Responsive YouTube and Vimeo players for links that stand alone in a post.

What it does

  • A paragraph that contains only a YouTube or Vimeo URL is replaced with a 16:9 responsive player.
  • Supported links:
    • https://www.youtube.com/watch?v=VIDEOID
    • https://youtu.be/VIDEOID
    • https://www.youtube.com/shorts/VIDEOID
    • https://vimeo.com/123456789
  • A link with its own text (for example [watch this](https://youtu.be/…)) stays a normal link; only a bare URL — the core renderer shows the URL itself as the link text — becomes a player.
  • Code blocks, inline code, links inside other text and HTML produced by the user are never re-rendered: the filter only matches a complete <p> with one link, and all text from the user stays escaped.
  • Video ids are validated with anchored, character-class-only regular expressions. The iframe URL is built by the plugin from a fixed host and that id; no user HTML or arbitrary query string is passed through.
  • YouTube embeds use www.youtube-nocookie.com by default (privacy-enhanced mode). Vimeo uses player.vimeo.com.
  • link.previewable returns false for YouTube and Vimeo hosts, and security.csp adds https://www.youtube-nocookie.com, https://www.youtube.com and https://player.vimeo.com to frame-src.

Settings

Admin → Plugins → Embed

  • Embed YouTube videos — default on.
  • Embed Vimeo videos — default on.
  • Use privacy-enhanced YouTube (youtube-nocookie.com) — default on. Turning it off uses www.youtube.com.

Notes

  • No tables and no database queries.
  • The rendered HTML is stored with the post (core behaviour); changing a setting affects content rendered after the change. Both YouTube origins remain allowed by the CSP so players saved earlier keep working.
  • Core's link_previewable() already returns false for youtube.com, youtu.be and vimeo.com before the link.previewable filter runs. The filter is registered as required, but those hosts never reach it.