Dropping a video onto a page takes one iframe, but a good embed takes a few decisions most tutorials skip: which domain to load the player from, how to stop the player's scripts from slowing the whole page, and which URL parameters still do anything. This guide covers the markup, the privacy option and the loading strategy, with a worked example you can adapt to your own pages.
Three decisions, not one.
A YouTube embed is an iframe pointed at youtube.com/embed/ followed by the video ID. Everything else is configuration: size, URL parameters like start and mute, and the allow attribute that grants the player permissions such as fullscreen and picture-in-picture.
Three things separate a careless embed from a good one: markup that keeps its shape on phones and does not break fullscreen, a privacy setting you chose on purpose, and a loading strategy that does not punish visitors who never press play.
Parameters deserve some scepticism, because a lot of advice online is out of date. YouTube has changed several over the years, including rel=0, which once hid all related videos and now only limits them to the same channel. Snippets copied from old blog posts can carry flags that no longer do what they claim. The ones that work reliably are autoplay, mute, controls, loop, start and end, plus rel, cc_load_policy, hl and playsinline. The generator sets each of them from a labelled checkbox or field, so you never type a parameter.
From shared link to markup.
Say a colleague shares https://youtu.be/dQw4w9WgXcQ?t=90 and you want it on a page starting at that moment. Paste the link into YouTube Embed Code Generator and the Start at field fills in 1:30 from the t= value. The iframe's src becomes https://www.youtube.com/embed/dQw4w9WgXcQ?start=90, and the live preview shows the player exactly as it will appear.
With Sizing left on Responsive (CSS aspect-ratio), the default, the iframe gets width 100%, a maximum width of the size you entered and a CSS aspect ratio of 560 by 315, so it shrinks on phones without a wrapper div. The code also carries a title attribute, the allow list, a referrer policy and allowfullscreen. Notice the two translations that happened: the youtu.be link became the /embed/ path, and t=90 became start=90. Watch-page links and embed links use different formats, which is why pasting a watch URL straight into an iframe fails.
One domain swap.
Tick Privacy-enhanced mode and the src switches from www.youtube.com to www.youtube-nocookie.com. YouTube says this mode limits what it stores about visitors until they play the video. For sites subject to consent rules like the GDPR, that change can matter, though you should confirm the details with whoever owns your compliance.
All the other options behave the same on both domains. Start times, controls, mute and loop work identically, so there is no functional cost to the private variant.
One caveat: the nocookie domain reduces tracking, it does not remove it. Once a visitor presses play, YouTube serves the video and collects playback data as usual. Treat it as a sensible default for public sites, not a replacement for a consent banner where one is legally required.
The weight problem.
An iframe that loads straight away pulls in the player's scripts before anyone interacts with it. The cheapest fix is adding loading="lazy" to the iframe, which delays the request until the player scrolls near the screen. The generator adds it by default through the Lazy-load checkbox. It is one attribute and a real help for Core Web Vitals.
The stronger version is the facade pattern: show a static thumbnail with a play button, and only insert the iframe when someone clicks. The Click to load tab writes it for you, a small block of HTML with a short script that swaps in the player and starts it on click or on Enter. Visitors who never play the video download one image instead of a whole player.
Measure the difference once on your own page and the case makes itself. Several eager embeds add a lot of third-party code before first interaction, while the same page with facades ships a few small images. The players arrive on demand, and only for the people who wanted them.
Seen in production all the time.
Most broken embeds fail in one of a few predictable ways.
Assemble, then adjust.
Build the snippet in YouTube Embed Code Generator, tick Privacy-enhanced mode if privacy matters, and copy the tab you need: HTML, Click to load, WordPress, React or Markdown. In WordPress, use a Custom HTML block, since the standard YouTube block ignores most of these options. Keep the title attribute descriptive, because screen readers announce it.
If you need a clean video ID from a messy link first, YouTube Video ID Finder handles Shorts, live and playlist links. And if the page only needs a preview image that links out to YouTube, skip the iframe entirely. A linked thumbnail costs almost nothing to load.
Try it now
The tool is one click away. No sign up, no upload, no payment.
Open YouTube Embed Code Generator