Free plan

Embedding a document

Use oEmbed or the embed code snippet to display your EveryPage documents on external websites.

Embedding displays an EveryPage document inside a page on your own site — a blog post, a landing page, a client portal — using an iframe. The embedded viewer is the same viewer as the share page with its surrounding chrome removed, and it is subject to one structural constraint: a cross-site iframe does not carry EveryPage session cookies, so settings that depend on a session gate cannot be satisfied inside an embed.

How embedding works

EveryPage documents are embedded via a dedicated /embed/ path that serves the same viewer as the share page — honouring your viewer mode — but without the page chrome around it. The /embed/ path is the only one served with a framing policy that permits foreign sites (frame-ancestors *); an ordinary share URL is sent with frame-ancestors 'none' and a browser will refuse to render it in an iframe. Always embed the /embed/ form.

When readers view your document through an embed, their views appear in your readership analytics with source: embed, so you can distinguish between direct visits and embedded visits.

Embed code and the embed URL

The Share panel on a document's Configure & Share page shows a ready-made snippet:

<iframe src="https://everypage.co/embed/aBcD1ef2gHiJ" width="100%" height="600" style="border:none;"></iframe>

The src attribute always uses your document's durable short ID (or its UUID, for documents created before short IDs existed), never a vanity slug. This is a frozen-artifact rule: an embed snippet pasted into a website today must survive a slug rename. The host, however, is whichever base your links use at the time the snippet is generated — if you have an active custom domain, the snippet points at that domain and depends on it staying verified and on Pro.

Some platforms (notably Notion's Embed block) construct the iframe themselves from a pasted URL. For those, copy the bare embed link instead:

https://everypage.co/embed/aBcD1ef2gHiJ

The Share panel provides both — a "Copy" button for the iframe snippet and a "Copy embed link for Notion" button for the bare URL.

Limitations with gated documents

The embed viewer refuses to render four kinds of document, and shows a short notice with an "Open document" link to the direct share URL instead:

SettingWhy the embed refuses
Password protectionThe password is verified against a session cookie, which a cross-site iframe does not carry
Email gateSame session-cookie constraint; the reader must pass the gate on the direct link
Lead-capture form fieldsAs above, with a message naming the form
View limitEvery iframe load would consume one of the document's remaining views

Password protection also removes the embed code from the Share panel entirely, replacing it with a note that embedding is disabled for password-protected PDFs. The other three settings still show the snippet — the refusal happens when a reader loads the frame.

If a document needs access control, share the direct link rather than an embed.

oEmbed auto-embedding

oEmbed is a discovery protocol that lets a platform turn a pasted link into an embedded viewer without you writing any HTML. WordPress is the main consumer that uses it against EveryPage. The platform calls the endpoint with your link:

GET /oembed?url=https://everypage.co/aBcD1ef2gHiJ

The endpoint is public and unauthenticated. It accepts all three identifier forms — short IDs, UUIDs and vanity slugs — plus link-variant short IDs and /embed/ URLs, and returns a type: rich JSON payload whose html is an 800×600 iframe on the /embed/ path. As with the copied snippet, that iframe is built from the parent document's durable identifier, never a slug and never the variant.

Vanity slugs are resolved against the host in the url you pass, so a slug only resolves when the link was written on the owner's own custom domain. Every dead shape — unknown identifier, expired, burned, or a slug presented under the wrong host — answers the same 404, with no detail that would distinguish them. Requesting format=xml (or any format other than json) answers 501; omitting url answers 400.

WordPress

WordPress treats an unknown oEmbed provider as untrusted and renders it in a sandboxed iframe with an opaque origin. The EveryPage viewer cannot boot inside that sandbox, because its requests for assets and public read endpoints fail the origin check. This is a real limitation, not a configuration mistake: a plain paste on a site without the plugin will not render the document.

The EveryPage WordPress plugin fixes it by registering everypage.co as a trusted provider on the site it is installed on, so the iframe is not sandboxed and the viewer loads normally.

Notion

Notion does not need oEmbed. Paste the bare embed link (not the iframe snippet) into a Notion page and choose Embed — not Bookmark — from the menu Notion offers. Notion builds the iframe itself and the viewer loads.

Discovery

Consumers find the endpoint in two ways, both automatic:

  1. A static oEmbed <link> in the served HTML shell. WordPress reads raw HTML without running JavaScript, so this is the tag it uses; it appends ?url= to the endpoint itself.
  2. A per-document oEmbed <link> that the viewer page injects at runtime, for consumers that execute JavaScript.

Availability

Embedding — both the snippet and oEmbed — is available on every plan, including free, and on unclaimed anonymous uploads. Apart from the four settings listed above, file settings behave on an embed exactly as they do on the share page, and embed views are recorded as source: embed.