0

For security reasons (e.g. preventing an editor to create a form that mimics the login form and send the credentials anywhere), we'd like to forbid editors to insert JavaScript or Forms into the pages.

Is there a way to do that?

1

By default, editors and admins in a single site installation have the unfiltered_html capability, which means they can insert any JavaScript and forms. If you want to disallow that, you can remove that capability from the editor role as described in Why is javascript allowed in my post content? or using a plugin like Members.

The only alternative is to assign them another role. See the documentation on which roles have the unfiltered_html capability and which don't.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.