diff --git a/.env.example b/.env.example
index 7fa6a1b0..10663b51 100644
--- a/.env.example
+++ b/.env.example
@@ -81,7 +81,8 @@ unthrottled_ips=
 MATOMO_SITE_ID=
 
 # Feature flags
-STATE_ACTIONS_ENABLED=true
+STATE_ACTIONS_ENABLED=false
+EMBEDS_ENABLED=false
 
 #
 # End of application environment variables
diff --git a/app/controllers/action_page_controller.rb b/app/controllers/action_page_controller.rb
index d1612a1a..7d61e824 100644
--- a/app/controllers/action_page_controller.rb
+++ b/app/controllers/action_page_controller.rb
@@ -40,10 +40,16 @@ def index
   end
 
   def embed
+    unless Rails.application.config.embeds_enabled?
+      raise ActionController::RoutingError.new("Not found")
+    end
     render "action_page/embed.js.erb", layout: false
   end
 
   def embed_iframe
+    unless Rails.application.config.embeds_enabled?
+      raise ActionController::RoutingError.new("Not found")
+    end
     @css = params[:css] if params.include? :css
     render layout: "application-blank"
   end
diff --git a/config/application.rb b/config/application.rb
index 42965d15..8184eeb6 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -46,5 +46,6 @@ class Application < Rails::Application
     config.google_civic_api_url = Rails.application.secrets.google_civic_api_url
     config.time_zone = Rails.application.secrets.time_zone || "Eastern Time (US & Canada)"
     config.state_actions_enabled = Rails.application.secrets.state_actions_enabled
+    config.embeds_enabled = Rails.application.secrets.embeds_enabled
   end
 end