Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →WordPress does not have one universal “disable embeds” switch. To stop a single service, remove that provider from the oEmbed registry. To stop WordPress’s legacy host-side communication script, unhook wp_oembed_add_host_js. These controls affect different layers, and neither one rewrites iframe or block markup already saved in posts.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
WordPress embeds are built around oEmbed, a protocol that lets a post request ready-to-render HTML for videos, images, text and other media. Core maintains a whitelist of providers it can discover and embed. The right way to disable embeds therefore depends on what you are trying to stop: one provider, the host script associated with post embeds, or assets loaded inside an embed iframe.
As an Amazon Associate I earn from qualifying purchases.
Choose the layer you actually want to disable
Provider control: block one service
Provider control removes a registered provider from WordPress’s oEmbed handling. It is the narrowest choice when, for example, one video service is not acceptable but other providers should continue to work. Removing a provider prevents new oEmbed discovery or handling for that provider; it does not automatically remove markup that is already stored in post content.
Host-script control: suppress WordPress’s legacy communication script
WordPress historically added a small host-side script named wp-embed (commonly seen as wp-embed.js) to communicate with post-embed iframes. The legacy callback is wp_oembed_add_host_js(). Unhooking that callback targets the host-script path, not every possible iframe, block, or script emitted by a plugin.
#1 Best Overall
Iframe control: a separate asset path
Embed documents have their own enqueue process. The enqueue_embed_scripts hook runs while scripts and styles for an embed iframe are queued, and WordPress’s default iframe stylesheet is handled by wp_enqueue_embed_styles(). Removing the host callback does not, by itself, remove these iframe assets or a custom template supplied by a theme or plugin.
Prepare safely before changing hooks
- Use a small site plugin or a child theme rather than editing WordPress core or a parent theme. A core update would overwrite a direct core edit, and a parent-theme update can remove a theme-file change.
- Identify whether the unwanted output is generated by WordPress oEmbed, saved iframe or block markup, or a plugin’s custom renderer. The same visual result can come from different layers.
- Record the current behavior on a real post containing an embed and on a post without one. This gives you a comparison after the change.
- Make a backup or ensure you can deactivate the site plugin quickly. Hook changes are reversible, but saved content is a separate matter.
Disable one oEmbed provider
Use WordPress’s documented wp_oembed_remove_provider() API when one provider should be rejected while the rest of the oEmbed whitelist remains available. The function needs the provider URL pattern and the handler that was used when that provider was registered.
Free tools Windows power users keep installed
One-click scans. No signup required.
Step 1: find the provider registration
Provider registration details are not identical across WordPress versions, plugins and custom integrations. Confirm the exact URL pattern and handler in the code that registered the provider. Do not guess a domain pattern: an incorrect pattern can leave the provider active or match more URLs than intended.
Step 2: call the removal API after registration
Run the removal on init, after normal provider registration has occurred. In a site plugin or child theme, the essential call has this form:
<?php
add_action( 'init', function () {
wp_oembed_remove_provider( $provider_url_pattern, $provider_handler );
} );Set $provider_url_pattern and $provider_handler to the values used by your site’s registration. The API removes that provider entry; it does not delete old post content.
Step 3: test the boundary
Open a post that uses the blocked service and confirm that WordPress no longer generates a new oEmbed result for it. Then test a different provider that should remain allowed. If the unwanted output still appears, inspect the post content and the active plugins: a saved iframe or a plugin-generated embed bypasses provider removal.
Stop WordPress’s host-side embed script
The compatibility pattern for suppressing the legacy host callback is:
<?php
add_action( 'init', function () {
remove_action( 'wp_head', 'wp_oembed_add_host_js' );
} );Why the timing matters
remove_action() can only remove a callback after it has been registered, and the callback, hook and priority must match the registration. Running the removal on init is the commonly used placement because WordPress has registered its default filters by then. If a theme or plugin registered the same callback at a different priority, supply that priority to remove_action() as well.
What this change does
This unhooks the host-side callback that would add the legacy communication script. It does not erase an iframe already present in post content, remove scripts enqueued by a plugin, or alter an embed document’s own stylesheet. It also does not guarantee that a page has no JavaScript associated with an embedded service.
Deprecation and compatibility
WordPress deprecated wp_oembed_add_host_js() in version 5.9.0. The function reference says it is no longer used directly and remains as a back-compat indicator that the oEmbed host JavaScript should be added. Core still retains a compatibility check, so the legacy unhooking pattern continues to work on installations that expose this callback.
Understand conditional loading in WordPress 5.9-era core
Modern WordPress does not unconditionally load wp-embed on every front-end page. Core checks generated HTML for the wp-embedded-content marker and enqueues the script only when post-embed markup is detected. The related function is wp_maybe_enqueue_oembed_host_js(). Trac changeset 52132, recorded on November 11, 2021, documents this move away from unconditional loading.
As a result, removing the callback may produce no visible difference on a page that has no post embed. A page can still contain ordinary media, a block rendered by a plugin, or a hand-written iframe without containing the marker that triggers this conditional path.
Rank #4
Control scripts and styles inside the embed iframe
If the goal is to reduce assets loaded by the iframe itself, work at the iframe layer rather than only unhooking the host callback. The relevant extension point is enqueue_embed_scripts, introduced in WordPress 4.4.0. The default stylesheet is queued through wp_enqueue_embed_styles().
Inspect the specific iframe response and the code that generates it before changing this layer. A custom embed template, a block, or a plugin can enqueue its own assets. Removing a core host callback cannot remove those independently generated resources.
Recommended Free Tools
Saved markup is different from generated output
Older posts may contain an iframe, block HTML or provider markup saved directly in post_content. Hook changes affect future generation and enqueue decisions; they do not rewrite that existing content. Review representative posts after deploying a change.
If old embeds must disappear, treat content migration as a separate operation: identify the affected posts, decide what replacement or deletion is appropriate, and test the edit on a copy before applying it in bulk. Do not assume that disabling discovery will clean historical content.
Best Value
Verify the result on the right pages
- Clear caches. Purge page, object and CDN caches so an earlier HTML response or script list is not mistaken for current behavior.
- Use a real post embed. Test a page that actually contains WordPress post-embed markup; an empty page is not a meaningful test for conditional loading.
- Inspect page source. Search the rendered source for
wp-embed, thewp-embedded-contentmarker and the iframe URL. - Inspect network requests. Reload with the browser’s network panel open and check whether the host script, iframe document and iframe assets are requested.
- Test a page without an embed. This confirms that unrelated pages have not gained a script or broken markup.
- Test an allowed provider. If you removed one provider, verify that another provider still embeds as intended.
- Check custom code. Review active plugins and the theme for independent enqueue calls, custom iframe templates or hard-coded script tags.
Troubleshoot common results
The script still appears
- The page may contain a detected post embed, so core is following its conditional enqueue path.
- The callback may have been removed before registration, or with a priority that does not match the original registration.
- A plugin or theme may enqueue a similarly named file independently. Use the browser’s network initiator information and search active code for additional enqueue calls.
- A cache may be serving an earlier HTML response. Purge every relevant cache layer and retest.
The provider still embeds
- The URL pattern or handler passed to
wp_oembed_remove_provider()may not match the registered entry. - The provider may be rendered by a plugin or custom block rather than WordPress’s oEmbed registry.
- The post may already contain saved iframe or block markup, which provider removal does not rewrite.
The iframe still loads scripts or styles
That is expected when only the host callback was removed. Inspect the iframe’s own enqueue path, including enqueue_embed_scripts, wp_enqueue_embed_styles(), custom templates and plugin output. Change only the asset layer you have identified, because removing iframe dependencies can affect the appearance or behavior of the embedded document.
An unrelated page changes
Check whether the code was placed globally in a shared template, whether a plugin reused the hook for another feature, or whether a broad provider pattern matched more URLs than intended. Narrow the callback or provider rule and retest both embedded and non-embedded pages.
Which approach fits your goal?
| Approach | Scope | Compatibility target | Reversibility | Verification |
|---|---|---|---|---|
wp_oembed_remove_provider() |
One registered oEmbed provider | WordPress oEmbed discovery and handling | Remove the call to restore normal registration | Test the blocked provider and an allowed provider |
remove_action( 'wp_head', 'wp_oembed_add_host_js' ) |
Legacy host-side oEmbed communication callback | Core’s host-script path | Delete or disable the unhook | Inspect source and network requests on a real post embed |
enqueue_embed_scripts or iframe-specific code |
Scripts and styles inside the embed iframe | Core iframe assets and custom embed output | Restore the removed enqueue or template change | Inspect the iframe response and its requests |
A practical decision sequence
- If only one service is unwanted, identify its registration and remove that provider. This preserves other oEmbed providers.
- If the concern is specifically the host-side
wp-embedscript, use the compatibility unhook oninit, then verify the callback priority and the actual network request. - If the unwanted bytes come from the iframe document, investigate the iframe enqueue hook or custom renderer instead of changing the host callback.
- If old posts still display embeds, plan a content edit or migration; no hook alone rewrites saved markup.
Key version facts
enqueue_embed_scriptshas existed since WordPress 4.4.0.wp_oembed_add_host_js()has been deprecated since WordPress 5.9.0, while the compatibility path remains available.- WordPress 5.9-era core introduced conditional
wp-embedloading when post-embed markup is detected. - Trac changeset 52132, dated November 11, 2021, records the change from unconditional to conditional loading.
The safest implementation is the narrowest one that matches the problem: remove a provider when one service must be blocked, unhook the legacy host callback only when that host script is the target, and handle iframe assets or saved content as separate systems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
