Guidelines for using third-parties
Introduction
These guidelines provide a starting point of what to consider when you are planning to use third-party services on your website. The Mosaic team is not responsible for assessing the suitability or compliance of any third party. We are sharing best practice, known use cases, and signposting documentation and resources to support your own assessment.
Understanding embedding
Your site visitor will have the same experience in looking at content on your site as if they were accessing it on the originating site. If you are using an iFrame, it is opening a browser window within the widget. It is instead of you providing a URL link in body text and your site visitor opening that in a new browser window. If they followed the link, they would leave your Mosaic site. Using an iFrame means they leave your site while remaining on the Mosaic page. Site visitors may not appreciate they have left your site. As such, they will trust the content they are viewing is appropriate.
Whether or not the embedded content is displayed is outside your control. Some content providers amend the metadata so it does not allow sharing or embedding somewhere else. If the source content is deleted or the connection is disrupted, the widget on your Mosaic page might show as black, with or without an error message. If you are using script in Source view to embed, it is reliant on the script being OK. If something happens to break the script, you won’t know how well that will be handled by the content provider. It is possible the script could affect how the rest of the page performs. If an iFrame breaks, it will only affect the iFramed content.
Embedded content will be cached and remain available during a Mosaic maintenance window as long as nothing changes at the source to break the embed connection. You will need to schedule checks on your Mosaic site to verify embedded content is still available.
Loading iFramed content, whether or not the site visitor wants to interact with it, could slow down the performance of the page.
When you embed, your site isn’t hosting the content. This means you can manage disk usage more effectively and potentially reduce the cost of your site. Popular embeds are to video services such as YouTube (e.g. TED talks), Vimeo and Mappola, to podcasts, survey tools and audio services such as Spotify and Buzzsprout.
Service selection
There may only be one option for the content you want to embed. You will still have to consider privacy, cookies, accessibility and usability. There will be times when you will have to make a choice between services. Taking survey tools as an example, how would you decide between Survey Monkey, JISC online surveys, or Vevox?
Check the University’s third-party register Information Security - Third Party Register - All Items (sharepoint.com)
Conduct a risk assessment of who has developed the application. How long have they been in business? Can you find any evidence of historic security breaches? What impact could a security breach have if you used their service?
Ask the Oxford Mosaic User Community.
If the third parties pass your assessment for privacy, accessibility, and cookies policies, try each for yourself to assess usability.
Because the experience your site visitor will have will be as if they are on the source website, we recommend considering the following areas when deciding whether or not to embed their content. You have to decide whether you are happy for your site to be associated with the values and business ethos of the source content provider.
Check the third party’s privacy policy. Might the application make it difficult to comply with any regulations for auditing stored data (e.g. freedom of information requests)?
Developing Organizational Policies on Web Accessibility | Web Accessibility Initiative (WAI) | W3C WCAG advises a site’s accessibility policy needs to consider procured or syndicated third-party content. This is particularly relevant for third-party content that provides essential parts of a website such as video streaming channels.
Site owners are responsible for ensuring accessibility or for providing accessible alternatives. This is true even if site owners don’t have full control over such content and services. For example, social media feeds may need to be monitored or moderated to ensure accessibility.
You may need to provide a transcript of the content alongside the embed on your site. Although the best transcripts would be written by a professional service, some services, such as YouTube, offer auto-generated transcripts. You will probably need to edit before publication to correct garbled and mistranslated content. Depending on the length of the transcript, you may be able to place it next to the video in its entirety or with a scroll bar. This is preferable to providing a transcript as a downloadable file or linking to another page. The advantage of providing the transcript is it will be accessible to everyone via text, be searchable by everyone, and indexable for search engines.
People using keyboard navigation could get trapped within a YouTube video, for example, especially if it is already playing, because they will have to tab through the controls on the YouTube site before they identify the control to pause play. It is better to show a static image and play button rather than using auto-play. Consider using the upload from web function and inserting the URL so that the widget displays with a play arrow control. This also ensures visitors will access your content from the start.
Practicalities
Best practice says to start with information architecture. This means agreeing the structure of your content first, not starting with the visual design because it is what excites you. Otherwise, you risk shoe-horning content into a badly shaped container.
Research has shown more people look at the top left of a page and scan content in an F pattern. Avoid displaying key content on the right-hand region of a page.
What role will the embedded content have? How important is it? Site visitors will be scanning pages to find a mention of what they are interested in, to seek reassurance they are on the right site to find the information they need.
Is your embedded content something you want to direct visitors to engage with? To submit an event registration form, for example, or to watch a video welcoming new starters. Make it easy for your visitor to find.
The rule of thumb is to place the most important content at the top of a page; add more details in the middle; place the least important information at the end.
Keeping text simple will help readers with a lower level of literacy who might otherwise skip whole sections of your site. Cut out the filler and hype, use short words, paragraphs, and pages to increase the clarity of your message and improve comprehension. Web text is generally 50% less than a printed version.
There are various ways to embed content.
Look for an embed code you can copy, sharing option, use Upload from Web, or insert an iFrame.
See example for How to embed using the Upload from Web option
See example for How to embed using Share
See Mosaic documentation for additional explanation about using iFrames WYSIWYG Content Area | Oxford Mosaic
How to embed commonly selected services SDS Figshare and AccessPlanIT
Public Affairs Directorate web accessibility guide
Public Affairs Directorate general accessibility resources
Public Affairs Directorate making effective website guide
Research showcase demo Mosaic site using iFrames
Research Data Oxford FAQ about using third-party survey tools
Using Dataviz maps and charts - Interactive Data Network
Working with third parties | Information Security (ox.ac.uk)
Device Security Guidance - NCSC.GOV.UK
