Full transparency: Links marked with (*) are affiliate links. Yes, we might earn a commission if you buy. No, that doesn’t mean we’re shilling garbage. We recommend what we’d actually use ourselves. Read our full policy.

Everyone’s debugging the wrong problem.

When you see “Video unavailable” with error 153 on an embedded YouTube video, forums explode with theories: dev vs. production settings, special API configurations, CDN issues, WordPress plugin conflicts.

None of that matters.

The actual problem: Your site isn’t telling YouTube where the embed request came from.

That’s it. YouTube requires a referrer header for embedded videos. No referrer = no video. This isn’t a YouTube bug, a hosting issue, or a dev/live environment problem. It’s a missing HTTP header.

The one-line fix

Your site needs this referrer policy:

Referrer-Policy: strict-origin-when-cross-origin

Not no-referrer. Not same-origin. Not whatever privacy guide you read last week suggested. YouTube’s embed system requires strict-origin-when-cross-origin specifically.

Why people get this wrong

  1. Privacy zealots recommend no-referrer – which breaks YouTube embeds (and a lot of other things)
  2. Developers assume it’s environment-specific – it’s not. Same rules for dev, staging, and production
  3. People confuse this with SSL requirements – they’re related but separate issues

How to actually fix it

For Apache (.htaccess):

Header set Referrer-Policy "strict-origin-when-cross-origin"

For Nginx:

add_header Referrer-Policy "strict-origin-when-cross-origin";

For WordPress (if you can’t access server config):
Add to your theme’s functions.php:

add_action('send_headers', function() {
    header('Referrer-Policy: strict-origin-when-cross-origin');
});

For individual iframes (when you need granular control):
Add the attribute directly to the iframe:

<iframe 
    src="https://www.youtube.com/embed/VIDEO_ID"
    referrerpolicy="strict-origin-when-cross-origin"
    frameborder="0" 
    allowfullscreen>
</iframe>

This is useful if you can’t modify server headers or if you only want specific embeds to send referrer information.

The official word

Don’t believe me? Read Google’s own documentation.

After fixing hundreds of these: The sites that have this problem usually have other header misconfiguration issues too. If you’re getting error 153, audit your entire security header setup.