How to allow embedded content on Securly Filter

Embedded content on websites takes the form of images, videos, and widgets such as embedded threads and other interactive elements. A common problem is that a page loads fine, but an embedded like a YouTube video stays broken — that's because the embedded resource is usually hosted on a completely different domain than the page itself, and Filter policy may be blocking that domain separately.

When a browser requests embedded content, it sends HTTP headers that identify the source page making the request — not the destination:

• Referer — the page doing the embedding, e.g. https://mymaths.com/lessons/algebra

• Origin — the same source site, without the page path, e.g. https://mymaths.com

Both headers point back to the site that has the embedded content (e.g., mymaths.com), never to the embedded resource's own domain (e.g., youtube.com).

To allow embedded content on a website:

1. Navigate to Settings > Allow Lists.

   

2. Scroll to the Referer/Origin allow list, click the plus (+) icon, and enter the domain of the website that has the embedded content you want to allow (the page doing the embedding — not the embedded resource itself). For example, to allow a YouTube video embedded on mymaths.com, you'd add mymaths.com — not youtube.com — to the Referer/Origin allow list.

3. Click Add Domain. Embedded content will now be allowed on that website.