Click-to-load video embed

What an ordinary embed does before anyone watches

The snippet you copy from a video’s Share menu is an <iframe>, a small window onto another website set inside your page. The browser fills that window as soon as it draws the page. For one YouTube video, that’s roughly twenty requests and several hundred kilobytes of script, fetched from Google servers for every visitor, including all the ones who scroll right past.

Each of those requests carries the visitor’s IP address and the address of your page. The player can also read and write its own storage in the browser. So your page gets slower, and your visitors get noticed by a company they never chose to contact.

The two kinds of code this tool writes

Click to load

Your page gets a link dressed up as a video frame, with a poster image, a play triangle and an accessible label. A short script, included once, waits for a click on that link and only then swaps in the real player with autoplay=1, so one press is enough on most devices. If the script is missing or blocked, the link still works and opens the video on the platform in a new tab.

Plain iframe on the privacy-enhanced domain

No script at all. The player loads with the page, but from youtube-nocookie.com, or from Vimeo with dnt=1, and with loading="lazy" so a video far down the page waits until the visitor scrolls near it.

Either way, the player sits in a box sized with the CSS aspect-ratio property, so it scales with whatever column you put it in. A /shorts/ link is detected and gets a 9:16 box limited to 360 pixels wide.

The poster image is the last leak

For YouTube, the click-to-load code points by default to the video’s thumbnail on i.ytimg.com. That server belongs to Google. It sets no cookie, but it does see the visitor’s IP address when the picture loads. To get down to zero third-party requests, save a frame of the video, upload it to your own site and paste its address in the poster field. Make it an https:// address, because browsers refuse insecure images on secure pages.

Vimeo has no predictable thumbnail address, so the default there is a dark frame showing your title. The same poster field replaces it with a picture.

Pasting the code into your site

The output is plain HTML with inline styles, so it doesn’t depend on your theme.

• WordPress: add a “Custom HTML” block and paste. Administrators can save the <script> part, but accounts with the Editor role on a multisite network may have it stripped on save. If that happens, the poster still links to the video, or you can switch to the plain iframe.
• Squarespace, Wix, Webflow, Shopify: use the code or embed block, not the built-in video block, which would bring the standard player right back.
• Static HTML: paste where the video belongs. With several videos on one page, paste each snippet in full. The script checks whether it has already run.
• Content-Security-Policy: allow www.youtube-nocookie.com or player.vimeo.com in frame-src. A policy that forbids inline scripts will block the click-to-load script, so move it to a file you serve yourself.

Always fill in the title field. It becomes the title of the iframe and the label of the play link, and that’s what a screen reader announces. Leave it empty and all the listener hears is “YouTube video”.