How to embed a SCORM course in WordPress. Without a plugin.

You finished the course. The client's site runs on WordPress. So you do the obvious thing — drag the SCORM .zipinto the Media Library — and nothing useful happens. Maybe it uploads as a dead file. Maybe the page offers a download link to a zip no human can open. Either way, the module doesn't run.

Here's the fix, and it's simpler than every "best SCORM plugin for WordPress" listicle wants you to believe: you don't need a plugin. You need one good link.

WordPress is a CMS, not a SCORM runtime. It can show your course. It can't run it.— the whole article in one line

Host it first, then embed.

A SCORM package is a .zip that expects to talk to a JavaScript runtime — the thing that calls LMSInitialize() and records completion, score, and bookmarking. WordPress serves files; it does not provide that runtime. So the move is always two steps: host the package somewhere that runs it, then point WordPress at the URL.

Publish from Storyline, Rise, or Captivate, upload the package to a host that serves the player (Training OS gives you a stable HTTPS launch URL), and — before you touch WordPress — open that URL in a plain browser tab. If audio, completion, and resume work there, they'll work embedded. If they don't, fix it at the host first; WordPress can't fix a broken launch.

One prerequisite: your WordPress site must be on HTTPS. An HTTP page embedding an HTTPS player throws mixed-content warnings, and some browsers block it outright.

Two ways to put it on the page.

Once the URL works, you have exactly two good options. Ranked by how rarely they break:

<iframe
  src="https://app.trainingos.com/m/your-module"
  width="100%"  height="760"
  allow="fullscreen"
  title="Compliance refresher — interactive module"
></iframe>

Where WordPress fights you.

If the iframe misbehaves, it's almost always one of three WordPress-specific things — in order of how often I see them:

1. A security plugin is blocking the frame.

Wordfence, iThemes, and friends sometimes refuse to render external iframes. Whitelist your host's domain in the plugin's content-security settings — or just use the new-tab button and move on with your day.

2. The editor ate your iframe.

Page builders and "sanitize HTML" settings strip <iframe> tags on save. If your embed vanishes after you hit Update, use a block that explicitly allows raw HTML — or, again, the button.

3. A caching plugin is serving a stale page.

WP Rocket, LiteSpeed, and co. cache aggressively. Exclude the page from full-page cache while you're testing, or you'll swear you fixed something that the cache is quietly hiding.

Before you hit publish.

Run this once, from a logged-out incognito window:

• The button or iframe loads the module — not a download prompt.
• Audio plays, completion fires, and resume works if your package relies on them.
• It looks right on a phone — narrow themes crush iframes; bump the height or fall back to the button.
• Re-check after any theme or plugin update; updates love to re-tighten allowed HTML.

Frequently asked questions.