Strands PDF Embed

1. 01Upload the pdf-embed/ folder to wp-content/plugins/
2. 02Activate the plugin via the Plugins screen
3. 03Visit Settings → PDF Embed to configure default sizing and appearance

Can I override the viewer markup in my theme?

Yes. Copy wp-content/plugins/pdf-embed/templates/viewer.php to wp-content/themes/your-theme/pdf-embed/viewer.php and edit.

Does it work with private / draft attachments?

It mirrors WordPress’s own permission model. The viewer only renders for visitors who have permission to read the underlying post ( current_user_can('read_post', $id) ). In practice that means:

• Logged-in admins, editors, and the post’s author : drafts and private posts render in their post-preview screens, exactly like the rest of the post content.
• Anonymous visitors : drafts and private posts are blocked (an HTML comment is emitted, no viewer). This is a deliberate security boundary; leaked draft URLs cannot expose embedded PDFs.

If you need to share a draft preview with someone who can’t log in, that’s a WordPress concern, not a PDF Embed one (use a preview/share-link plugin or publish the post privately).

How do I add translations?

Drop a .po / .mo / .l10n.php file into the plugin’s languages/ folder using the pdf-embed text domain.

Does it work on multisite?

Yes. Activation seeds defaults per site, and uninstall cleans options on each site (including the legacy pdfembed_source from older versions). No network-wide tables, no add_site_option use; per-site settings stay independent.

Where does the Enfold ALB element show up?

In Enfold’s Advanced Layout Builder, look for PDF Embed under the Media Elements tab. If your Enfold runs in a non-English language, Enfold groups elements by localized tab name and ours stays in English — so PDF Embed may show up in its own auto-created group instead. The element itself works identically either way.

How does the Print button work?

The viewer renders PDFs safely via PDF.js (canvas pixels, no PDF-side JS executes). The Print button, however, hands the raw PDF to the browser’s native PDF renderer; that’s the only way to get a browser’s print dialog. Don’t rely on Print for security-sensitive documents.

Is my PDF.js version patched for CVE-2024-4367?

Yes. PDF Embed ships PDF.js 6.4.299, well past the 4.2.67 patch.

If I set `download=”no”`, can visitors still save the PDF?

Yes, technically. The Download button is removed from the toolbar, but the PDF bytes are loaded into the browser by PDF.js to render the document, so a visitor with browser developer tools can still extract them. Use download="no" to remove the button as a UX choice (e.g. on pages where you don’t want to encourage downloads), not as a security boundary. The same applies to navigation="no" and zoom="no" : they remove buttons; they don’t prevent a determined visitor from re-enabling those interactions in their browser. To actually keep a PDF private, restrict the post that embeds it (private/draft, role-restricted, members-only plugin).