Remove frameborder attribute from iframes

WordPress doesn’t add the frameborder attribute. YouTube does. It’s part of their embed code.

If you absolutely must remove it you can use the embed_oembed_html filter to modify the returned HTML:

function wpse_308247_remove_frameborder( $html, $url ) {
    // If the URL to be embedded is from YouTube.
    if ( strpos( $url, 'youtube.com' ) !== false ) {
        // Replace the frameborder attribute with an empty string.
        $html = str_replace( 'frameborder="0"', '', $html );
    }

    return $html;
}
add_filter( 'embed_oembed_html', 'wpse_308247_remove_frameborder', 10, 2 );

But here’s the thing: you don’t get anything special for avoiding errors in the validator. What’s important is understanding the errors and what issues they might cause, not trying to remove every single warning or error without context.

With that in mind, the frameborder attribute is likely just added by Google for backwards compatibility with older versions of HTML and it won’t cause any negative effects just by being there. I don’t think it’s worth the effort to remove it.

The allow attribute is a different situation. It seems to be for supporting Chrome specific features. So while it’s invalid HTML, it still has a purpose. It is similar to the frameborder attribute though in that leaving it there won’t cause any problems.