{video} embeds a YouTube or Vimeo video without letting the video site run anything before the visitor asks for it (tags/_lib/video.php). The page shows a poster with a play button; only a click on the button puts the player's iframe in the poster's place and moves the focus into it.

The poster of a YouTube video is its thumbnail on i.ytimg.com - an image, no script and no cookie - and the player comes from youtube-nocookie.com with autoplay=1&rel=0. A Vimeo video gets a quiet drawn poster unless poster names a picture, and its player is asked with dnt=1. The small script that swaps poster and player is written once per request, with the CSP nonce when $padCsp asks for one. Without script the button is hidden and a <noscript> link to the video on its own site stands in its place.

A file of www/<application>/ - .mp4, .webm, .ogv or .mov - is written as <video controls preload="none" playsinline> with its poster: nothing is loaded before play. A start time is written in the address - t=, start= or #t= - or as the at option, as 90, 1m30s or 1:30; not as start, the handling option that skips occurrences. ratio sets the proportion of the box. The colours are --pad-video-* custom properties on .pad-video.

title is required - it is what a screen reader says for the button and the player. A missing title and an address that is no known video are errors under the strict check.