What it does
The embed cleaner takes X embed code (or plain post URLs) and returns a cleaned version. It removes ref_src, utm and other tracking parameters from links, adds data-dnt="true", removes inline event handlers, javascript: links and scripts that don't come from X, keeps a single widgets.js loader, and can set the theme, hide media cards, hide the parent post in replies and align the embed.
What does the cleaner change?
It removes things you don't need, keeps the parts the embed script relies on, and lists every change it made.
| Before | After | Why |
|---|---|---|
...status/179...?ref_src=twsrc%5Etfw |
...status/179... |
Click tracking only |
?s=20&t=AbC... on x.com links |
removed | Share tracking added by the app |
utm_*, fbclid and similar |
removed | Campaign tracking |
<script src="https://platform.twitter.com/widgets.js"> repeated per embed |
one copy, or none | One loader per page is enough |
onmouseover="...", javascript: links |
removed | Nothing in an embed should run your code |
<script> from other hosts, <style>, <form>, <iframe> not from X |
removed | Pasted ad tags and leftovers |
no data-dnt |
data-dnt="true" |
Asks X not to personalize from the embed |
Which embed options can it set?
Theme, do-not-track, hidden media cards, hidden parent post, alignment, and the domain used in post links.
These map to the data attributes that X's embed script reads on the blockquote: data-theme="dark", data-dnt="true", data-cards="hidden", data-conversation="none" and data-align. X documents them in its embedded post parameter reference, listed under Sources. The "post links" option rewrites links between twitter.com and x.com. The script reads the status ID either way, but you might want consistent links for your own reasons.
Can I start from post URLs instead of code?
Yes: paste post links, one per line, and the cleaner builds a minimal embed blockquote for each.
A link like https://x.com/someone/status/1790000000000000000 becomes a blockquote with a single link and the loader script. When the page loads, X's script replaces it with the full card. If the script is blocked, visitors still see a "View post on X" link, which is better than an empty gap.
Is the cleaned code safe to paste into WordPress?
Yes, as long as you paste it into a Custom HTML block (block editor) or the Text tab (classic editor).
The visual editors may strip the script tag, which leaves a plain quote. If you load widgets.js once in your theme, turn on "Remove widgets.js" here and paste just the blockquotes. Our guide to filtering embedded posts covers WordPress, static sites and social walls.
Common questions
Does removing ref_src break the embed?
No. The ref_src parameter only tells X where a click came from. The embed script finds the post from the status ID in the link, so the post still renders.
What does data-dnt do?
It is X's do-not-track option for embeds. With it set to true, X says it won't use the embed to personalize content or ads for your visitors. The embed script still loads from X, so this isn't the same as blocking X completely.
Why remove widgets.js from each embed?
Every embed code from X ends with the same script tag. If a page has five embeds, it has five copies. Browsers handle that, but it's cleaner to load the script once in your template and paste only the blockquotes into posts.
Can it embed a post without loading anything from X?
Not as a live embed; the rendered card always comes from X. The text preview in the tool shows what visitors see if the script is blocked. That fallback is a plain quote with a link, which is a reasonable privacy-friendly option on its own.