WordPress removed your embed code? Why script tags disappear and how to fix it

The short answer

WordPress only lets users with the unfiltered_html capability save JavaScript in pages, posts and widgets. For everyone else, it filters the content when it is saved and removes tags such as <script> and <iframe>. On a normal single-site installation, administrators and editors have this capability. On a multisite network, only Super Admins have it. A setting in wp-config.php can take it away from everyone, and on WordPress.com, script tags only work on a paid plan with hosting features activated.

If your embed code disappears after saving, one of those rules is almost always the reason. If the code is still there but nothing appears on the live page, the cause is something else, usually a caching or optimization plugin. Both cases are covered below.

Find your situation

How WordPress decides what to remove

WordPress has a built-in HTML filter called KSES. When a user saves content, WordPress checks whether that user has the unfiltered_html capability. If they do not, it turns on the filters, which run the content through a function called wp_kses() and keep only allowed tags and attributes. Script tags are not on the allowed list, so they are removed.

WordPress’s documentation describes unfiltered_html as the capability that “allows user to post HTML markup or even JavaScript code in pages, posts, comments and widgets”. It also warns that giving it to untrusted users may let them post malicious or badly formatted code. That is the reason for the filter. A script on a page runs in every visitor’s browser, so WordPress only lets trusted roles add one.

Two details explain most of the confusion:

1. The filter applies when content is saved. The code you paste looks fine in the editor. It is removed when you click Save, Update or Publish, so you often only notice when you reopen the page or look at the live site.
2. The filter depends on who saves, not who added the code. If an administrator adds a script and an author later edits and updates the same page, WordPress filters the content for the author when they save it. The script can disappear even though the person who added it was allowed to.

Since WordPress 7.0, the Custom HTML block has separate HTML, CSS and JavaScript panels. According to WordPress’s documentation, the CSS and JavaScript panels are only shown to users with unfiltered_html. For users without it, the block’s content is filtered with wp_kses() and tags such as <script> and <iframe> are removed when the post is saved. So if you do not see a JavaScript panel in the block, that is a strong hint your user cannot save scripts.

Who can save scripts by default

These are WordPress’s defaults. Plugins that manage roles can change them, so if your site uses a role editor or a membership plugin, the actual permissions may be different.

Cause 1: your user role cannot save scripts

On a single site, authors and contributors do not have unfiltered_html. If you log in as one of these roles, every script you paste is removed when you save. The same happens to a page with an existing script whenever someone with one of these roles updates it.

Fix:

1. Ask an administrator or editor to add the embed code. Our WordPress guide has the steps for a page, a post, a widget area and a block theme template.
2. Put the feed somewhere authors do not edit day to day. A footer template part, a sidebar widget area, or a page that only administrators maintain avoids accidental removal. See adding a feed to the footer.
3. If authors must be able to place the feed themselves, have an administrator set up a shortcode (see “A developer-friendly fix” below). Authors then add only the shortcode, which is plain text and passes the filter.

Cause 2: your site is on a multisite network

On a WordPress multisite network, the rule is stricter. WordPress’s documentation states that in multisite, only Super Admins have the unfiltered_html capability. Administrators of individual sites in the network do not. This is often the case for university, company and agency networks, where each department or client is an administrator of its own site but not of the network.

WordPress’s core code checks this directly. When a site is part of a network and the user is not a Super Admin, unfiltered_html is denied, whatever role they have on that site.

Fix:

1. Ask a Super Admin of the network to paste the embed code into the page, template part or widget area for you.
2. Ask whether the network offers an approved way to add embeds, such as a shortcode or block provided by the network’s own plugin. Many networks have a policy for this.
3. Remember that later edits by a site administrator can remove the code again (see the two details above). Placing it in a part of the site that is rarely edited makes it last.

Cause 3: DISALLOW_UNFILTERED_HTML is turned on

WordPress supports a constant in wp-config.php called DISALLOW_UNFILTERED_HTML. When it is set to true, WordPress denies unfiltered_html to everyone. The comment in WordPress’s core code says it disallows unfiltered HTML “for all users, even admins and super admins”. This is a security hardening setting, and some developers, hosts and security setups use it on purpose.

Signs that this is the cause: even administrators lose script tags when they save, and nobody sees a JavaScript panel in the Custom HTML block.

Fix: ask whoever manages the site or the hosting whether the constant is set, and why. Only remove it if they agree. A setting like this is usually there for a reason, for example because many people can log in to the site. If it must stay, use an approach that does not depend on saving scripts in content, such as the shortcode in “A developer-friendly fix” below, or adding the code to a theme template file.

Cause 4: your site is on WordPress.com

WordPress.com, the hosted service, has its own rules that sit on top of the WordPress rules above. According to WordPress.com’s support page for the Custom HTML block, common HTML tags work on all plans, but tags such as script, iframe, style, form, embed and object need a paid plan. On sites that do not qualify, these tags are filtered out, so code that uses them can disappear or be partly removed after saving.

The same page adds that a paid plan alone is not enough: hosting features must be activated, which it says you do by installing at least one plugin. WordPress.com’s plugin documentation says installing plugins is available on all paid plans: Personal, Premium, Business and Commerce. Its support page about adding code says the same: JavaScript needs a plugin-enabled plan with hosting features activated, and before activation those sites have the same limits as free sites.

Fix:

1. On the free plan, script-based embeds cannot be saved. There is no setting in the widget that can change that. To use a script embed, upgrade to a paid plan.
2. On a paid plan, make sure hosting features are activated. Following WordPress.com’s instructions, install at least one plugin, then paste the embed code into a Custom HTML block again and save.
3. Plans and features on WordPress.com change from time to time. If the steps do not match what you see, check your plan on WordPress.com’s support pages.

WordPress.com also notes that code from some trusted partners, such as YouTube and Google Maps, can be turned into a supported embed on any plan. That does not apply to third-party widget scripts like ours.

Cause 5: the code went into the wrong block

Sometimes the script is not removed by the filter; it simply was not pasted into an HTML block. A Paragraph block treats everything as text, so the code appears on the page as visible characters, or the editor converts it in a way that stops it from running.

Fix:

1. Delete the paragraph that contains the code.
2. Add a Custom HTML block. Type /html in an empty paragraph and press Enter, or search for Custom HTML in the block inserter.
3. Paste the whole embed code, including the opening and closing script tags, into the block’s HTML area. Do not paste it into the JavaScript panel: that panel is for JavaScript code, and the embed code is an HTML tag.
4. Save, then reload the live page to check.

In the Classic Editor, switch to the Text tab before pasting, not the Visual tab. In page builders, use the builder’s own HTML or code element, for example the HTML widget in Elementor or the Code module in Divi. Page builders save their content through WordPress as well, so the same role rules usually apply. Check your builder’s documentation if you are unsure.

The embed code for Social Feed by grip space looks like this, with your own ID at the end:

<script type="text/javascript" src="https://n246.grip.space/api/v1/instagram/widget/xxxxxxxx"></script>

Cause 6: the code is there, but the widget does not appear

If you reopen the page and the script tag is still in the Custom HTML block, WordPress did not remove it. Something else is stopping it from running or from showing anything.

1. Caching and optimization plugins. Clear the plugin’s cache and your host’s cache after adding the code. If the feed still does not appear, exclude the embed script from options such as “delay JavaScript” or “combine JavaScript”. Our widget draws the feed right next to its own script tag, so moving or combining the script can break it.
2. A Content Security Policy. If your site or a security plugin sends a CSP, the browser may block the script or the images. The browser console shows what was blocked. See Content Security Policy and Instagram feed widgets.
3. The widget is unpublished. In the Social Feed dashboard, each widget has a Published / Unpublished toggle. An unpublished widget shows nothing on your site. See hiding a feed temporarily.
4. The wrong page or an old copy. Make sure you edited the page you are looking at, and not a draft, a different language version or a page that a template overrides.

Our full checklist, Instagram feed not showing on your website?, covers the remaining causes, such as view limits and expired Instagram connections.

How to check whether WordPress removed the code

1. Reopen the page in the editor. Select the Custom HTML block and look at its HTML. If the script tag is missing, it was removed when someone saved.
2. Look at the whole page as code. In the block editor, open the Options menu (the three dots at the top right) and choose the Code editor. Search for instagram/widget.
3. Check the live page. Open the published page, use your browser’s “View page source” and search for instagram/widget. If it is in the editor but not in the source, look at caching or the template. If it is in neither, it was removed.
4. Check who saved last. If your site keeps revisions, the revisions screen shows who saved each version. If the code vanished after a particular person’s edit, check that person’s role.
5. For developers: in the browser’s developer tools, compare the content sent in the editor’s save request with the content the server returns. If the script is in the request but not in the response, the server filtered it.

A developer-friendly fix: a shortcode

If the content filter cannot be avoided, for example on a multisite network or with DISALLOW_UNFILTERED_HTML, the cleanest solution is to keep the script out of the content entirely. A tiny plugin registers a shortcode, and editors add only the shortcode to the page. The shortcode is plain text, so the filter leaves it alone, and WordPress replaces it with the script tag when the page is shown.

<?php
/*
 * Plugin Name: Social Feed embed
 */
add_shortcode( 'social_feed', function () {
    return '<script type="text/javascript" src="https://n246.grip.space/api/v1/instagram/widget/xxxxxxxx"></script>';
} );

1. Replace the src address with the one from your own embed code.
2. Save the file as social-feed-embed.php in wp-content/plugins/ (or in wp-content/mu-plugins/), then activate it under Plugins if you used the normal plugins folder.
3. Add [social_feed] where the feed should appear, using a Shortcode block or a paragraph.

Installing a plugin needs the right permissions too. On a single site, that is an administrator. On multisite, only a Super Admin can install plugins. On WordPress.com, it needs a plan that allows plugins. Only the person who installs the plugin decides which script it outputs, so editors cannot use the shortcode to add other scripts.

What not to do

1. Do not install a plugin that turns off WordPress’s HTML filter for everyone. It fixes one embed and opens every page to any script that any logged-in user adds.
2. Do not grant unfiltered_html to authors or contributors unless you trust every one of them with full control of your site’s pages.
3. Do not remove DISALLOW_UNFILTERED_HTML without asking the person who added it.
4. Do not paste the embed code into the theme’s functions.php as raw HTML. It is not PHP, and it can break the site. If you want to work with code, use the shortcode approach above.

Frequently asked questions

Why does the code stay for me but disappear for my colleague?
Because WordPress filters content based on the role of the person who saves. If your colleague is an author or contributor, the script is removed when they save the page, even if you added it.

I am an administrator. Why is my code still removed?
Either your site is part of a multisite network, where only Super Admins can save scripts, or DISALLOW_UNFILTERED_HTML is set in wp-config.php. On WordPress.com, it can also be your plan or hosting features.

Does WordPress remove iframes too?
Yes, for users without unfiltered_html. WordPress’s documentation for the Custom HTML block names both <script> and <iframe> as tags that are stripped. Our widget does not use an iframe; it is one script tag.

Can I use the Instagram feed on the free WordPress.com plan?
Not with our script embed. WordPress.com filters script tags unless the plan allows them and hosting features are activated. That is a WordPress.com rule, and nothing on our side can work around it.

Do I need a WordPress plugin for Social Feed?
No. The embed code is one script tag that you paste into a Custom HTML block. The shortcode plugin above is only an option for sites where scripts cannot be saved in content. Read more in adding an Instagram feed without a plugin.

Will updating WordPress remove my embed code?
An update does not rewrite your existing pages. The script is only filtered when someone saves the content. If your code disappeared after an update, check whether a plugin, a role change or a new security setting arrived at the same time.

Get your feed on WordPress

Once you know who can save scripts on your site, adding the feed takes a minute. Create a free account, connect your Instagram professional account, copy the embed code and follow the WordPress guide. The Free plan includes one widget; see pricing for the paid plans.

Sources

1. WordPress.org Documentation, “Roles and Capabilities”: https://wordpress.org/documentation/article/roles-and-capabilities/
2. WordPress.org Documentation, “Custom HTML” block: https://wordpress.org/documentation/article/custom-html/
3. WordPress Developer Resources, kses_init(): https://developer.wordpress.org/reference/functions/kses_init/
4. WordPress Developer Resources, map_meta_cap() (unfiltered_html and DISALLOW_UNFILTERED_HTML): https://developer.wordpress.org/reference/functions/map_meta_cap/
5. WordPress.com Support, “Custom HTML Block”: https://wordpress.com/support/wordpress-editor/blocks/custom-html-block/
6. WordPress.com Support, adding code to your site: https://wordpress.com/support/code/
7. WordPress.com Support, installing a plugin: https://wordpress.com/support/plugins/install-a-plugin/