How to embed a SCORM course in WordPress. Without a plugin.

You finished the course. The client’s site runs on WordPress. So you do the obvious thing — drag the SCORM .zip into the Media Library — and nothing useful happens. Maybe it uploads as a dead file. Maybe the page offers a download link to a zip no human can open. Either way, the module doesn’t run.

Here’s the fix, and it’s simpler than every “best SCORM plugin for WordPress” listicle wants you to believe: you don’t need a plugin. You need one good link.

/01Host it first, then embed.

A SCORM package is a .zip that expects to talk to a JavaScript runtime — the thing that calls LMSInitialize() and records completion, score, and bookmarking. WordPress serves files; it does not provide that runtime. So the move is always two steps: host the package somewhere that runs it, then point WordPress at the URL.

Publish from Storyline, Rise, or Captivate, upload the package to a host that serves the player (on Training OS the module plays on your public portfolio at /portfolio/<handle>; Pro adds an embed URL at /embed/<courseId> and private share links), and — before you touch WordPress — open that URL in a plain browser tab. If audio, completion, and resume work there, they’ll work embedded. If they don’t, fix it at the host first; WordPress can’t fix a broken launch.

One prerequisite: your WordPress site must be on HTTPS. An HTTP page embedding an HTTPS player throws mixed-content warnings, and some browsers block it outright.

/02Two ways to put it on the page.

Once the URL works, you have exactly two good options. Ranked by how rarely they break:

<iframe
  src="https://www.trainingos.com/embed/your-course-id?creator=your-handle"
  width="100%"  height="760"
  allow="fullscreen"
  title="Compliance refresher — interactive module"
></iframe>

/03Where WordPress fights you.

If the iframe misbehaves, it’s almost always one of three WordPress-specific things — in order of how often I see them:

1. A security plugin is blocking the frame.

Wordfence, iThemes, and friends sometimes refuse to render external iframes. Whitelist your host’s domain in the plugin’s content-security settings — or just use the new-tab button and move on with your day.

2. The editor ate your iframe.

Page builders and “sanitize HTML” settings strip <iframe> tags on save. If your embed vanishes after you hit Update, use a block that explicitly allows raw HTML — or, again, the button.

3. A caching plugin is serving a stale page.

WP Rocket, LiteSpeed, and co. cache aggressively. Exclude the page from full-page cache while you’re testing, or you’ll swear you fixed something that the cache is quietly hiding.

/04Before you hit publish.

Run this once, from a logged-out incognito window:

• The button or iframe loads the module — not a download prompt.
• Audio plays, completion fires, and resume works if your package relies on them.
• It looks right on a phone — narrow themes crush iframes; bump the height or fall back to the button.
• Re-check after any theme or plugin update; updates love to re-tighten allowed HTML.

/05Frequently asked questions.