeds? Review saved post and block markup; hook changes do not rewrite existing content.
- Unsure what generated the output? Use page source, network inspection and plugin/theme code tracing before changing anything.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
