Preparing and hosting packages

Embed My does not store your .h5p file. It plays the package from a URL you provide, so the file has to be complete and reachable by a visitor's browser.

Where to put the file

The URL must point at the .h5p file itself, over HTTPS, and be public:

https://embed-my.github.io/samples/quiz.h5p

Do not use a link to a download page, a cloud-drive preview page, or a private LMS page. If your website cannot host the file, use one of the free places below.

Opening the URL in a private browser window should download the package without a login.

Free places to put the file

Checked on 9 October 2026 from the Embed My player origin, by request headers and, where a .h5p file was available, by playing it through the player. Services change their terms and their links; if one of these stops working, tell us.

Google Drive and OneDrive share links do not work: they send the file without the CORS header, and there is no setting to add it.

Dropbox

Most teachers already have an account, and the only step beyond sharing is one edit to the link.

1. Upload the .h5p file to Dropbox.
2. Share it: Create link, with Anyone with the link able to view. Copy the link. It looks like https://www.dropbox.com/scl/fi/abc123/quiz.h5p?rlkey=xyz&dl=0.
3. In that link, replace www.dropbox.com with dl.dropboxusercontent.com, and dl=0 at the end with dl=1: https://dl.dropboxusercontent.com/scl/fi/abc123/quiz.h5p?rlkey=xyz&dl=1.
4. Paste the edited link into Embed My. The unedited link does not work: it redirects, and the redirect carries no CORS header.

A Basic account's links are paused for 24 hours once they have served 20 GB, or 100,000 downloads, in a day, counted across all your links. That is hundreds of plays of a typical package. The direct-download address is not something Dropbox documents, so if it ever stops working, come back to this guide; the file itself is safe in your Dropbox either way.

GitHub

No Pages site needed: a file in a public repository already has an address that works.

1. Create a free account, then a new public repository, named for example h5p.
2. Add file → Upload files, drag the .h5p in, and Commit changes. The website takes files up to 25 MB; git tools take up to 100 MB.
3. Open the file in the repository, press Raw, and copy the address: https://raw.githubusercontent.com/<you>/h5p/main/quiz.h5p.

Upload a new file under the same name to update the activity; the address stays the same. GitHub does not mean this address for heavy traffic, but a class or a school site is nowhere near that. GitHub Pages serves the same files at a <you>.github.io address, which is what Embed My itself uses.

Zenodo

For material you are publishing openly anyway. Zenodo is the research repository run by CERN: free, permanent, and it gives the upload a DOI.

1. Create an account, then New upload. Choose the resource type Lesson, add the .h5p file, a title and a licence, and Publish.
2. The address to use is not the download link on the page. Build it from the record number in the page's address and the file name: https://zenodo.org/api/records/<record number>/files/quiz.h5p/content.

Everything on Zenodo is public and permanent: a published file cannot be replaced, and a new version gets a new record number, so an updated activity means a new link and a new snippet. Each record takes up to 50 GB.

Backblaze B2

Plain file storage with a generous free tier and no card to sign up.

1. Create a free account and a bucket with Files in bucket set to Public.
2. In the bucket's settings, under CORS Rules, choose Share everything in this bucket with all HTTPS origins, for both APIs. Without this step the file is refused.
3. Upload the file and copy its Friendly URL: https://f00x.backblazeb2.com/file/<bucket>/quiz.h5p.

The first 10 GB are free, and so are downloads up to three times what you store each month; beyond that Backblaze charges by the gigabyte, with a card on file.

Your own or your school's web host

Any web space that serves files over HTTPS works once it sends the CORS header. Ask whoever runs it to add Access-Control-Allow-Origin: * for the folder, which on Apache is one line in .htaccess and on nginx one add_header line. WordPress refuses .h5p uploads to its media library unless an administrator allows the file type.

Server headers

CORS (required)

The H5P package is fetched by the Embed My frame, on https://embed-my.github.io, not by the page it is embedded in, so the file host must allow cross-origin requests from that origin; Access-Control-Allow-Origin: * is the usual way. For publicly shared teaching material, a permissive header is often appropriate:

Access-Control-Allow-Origin: *

Range requests (recommended)

For large packages, also support ranged requests and expose their headers:

Accept-Ranges: bytes
Access-Control-Expose-Headers: Content-Range, Accept-Ranges, Content-Length, ETag

With them, a large package starts playing after a few kilobytes. Without them, it is downloaded whole before anything plays, which still works. A simple range such as bytes=0-99 needs no CORS preflight, so a host that ignores OPTIONS requests is not a problem.

An ETag or Last-Modified header lets the player tell a file republished at the same address from the old one, and a visitor who comes back reads almost nothing of the package again. The frame can read Last-Modified from any host, and an ETag only when the host lists it in Access-Control-Expose-Headers, as above.

GitHub Pages meets both requirements as it comes. The player's setup guide lists exactly what it needs.

Packages and library files

An H5P package normally includes the libraries it needs. Exports from H5P.com and h5p.org usually contain only content/ and expect the site they came from to provide the libraries.

Embed My plays those too. The player keeps a pack of the H5P hub's libraries for every content type the hub serves, one file per library, served from the player origin. A package that ships without its libraries downloads only the ones it needs from there, and the browser keeps each one for the next package that uses it. It asks no other site for libraries. See Privacy and security.

A package written for an older version of a library plays too, and so does one that carries an older version. The pack has the newest version of each library, the player plays that one, and before the activity starts it converts the content with the library's own upgrade steps, as Moodle, WordPress and the other H5P plugins do when a site installs a newer version. If a step fails, the activity plays as it was written. The lines under the preview name the libraries that played newer than the package carries them. To play them exactly as exported instead, add &refresh-libraries=off to the end of the src in the snippet.

If the preview still reports missing libraries, the package needs a library the pack does not carry: a new major version the H5P hub does not serve yet, or a library written for a single site. Export the activity as a complete package, including libraries, when your authoring tool offers that option. The player's libraries guide explains how library sources work.

Content made for newer libraries

H5P.com gets a library's new version weeks before the H5P hub serves it, so an activity made there in those weeks can name a version that nobody else has yet. The player plays it at the newest version of that library the pack has, and the lines under the preview say which.

Most new versions only add fields, which the older version ignores. Where one changed the shape of the content, a part of the activity can be missing or drawn wrong, so play through every part of it. To refuse such a package instead, add &downgrade-libraries=off to the end of the src in the snippet. The pack follows the H5P hub, so once the hub serves the newer version, a later release of the player plays the activity as made.

How big can a package be?

Embed My sets no limit and never holds the file; what limits a package is where it lives.

• On a host that answers Range requests, the player reads the archive in place. It fetches the index with a few kilobytes, pulls only the parts the activity asks for, and never holds more than 8 MB in memory, so a 300 MB package starts within seconds. The ceiling is your host and your visitors' connection, not the player.
• On a host without Range, the whole archive is downloaded and stored in the visitor's browser before anything plays. A package larger than the room the browser gives the site fails with a storage error that names the size it needed. That room varies by browser, is smaller for a frame inside another site and in private windows, and has no fixed number: tens of megabytes are safe there, hundreds are a gamble. Prefer a host that supports ranges, or keep the package small.
• Hosts cap files too. GitHub refuses single files over 100 MB, so that is the practical ceiling on GitHub Pages.
• Size is almost always video, and video compressed inside the archive or not arranged for streaming has to download in full before it plays on any host. See the next section.

Video that is slow to start

Large media may be compressed inside the .h5p archive, or the video may not be arranged for progressive playback, so it cannot start until it has fully downloaded. Rewrite the package once with:

npx @missing-elements/h5p-normalize course.h5p

This rewrites the package for streaming without changing the learning content. The player's streaming video guide explains the cause.

Third-party content

H5P content may contact services named by the package, such as YouTube, Vimeo, Google Fonts, MathJax, or an organization-hosted media service. Review a package and its third-party content before publishing it. See Privacy and security.