How to Embed a Photo Album on a Website

Two Snippets, and Which One You Actually Want

Open an album, press Share, and under the link itself there is now an embed section with two options. The first is an image, and it is the one to reach for unless you have a specific reason not to:

That is a picture wrapped in a link. It renders in Mailchimp, in a Substack post, in a Squarespace text block, inside a GitHub README, and in every content editor that strips iframes on save - which is most of the hosted ones. The image it points at is the same 1200x630 card a chat app draws when you paste the link into a thread, built out of the album's own cover photo, and it updates by itself when you change the cover.

The second option is the frame:

Use this one where you control the page and you want the album to look like part of it - your own site, a Ghost or WordPress install, a Notion page. It is a real grid rather than a single flat image, so a reader can see nine or twelve photographs at once instead of one.

What Ends Up Inside the Frame

The embed is a deliberately narrow view of the album, and the narrowness is the interesting part. It renders three things: the album title, a grid of thumbnails, and a button reading Open the album with the album's photo count beside it when there are more photos than the grid is showing. The grid is two columns on a phone and three from about 360 pixels of width upward, and it stops at 24 thumbnails however large the album is.

Everything else stays behind. The data the embed page is allowed to read is cut down to two fields per photo, an identifier and a thumbnail address, which is why the markup on your page cannot contain a full-resolution original even by accident. There is no download button, no upload affordance, no map, no owner name and no email address. If a visitor wants any of that they follow the button, which opens the album itself in a new tab - and the full-resolution originals live there, on a page whose behaviour you already understand.

Viallo is a private photo sharing platform, and two of its defaults matter for this. Viewers never make an account, so a reader who clicks through from your page lands on photographs rather than a signup wall. And the stored file is the file you uploaded, at full resolution with no compression pass, so the album behind a 400-pixel thumbnail is not a smaller version of your work.

One limitation worth knowing before you plan around it: a profile link, the single link that spans every album you own, cannot be embedded. There is no one album for the frame to draw, so it shows an unavailable state instead. Embed a per-album link.

Which Photo Services Hand You an Embed Code

This is a shorter list than people expect, and it is the reason the question gets asked at all. Most consumer photo services are built to end at their own page.

The Flickr row is the one worth dwelling on, because it shows the trade that usually comes with an embed. Flickr will give you an embed code for an album, and it asks in return that every photograph in that album be set to Public - which also means indexed, findable and open to anyone who never saw your page. Viallo's embed runs off an ordinary share link instead, and the embed page itself is marked as not to be indexed, so a search engine crawling your site cannot pull the album into its index through the frame.

Google Photos is the common disappointment. There is no embed feature and no way to iframe a shared album, which is why a search for it turns up third-party services that re-host your photographs to work around it. Handing a stranger's server a copy of your album to solve a layout problem is a poor trade.

The Frame Carries No Analytics and No Cookie Banner

An embed is an unusual thing to ship, because the code runs on a page that belongs to somebody else and is read by people who never chose to load Viallo at all. So nothing analytical runs inside it. Google Analytics, the Meta pixel, the product analytics, the page-view tracking and the advertising click-id capture each check whether they are inside the embed route and stop there. No consent chrome renders either - a cookie banner appearing inside a frame on your page would be your compliance problem, created by a picture you pasted in.

The framing rule is the other half of it. Every route on the site refuses to be framed at all; the embed route is the single exception, and it is the only one that omits the framing directives. That is a narrow hole on purpose, so that a share page or an album page cannot be dropped into a frame somewhere and dressed up as part of another site.

WordPress, Notion, and Why the oEmbed Answer Is a Photo

Some editors do not want a snippet at all. Paste a bare URL into WordPress or Notion and it asks the originating site what to do with it, over a small protocol called oEmbed. Viallo answers that question at /api/oembed, and the answer it gives is type: photo.

That is a considered choice rather than a limitation. The protocol also has a rich type, which can carry arbitrary markup, and WordPress takes that markup apart before it renders it. A photo response survives the trip intact, so pasting the link gets you the linked card reliably instead of an interactive block that works on one CMS and breaks on the next. If you want the live grid in WordPress, paste the iframe snippet into a custom HTML block.

A few details that save a debugging session:

• The endpoint answers JSON only. Ask it for XML and it says so with a 501 rather than pretending.
• It advertises a 600x315 thumbnail, and honours maxwidth and maxheight by scaling that proportionally.
• It suggests a one-hour cache, which is what stops a consumer re-fetching the card on every page view.
• WordPress clamps an iframe at 1000 pixels tall, so the embed page sizes itself from a 240-pixel floor and grows with its content rather than reading the viewport.

The preview image itself is a progressive JPEG rather than a PNG, at quality 82. That sounds like housekeeping and is not: Meta documents a 600 KB ceiling for WhatsApp link previews, the photographic cards were well past it as PNGs, and the JPEG re-encode measured 87 percent smaller with nothing visibly lost. A card that is too heavy is a card the chat app quietly declines to show.

What Your Page Shows After You Revoke the Link

An embed outlives the decision to embed it. You paste a frame into a post in September, and in March you revoke the link or its expiry date arrives. The post is still live, and the frame in it now points at nothing.

What the reader sees at that point is a short unavailable notice inside the frame. The album does not leak, and neither does anything about it - not the title, not a thumbnail, not the card image a chat app would have drawn. A consumer asking the oEmbed endpoint about the same link gets a refusal rather than a stale card.

There is one distinction the frame is careful about, and it is the kind of thing that only shows up in production. If Viallo's own backend fails to answer - an outage, a timeout - the frame does not claim the album was revoked. Saying "this album is no longer available" on somebody else's website is a statement about the owner's intentions, and publishing that because of a five-second network fault would be a lie that stays up for as long as the fault does. A transport failure reads as a transport failure.

Putting One On a Page

1. Open the album and press Share.
2. Create the link you want to embed, or pick an existing one. Give it a label if you keep more than one - it is what you will read later when you want to revoke this one and not the others.
3. Open the embed section under the link and choose Image or Iframe. Copy the code.
4. Paste it into your page. In WordPress that is a Custom HTML block; in Ghost an HTML card; in Notion an Embed block, where the bare share URL also works.
5. Load the published page in a private window. You are checking that you see what a stranger sees, which is the whole point of the exercise.

If you are a photographer putting client work on a portfolio page, the thing to read next is private photo sharing for photographers, because the interesting question there is not the embed but which link you embed and what it is allowed to do.

Frequently Asked Questions