QUESTION:

When I paste embed or iframe HTML code on the “Text” tab and then “Publish” the post, my embed and iframe code is stripped out. I am the site administrator, why is this happening?

ANSWER:

WordPress Multisite (which is what Virginia Tech is running) does not permit straight embed codes or iframes (i.e. unfiltered HTML) for anyone but network administrators. It’s a security precaution, as embedding and iframes are two ways malicious code gets injected into WordPress sites.

Good news, though: there’s an “internal whitelist” built into WordPress that allows embedding of YouTube and Vimeo videos. See the Whitelist for a complete list and more information: http://codex.wordpress.org/Embeds. The trick is simply to put the plain URL into the visual editor box (i.e. the “Visual” tab). Once you do that, the video is embedded automatically.