# Embedding the statement without a plugin

How to embed the statement with a snippet or server-side in TYPO3, Drupal or your own website – with allowed domains and never an empty spot.

**In short**

- Set up embedding in the “Embedding” tab; the ready-made snippet appears once a statement is published.
- Embedded server-side, the text is part of the page even without JavaScript – the better way wherever possible.
- A browser only loads the text from domains you have allowed. The key is not a secret.

Embedding shows your published statement on a page of your own website and follows every new version automatically. It is included from the Starter plan.

## Setting it up

1. In the service, go to “Websites” → your website → the “Embedding” tab.
2. Choose “Set up embedding”.
3. Under “Allowed domains”, enter the domains the statement should appear on – one per line – then “Save domains”.

Only “Owner” and “Administration” see this tab.

## Way 1: the snippet

For systems where you can only paste HTML. Once a statement is published, the ready-made code appears under “Snippet for your page”. Place it where the statement should appear.

The snippet contains a visible link to the public statement. The script replaces it **only** when the text has loaded successfully. Without JavaScript, with a blocked script or when retrieval fails, the link stays – so this spot is never empty. The script loads no CSS and changes nothing else on your page.

## Way 2: server-side

If your system can send an HTTP request – TYPO3, Drupal, custom code – retrieve the “Address of the fragment” on the server and insert the HTML into your page. The text is then part of the page without JavaScript, and you keep it in your own cache.

The address accepts the same settings as the WordPress shortcode as query parameters:

| Parameter | Values |
| --- | --- |
| `teil` | `komplett`, `maengel`, `kontakt` |
| `ueberschrift` | `2` to `4` |
| `stand` | `ja`, `nein` |

An unknown value falls back to the default instead of rejecting the request. What the values mean: [Showing the statement in WordPress: shortcode and block](https://barrierepruefung.de/en/help/wordpress-shortcode#attribute).

## Allowed domains

A browser only loads the text when the page is on an allowed domain. The host name is compared exactly: `example.org` and `www.example.org` are two entries. Enter both if your page is reachable under both.

Server-side requests send no origin and are therefore not restricted to allowed domains.

## The key is not a secret

The key is in your page’s source code, so it cannot be a secret. It does not need to be: it only opens what is available at the public address anyway. It ties the embed to your domains and can be locked and replaced.

- “Block embedding” – the embed delivers nothing; the snippet keeps showing its link.
- “Rotate key” – the old snippet no longer shows text until you have placed the new one.

The section shows when and from which domain the embed was last retrieved. That tells you it works.

## When a new version appears

On the server, the new version is available immediately. A browser may keep the response for 5 minutes, so a new version appears on your page within a few minutes. With server-side embedding, it also depends on your own cache.

## After a subscription ends

An embedded statement is often linked from elsewhere. So it does not simply disappear:

- If your plan no longer includes embedding, it still delivers the full text for 90 days.
- After that, it shows a visible link to the public statement, which stays online.

---

Last checked against the product: 2026-09-13 · https://barrierepruefung.de/en/help/embedding