This module introduces a new media type for embedding third-party scripts and iframe snippets, such as social widgets or tracking codes. Editors can add these embed codes through the Media Library and reuse them across the site, Centralizing and managing them as media entities. This allows for safe embedding of such content without directly pasting raw markup into content fields.
The Media Embed Code module adds an "Embed Code" media type, giving site builders a clean, reusable way to store and embed third-party script and iframe snippets — social widgets, ad tags, tracking pixels, chat widgets, maps, and similar embeds — as media entities, rather than pasting raw markup directly into body fields or templates.
Once installed, editors can add an "Embed Code" media item through the standard Media Library, paste in the third-party snippet, and reference it anywhere media entities are supported: media reference fields, views, and the CKEditor 5 Media Library button in any text format.
Features
- A dedicated Embed Code media type, field type, and field formatter, ready to use immediately after installation.
- A media source plugin so Embed Code integrates natively with the Media Library, media reference fields, and CKEditor 5.
- A CKEditor 5 preview safeguard: when an Embed Code media item is shown inside the editor's live preview or "Preview" tab, the module automatically substitutes a safe thumbnail-based display instead of executing the embedded script/iframe inline in the editing surface.
- A configurable "Allowed HTML tags" field setting, letting site builders restrict which tags (e.g. iframe, script, embed) editors may enter into a given Embed Code field. Content with a disallowed tag is blocked from saving with a validation error naming the offending tag(s); the setting defaults to allowing any tag.
- No dependencies beyond Drupal core's Media and Media Library modules — nothing else required.
Use cases
- Centralizing third-party embed snippets (analytics, ad tags, marketing widgets) as manageable, reusable content instead of scattering raw HTML across body fields.
- Letting trusted editors embed scripts through the Media Library UI without giving them a text format that allows arbitrary HTML everywhere.
- Auditing and reusing the same embed code across multiple pages from a single media entity.
Security considerations
Embed Code media renders its stored value as unsanitized, trusted markup by design — third-party embed snippets frequently require <script> or <iframe> tags to function.
This means anyone able to create or edit Embed Code media can execute arbitrary JavaScript on any page where that media item appears.
Site builders must restrict the dynamically-generated "Embed Code: Create new media" and "Embed Code: Edit own/any media" permissions to trusted, administrative roles only.
See the module's README for full details.
Requirements
- Drupal core's Media module
- Drupal core's Media Library module
- Drupal ^10.3 or ^11
No contributed module dependencies.
Ask your assistant about Media Embed Code
Check compatibility with your Drupal and PHP version, maintenance and security coverage, from current release data. How it works
Depends on
Dependencies of the latest stable release
- media Drupal core
- media_library Drupal core
Required by
Tracked projects that depend on this one
No tracked projects depend on this one yet.