* @param int $height Height of the response.
return apply_filters( 'embed_html', $output, $post, $width, $height );
* Retrieves the oEmbed response data for a given post.
* @param WP_Post|int $post Post object or ID.
* @param int $width The requested width.
* @return array|false Response data on success, false if post doesn't exist
* or is not publicly viewable.
function get_oembed_response_data( $post, $width ) {
$post = get_post( $post );
$width = absint( $width );
if ( ! is_post_publicly_viewable( $post ) ) {
* Filters the allowed minimum and maximum widths for the oEmbed response.
* @param array $min_max_width {
* Minimum and maximum widths for the oEmbed response.
* @type int $min Minimum width. Default 200.
* @type int $max Maximum width. Default 600.
$min_max_width = apply_filters(
$width = min( max( $min_max_width['min'], $width ), $min_max_width['max'] );
$height = max( ceil( $width / 16 * 9 ), 200 );
'provider_name' => get_bloginfo( 'name' ),
'provider_url' => get_home_url(),
'author_name' => get_bloginfo( 'name' ),
'author_url' => get_home_url(),
'title' => get_the_title( $post ),
$author = get_userdata( $post->post_author );
$data['author_name'] = $author->display_name;
$data['author_url'] = get_author_posts_url( $author->ID );
* Filters the oEmbed response data.
* @param array $data The response data.
* @param WP_Post $post The post object.
* @param int $width The requested width.
* @param int $height The calculated height.
return apply_filters( 'oembed_response_data', $data, $post, $width, $height );
* Retrieves the oEmbed response data for a given URL.
* @param string $url The URL that should be inspected for discovery `<link>` tags.
* @param array $args oEmbed remote get arguments.
* @return object|false oEmbed response data if the URL does belong to the current site. False otherwise.
function get_oembed_response_data_for_url( $url, $args ) {
$url_parts = wp_parse_args(
'domain' => $url_parts['host'],
'update_site_meta_cache' => false,
// In case of subdirectory configs, set the path.
if ( ! is_subdomain_install() ) {
$path = explode( '/', ltrim( $url_parts['path'], '/' ) );
$qv['path'] = get_network()->path . $path . '/';
$sites = get_sites( $qv );
// Do not allow embeds for deleted/archived/spam sites.
if ( ! empty( $site->deleted ) || ! empty( $site->spam ) || ! empty( $site->archived ) ) {
if ( $site && get_current_blog_id() !== (int) $site->blog_id ) {
switch_to_blog( $site->blog_id );
$post_id = url_to_postid( $url );
/** This filter is documented in wp-includes/class-wp-oembed-controller.php */
$post_id = apply_filters( 'oembed_request_post_id', $post_id, $url );
$width = isset( $args['width'] ) ? $args['width'] : 0;
$data = get_oembed_response_data( $post_id, $width );
return $data ? (object) $data : false;
* Filters the oEmbed response data to return an iframe embed code.
* @param array $data The response data.
* @param WP_Post $post The post object.
* @param int $width The requested width.
* @param int $height The calculated height.
* @return array The modified response data.
function get_oembed_response_data_rich( $data, $post, $width, $height ) {
$data['width'] = absint( $width );
$data['height'] = absint( $height );
$data['html'] = get_post_embed_html( $width, $height, $post );
// Add post thumbnail to response if available.
if ( has_post_thumbnail( $post->ID ) ) {
$thumbnail_id = get_post_thumbnail_id( $post->ID );
if ( 'attachment' === get_post_type( $post ) ) {
if ( wp_attachment_is_image( $post ) ) {
$thumbnail_id = $post->ID;
} elseif ( wp_attachment_is( 'video', $post ) ) {
$thumbnail_id = get_post_thumbnail_id( $post );
list( $thumbnail_url, $thumbnail_width, $thumbnail_height ) = wp_get_attachment_image_src( $thumbnail_id, array( $width, 99999 ) );
$data['thumbnail_url'] = $thumbnail_url;
$data['thumbnail_width'] = $thumbnail_width;
$data['thumbnail_height'] = $thumbnail_height;
* Ensures that the specified format is either 'json' or 'xml'.
* @param string $format The oEmbed response format. Accepts 'json' or 'xml'.
* @return string The format, either 'xml' or 'json'. Default 'json'.
function wp_oembed_ensure_format( $format ) {
if ( ! in_array( $format, array( 'json', 'xml' ), true ) ) {
* Hooks into the REST API output to print XML instead of JSON.
* This is only done for the oEmbed API endpoint,
* which supports both formats.
* @param bool $served Whether the request has already been served.
* @param WP_HTTP_ResponseInterface $result Result to send to the client. Usually a WP_REST_Response.
* @param WP_REST_Request $request Request used to generate the response.
* @param WP_REST_Server $server Server instance.
function _oembed_rest_pre_serve_request( $served, $result, $request, $server ) {
$params = $request->get_params();
if ( '/oembed/1.0/embed' !== $request->get_route() || 'GET' !== $request->get_method() ) {
if ( ! isset( $params['format'] ) || 'xml' !== $params['format'] ) {
// Embed links inside the request.
$data = $server->response_to_data( $result, false );
if ( ! class_exists( 'SimpleXMLElement' ) ) {
die( get_status_header_desc( 501 ) );
$result = _oembed_create_xml( $data );
// Bail if there's no XML.
return get_status_header_desc( 501 );
if ( ! headers_sent() ) {
$server->send_header( 'Content-Type', 'text/xml; charset=' . get_option( 'blog_charset' ) );
* Creates an XML string from a given array.
* @param array $data The original oEmbed response data.
* @param SimpleXMLElement $node Optional. XML node to append the result to recursively.
* @return string|false XML string on success, false on error.
function _oembed_create_xml( $data, $node = null ) {
if ( ! is_array( $data ) || empty( $data ) ) {
$node = new SimpleXMLElement( '<oembed></oembed>' );
foreach ( $data as $key => $value ) {
if ( is_numeric( $key ) ) {
if ( is_array( $value ) ) {
$item = $node->addChild( $key );
_oembed_create_xml( $value, $item );
$node->addChild( $key, esc_html( $value ) );
* Filters the given oEmbed HTML to make sure iframes have a title attribute.
* @param string $result The oEmbed HTML result.
* @param object $data A data object result from an oEmbed provider.
* @param string $url The URL of the content to be embedded.
* @return string The filtered oEmbed result.
function wp_filter_oembed_iframe_title_attribute( $result, $data, $url ) {
if ( false === $result || ! in_array( $data->type, array( 'rich', 'video' ), true ) ) {
$title = ! empty( $data->title ) ? $data->title : '';
$pattern = '`<iframe([^>]*)>`i';
if ( preg_match( $pattern, $result, $matches ) ) {
$attrs = wp_kses_hair( $matches[1], wp_allowed_protocols() );
foreach ( $attrs as $attr => $item ) {
$lower_attr = strtolower( $attr );
if ( $lower_attr === $attr ) {
if ( ! isset( $attrs[ $lower_attr ] ) ) {
$attrs[ $lower_attr ] = $item;
unset( $attrs[ $attr ] );
if ( ! empty( $attrs['title']['value'] ) ) {
$title = $attrs['title']['value'];
* Filters the title attribute of the given oEmbed HTML iframe.
* @param string $title The title attribute.
* @param string $result The oEmbed HTML result.
* @param object $data A data object result from an oEmbed provider.
* @param string $url The URL of the content to be embedded.
$title = apply_filters( 'oembed_iframe_title_attribute', $title, $result, $data, $url );
if ( isset( $attrs['title'] ) ) {
unset( $attrs['title'] );
$attr_string = implode( ' ', wp_list_pluck( $attrs, 'whole' ) );
$result = str_replace( $matches[0], '<iframe ' . trim( $attr_string ) . '>', $result );
return str_ireplace( '<iframe ', sprintf( '<iframe title="%s" ', esc_attr( $title ) ), $result );
* Filters the given oEmbed HTML.
* If the `$url` isn't on the trusted providers list,
* we need to filter the HTML heavily for security.
* Only filters 'rich' and 'video' response types.
* @param string $result The oEmbed HTML result.
* @param object $data A data object result from an oEmbed provider.
* @param string $url The URL of the content to be embedded.
* @return string The filtered and sanitized oEmbed result.
function wp_filter_oembed_result( $result, $data, $url ) {
if ( false === $result || ! in_array( $data->type, array( 'rich', 'video' ), true ) ) {
$wp_oembed = _wp_oembed_get_object();
// Don't modify the HTML for trusted providers.
if ( false !== $wp_oembed->get_provider( $url, array( 'discover' => false ) ) ) {
$html = wp_kses( $result, $allowed_html );
preg_match( '|(<blockquote>.*?</blockquote>)?.*(<iframe.*?></iframe>)|ms', $html, $content );
// We require at least the iframe to exist.
if ( empty( $content[2] ) ) {
$html = $content[1] . $content[2];
preg_match( '/ src=([\'"])(.*?)\1/', $html, $results );
if ( ! empty( $results ) ) {
$secret = wp_generate_password( 10, false );
$url = esc_url( "{$results[2]}#?secret=$secret" );
$html = str_replace( $results[0], ' src=' . $q . $url . $q . ' data-secret=' . $q . $secret . $q, $html );
$html = str_replace( '<blockquote', "<blockquote data-secret=\"$secret\"", $html );
$allowed_html['blockquote']['data-secret'] = true;
$allowed_html['iframe']['data-secret'] = true;
$html = wp_kses( $html, $allowed_html );
if ( ! empty( $content[1] ) ) {
// We have a blockquote to fall back on. Hide the iframe by default.
$html = str_replace( '<iframe', '<iframe style="position: absolute; clip: rect(1px, 1px, 1px, 1px);"', $html );
$html = str_replace( '<blockquote', '<blockquote class="wp-embedded-content"', $html );
$html = str_ireplace( '<iframe', '<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted"', $html );
* Filters the string in the 'more' link displayed after a trimmed excerpt.
* Replaces '[...]' (appended to automatically generated excerpts) with an
* ellipsis and a "Continue reading" link in the embed template.
* @param string $more_string Default 'more' string.
* @return string 'Continue reading' link prepended with an ellipsis.
function wp_embed_excerpt_more( $more_string ) {
'<a href="%1$s" class="wp-embed-more" target="_top">%2$s</a>',
esc_url( get_permalink() ),
/* translators: %s: Post title. */
sprintf( __( 'Continue reading %s' ), '<span class="screen-reader-text">' . get_the_title() . '</span>' )
return ' … ' . $link;
* Displays the post excerpt for the embed template.
* Intended to be used in 'The Loop'.
function the_excerpt_embed() {
$output = get_the_excerpt();
* Filters the post excerpt for the embed template.
* @param string $output The current post excerpt.
echo apply_filters( 'the_excerpt_embed', $output );
* Filters the post excerpt for the embed template.
* Shows players for video and audio attachments.
* @param string $content The current post excerpt.
* @return string The modified post excerpt.