I am trying to create add-to-calendar links using shortcode. However when using return following shortcode function outputs a broken link. (echo does not!). Wordpress documentation recommends using return and I am worried if echo, even when it works, is the safe way of doing this.

add_shortcode('calendar-links', 'shortcode_function');

shortcode_function (){
  $link = '<a href="data:text/calendar;charset=utf8;base64,QkVHSU46VkNBTEVOREFSDQpWRVJTSU...">Download</a>';
  return $link;

The output of return is as below:

<a href="https://localhost/text/calendar;charset=utf8;base64,QkVHSU46VkNBTEVOREFSDQpWRVJTSU...">Download</a>

I am assuming the shortcode output is going through some kind of sanitisation, but unable to find a fix for it. Also, if it helps, the shortcode is being outputted using an Elementor shortcode widget.

  • Maybe that's because data is not in the list of allowed protocols. Try adding data to that list per filter. Does that work?
    – fuxia
    Jun 4, 2023 at 1:48
  • Thanks @fuxia that works!
    – gnat
    Jun 4, 2023 at 8:50

1 Answer 1


Thanks to @fuxia, adding data to allowed protocols fixes the problem and I can happily use return.

add_filter( 'kses_allowed_protocols', function ( $protocols ) {
    $protocols[] = 'data';
    return $protocols;
} );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.