oEmbed 是 WordPress 中用于简化内容嵌入的协议，允许从外部站点（如 YouTube）获取嵌入 HTML，避免手动复制粘贴。它支持视频、图像等多种内容类型，但默认仅允许白名单中的 URL 嵌入以确保安全。
oEmbed 发现功能对“链接”和“照片”类型的内容过滤较轻，但仍会进行适当转义以防止恶意内容显示。开发者应谨慎处理安全设置，避免潜在漏洞。
The easy embedding feature is mostly powered by oEmbed, a protocol for consumers (such as your blog) to ask providers (such as YouTube) for the HTML needed to embed content from the provider.
oEmbed is designed to avoid the need to copy and paste HTML from the site hosting the media you wish to embed. It supports different kind of content like videos, images, text, and more.
No, not by default. The WordPress Core has an internal whitelist that will only allow certain URLs to be embeddable for security reasons. The good news is that the whitelist can be modified, and new sites and URLs can be added by registering their handle.
Adding support for an additional website depends on whether the site supports oEmbed. oEmbed.com provides a list of hundreds of supported provides.
If a site supports oEmbed, you’ll want to call wp_oembed_add_provider() to add the site and URL format to the internal whitelist.
You’ll need to register a handler using wp_embed_register_handler() and provide a callback function that generates the HTML.
If you wish to remove an oEmbed-enabled provider, you’ll want to call wp_oembed_remove_provider.
As of version 4.4, WordPress supports oEmbed discovery, but has severe limitations on what type of content can be embedded via non-whitelisted sites.
Specifically, the HTML and Video content is filtered to only allow links, blockquotes, and iframes, and these are additionally filtered to prevent insertion of malicious content. The HTML is then modified to be sandboxed and to have additional security restrictions placed on them as well.
However, if you feel you are knowledgeable enough to not require this level of safety, you can give unfiltered_html users (Administrators and Editors) the ability to embed from websites that have oEmbed discovery tags in their <head>.
The oEmbed discovery content for “link” and “photo” types is not quite so heavily filtered in this manner; however, it is properly escaped for security and to prevent any malicious content from being displayed on the site