---
title: YouTube embed error 153
canonical: https://wpsecurityninja.com/docs/errors-and-debugging/troubleshooting-youtube-embed-issues-error-153/
---
YouTube embed error 153 (often shown as “Error 153: Video player configuration error”) usually means the player did not get the referrer or framing info it needs. On WordPress, security headers from WP Security Ninja or another plugin can cause **youtube error 153 wordpress** failures even when the video ID is fine. This guide covers how to find and fix it.

## Quick checklist for error 153 youtube

Work through these in order:

1. **Referrer-Policy** on the page: use `strict-origin-when-cross-origin`, not `no-referrer` or `same-origin`.
2. **CSP `frame-src` / `child-src`**: allow `https://www.youtube.com`, `https://www.youtube-nocookie.com`, and `https://*.ytimg.com`.
3. **Iframe `referrerpolicy`**: add `referrerpolicy="strict-origin-when-cross-origin"` on the YouTube `<iframe>`.
4. **Conflicts**: temporarily disable other security or caching layers if headers look correct but the player still fails.

For header setup in WP Security Ninja, see [security headers](https://wpsecurityninja.com/docs/security-fixes/security-headers/).

## Understanding Error 153

YouTube’s embedded player expects a usable HTTP `Referer` (and related header policy) so it can validate the embed. Strict referrer policies, Content Security Policy gaps, or odd iframe settings can trigger Error 153 on YouTube in WordPress even when the video ID is fine.

## How to check for YouTube embed issues

Inspect the page’s HTTP headers and the embed HTML.

### 1. Inspect HTTP Referrer-Policy

The `Referrer-Policy` header controls what referrer data is sent. Too strict, and YouTube cannot validate the embed.

1. Open the page that shows Error 153.
2. Right-click and choose Inspect.
3. Open the Network tab, then refresh.
4. Select the main HTML document request (your domain).
5. Under Response Headers, find `Referrer-Policy`.

**Problematic:** `no-referrer` or `same-origin`.  
**Recommended:** `strict-origin-when-cross-origin` (YouTube’s usual recommendation; also the WP Security Ninja default for new installs and the setup wizard).

### 2. Check for X-Frame-Options

`X-Frame-Options` stops pages from being framed. It is less often the sole cause of Error 153, but a harsh setting on embed-heavy pages can add friction.

1. Use the same Network / Headers steps as above.
2. Look for `X-Frame-Options` in Response Headers.

**Problematic:** `DENY` or `SAMEORIGIN` on pages where third-party iframes must load.  
Configure carefully when you mix security headers with embeds.

### 3. Review Content Security Policy (CSP)

If CSP is on (via WP Security Ninja or elsewhere), missing YouTube hosts in `frame-src` / `child-src` will block the player.

1. Same Headers inspection as above.
2. Find `Content-Security-Policy`.
3. Check `frame-src`, `child-src`, and if needed `script-src` and `img-src`.

Allow YouTube hosts, for example:

- `frame-src` / `child-src`: `https://www.youtube.com` `https://www.youtube-nocookie.com` `https://*.youtube.com` `https://*.ytimg.com`
- If you use the IFrame API: `script-src` includes `https://www.youtube.com` `https://*.ytimg.com`
- Thumbnails: `img-src` includes `https://i.ytimg.com` `https://*.ytimg.com`

### 4. Examine the YouTube embed code

The iframe may be missing `referrerpolicy`.

1. Right-click the player area and Inspect.
2. Find the YouTube `<iframe>`.

Add `referrerpolicy="strict-origin-when-cross-origin"`:

```html
<iframe
  src="https://www.youtube.com/embed/VIDEO_ID"
  referrerpolicy="strict-origin-when-cross-origin"
  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; fullscreen"
  allowfullscreen
  loading="lazy"
  width="560" height="315">
</iframe>
```

## Common solutions

### Adjust Referrer-Policy

- **WP Security Ninja:** the default for new installs and the setup wizard is `strict-origin-when-cross-origin`. If an older saved setting still uses `same-origin` or `no-referrer`, change Referrer-Policy under Security Headers / Fixes to `strict-origin-when-cross-origin` (or another policy that still sends a usable cross-origin referrer).
- **Apache `.htaccess`:**

```apache
<IfModule mod_headers.c>
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
```

- **Nginx:**

```nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
```

- **HTML meta** (less precise, sometimes enough):

```html
<meta name="referrer" content="strict-origin-when-cross-origin" />
```

### Update the YouTube embed

- Add `referrerpolicy="strict-origin-when-cross-origin"` on the iframe.
- Try `youtube-nocookie.com` in the `src` (`www.youtube-nocookie.com/embed/...`). That privacy domain often clears referrer-related failures.

### Configure CSP

Whitelist YouTube in `frame-src` and `child-src` (and related directives if you use the API). Adjust CSP in WP Security Ninja or your host config to match the hosts listed above.

### Check conflicting plugins or services

Temporarily disable other security plugins, caching plugins, or CDN/WAF layers (for example Cloudflare) one at a time. If one of them “fixes” Error 153 when off, configure that layer to allow YouTube embeds instead of leaving security off.

Work through headers first, then the iframe, then CSP. That order usually finds the cause of YouTube embed error 153 without guessing.