Social Embed

Paste a link. Get an embed. Put a YouTube, Instagram, X, TikTok, Spotify or Mastodon link on its own line in a post, save, and it becomes a polished embed. No code, no theme changes.

• 14 platforms: YouTube (including Shorts), Instagram, X, Mastodon, Threads, TikTok, Vimeo, Spotify, SoundCloud, Apple Music, Apple Podcasts, CodePen, Loom and GIPHY.
• Its own post cards for X and Mastodon: author, text, photos, date and counts, with no third-party scripts. They follow light or dark mode and size themselves.
• Never a blank box: deleted or private posts become a tidy link card.
• Fast: resolved once on save and cached. Nothing extra runs when readers visit.
• Privacy mode: preview cards instead of players, so nothing loads from the platforms until a reader clicks.
• Uninstall-safe: it stores standard EmDash blocks, so posts keep rendering without the plugin.

Does it slow down my pages? No. Embeds are resolved when you save. Post cards are plain HTML and CSS with no scripts, and players are lazy-loaded.

What if I uninstall it? Posts keep rendering. The plugin stores standard EmDash Iframe and HTML blocks.

Do I need an API key or a developer account? No.

A link didn't turn into an embed. Why? It must be alone on its own line, its platform must be switched on in settings, and it must point to a post or video, not a profile.

Can I edit an embed? Delete the block and paste a new link. Reload the editor after saving to see the converted block.

Which Mastodon servers work? mastodon.social, mastodon.online, mstdn.social, mas.to, hachyderm.io, fosstodon.org, infosec.exchange, mastodon.world, techhub.social and universeodon.com.

Social Embed runs in EmDash's plugin sandbox. It asks for content write (to replace a link with its embed on save) and network access to a fixed list of hosts: X (cdn.syndication.twimg.com, publish.x.com), 10 Mastodon servers, www.youtube.com, vimeo.com, open.spotify.com (preview titles and thumbnails) and TikTok (short-link expansion). It never requests unrestricted network access and injects no scripts into your pages.

All text from platforms is escaped, only https links and images are emitted, and post cards render in EmDash's sandboxed, isolated HTML block.

Report security issues to dipak@decryptsocial.com.

1. Install Social Embed from Admin → Registry and approve its permissions.
2. In any post, paste a share link on its own line, for example https://www.instagram.com/p/DfZNx2KSedR/.
3. Save. The link is now an embed.

You can also insert the built-in Iframe block (/iframe) and paste an ordinary share link into it.

Settings live under Admin → Plugins → Social Embed: card theme, card width, auto-embed on/off, privacy mode, per-platform switches, and a Try a URL tester. Settings apply to a post the next time it is saved.