My client won't allow me access to the CSS editor to change the fonts for the sites I've created and this is down to a potential security risk across their multisite setup. I'm suggesting I have access and create child themes to then change the font CSS, would that be the best way to go about it? It's frustrating not being able to edit the CSS or install plugins myself.

Thanks, Laura

  • Can you elaborate more? what rol your user has? – David Lee Sep 8 '17 at 13:14

As you can see here, CSS is a security risk. In a multisite the style tag is even stripped from posts and pages unless the super administrator is editing the post/page.

Suggesting that they allow you to create child themes is not good. They will have to give you access to the PHP files, which is even worse.

The best would be for them to install a custom CSS plugin that is limited to only safe rules (if such a plugin exists).

At the moment you can use the style attribute inside your posts and pages to change the font of all the text in the content.

  • there is no such thing as "safe css rules", and using a plugin to to add css rules that you could add to the stylesheet itself is a ridiculous idea. – Mark Kaplun Sep 8 '17 at 15:51
  • @MarkKaplun It is safe to change the font family or size or color for example. The site will not be hacked like this. Site administrators in a multisite cannot edit the style.css file. – Nikolay Sep 8 '17 at 16:31
  • I have no idea how safe font files are, but even if they are I have never heard of any css plugin that lets you insert only font rules. As for why he can not change the style sheet, that is between her and the client, but adding a component with weak security should not be a valid solution.... and as she said she can not install plugins. – Mark Kaplun Sep 8 '17 at 17:43
  • @MarkKaplun She will not upload font files, just change the font with CSS using the default fonts. Anyway... – Nikolay Sep 8 '17 at 17:56
  • uploading have nothing to do with why css is insecure. for example you can link to external SVG in a background rule, and the SVG might include JS. – Mark Kaplun Sep 8 '17 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.