LFW

Blog · What the free audit finds

Embedding Video Without Breaking Accessibility

Paste a YouTube link into a page and the video appears. It also arrives with no name for a screen reader, no captions unless someone made them, and sometimes with sound that starts on its own.

The four things an embedded video needs, which ones the free audit catches, and how to add them on a WordPress site without touching the video itself.

What a screen reader hears

An embedded video is a frame from another website placed inside your page. A screen reader announces the frame before the visitor decides whether to enter it. If the frame has no title, the announcement is the word frame and nothing else, or the address of the video service. The visitor cannot tell whether it is a message from the director or a background loop.

The fix is a title attribute on the frame that says what the video is: the annual meeting keynote, a tour of the new clinic. Automated checks flag its absence on every page, and it is the single most common accessibility finding on organization sites we scan.

Captions are the standard, not the extra

Prerecorded video with speech needs captions under the accessibility standard every public body and most funders point to, WCAG 2.1 at level AA. Automatic captions from the video service are a starting point and nothing more: they miss names, numbers, and anyone with an accent, and a wrong number in a caption is worse than no caption.

Budget for corrected captions. The video service lets you edit the automatic text in place, and a ten-minute video takes about half an hour to correct. Captions also make the video searchable and watchable with the sound off, which is how most people watch on a phone.

Nothing plays by itself

Sound that starts without being asked is a barrier for a screen reader user, whose own audio it drowns out, and an annoyance for everyone else. The standard is plain: no audio that plays automatically for more than three seconds unless there is a control to stop it. Leave autoplay off. If a page needs a moving background, it should be muted, short, and stoppable.

A transcript, or at least a summary

Some visitors cannot use the video at all: a slow connection, a blocked video service on an office network, a deaf-blind visitor with a braille display. A transcript below the video serves them and doubles as the text search engines index. A two-paragraph summary is the acceptable minimum when a full transcript is not available.

Doing it on WordPress

The standard embed block takes a link and gives you no field for a frame title. The reliable way is a custom HTML block with the embed code from the video service, edited by hand.

The same snippet solves two other problems. The lazy attribute stops the video player loading until the visitor scrolls near it, which takes a heavy player off the first paint. The privacy address of the service, when it offers one, keeps the service from setting cookies until the visitor presses play, which matters for the privacy notice on your own site.

Show the code Hide the code HTML, 7 lines
<iframe
  src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  title="2026 annual meeting: the executive director's report"
  loading="lazy"
  allow="picture-in-picture"
  allowfullscreen>
</iframe>

Give the frame a width and height in the page's styles so it holds its space before it loads. Otherwise the page jumps when the player arrives, which is the subject of an earlier part of this series.

What the free audit catches

The free audit checks the homepage with the same automated accessibility rules a compliance reviewer starts with. A frame without a title is reported by name. Autoplay is reported when the player declares it. Captions and transcripts cannot be checked by a machine, which is exactly why they are the ones to check yourself.

Keep reading

September 20, 2026 4 minutes

What a Stranger Learns About Your Site in One Minute

Everything in this article is public. It is what a curious visitor, a vendor sizing you up, a journalist, or a scanner run by someone less friendly can read about your website in about a minute. The free audit is that minute, run on your behalf. This is what it looks at, in the order a stranger would.

September 20, 2026 3 minutes

Login Names Are Half a Login

Ask a WordPress site for its list of users and, by default, it answers. Every author's login name, in a machine-readable list, at a fixed address. Attackers do not have to guess who the accounts are. They only have to guess the passwords. Where the list comes from, how the free audit reports it, and the four changes that close it without locking anyone out.

All articles

    Powered by LFW Search
    Prefer to write?

    Tell us what needs to work better.

    Slow, fragile, hard to edit, missing a workflow. Say it plainly, and you'll get a straight answer, not a ticket number.