Security Changes to HTML Widgets in Engagement Pages
The HTML widget on an Engagement Page accepts free-form markup, but that markup is checked for unsafe content before it is stored. Scripts, inline event handlers and unsafe frames are removed, and any CSS you include is confined to the widget. This article lists exactly what is removed, what is still allowed, and the supported way to run custom code on an Engagement Page.
These rules were introduced in v2026.3.0. Engagement Pages created before that release keep their original content until the page is next saved - see When the Check Runs below.
They apply only to the HTML widget. Every other widget type builds its own markup and is unaffected.
What Is Removed From HTML Widget Content
| Category | Removed |
|---|
| Elements | script, iframe (unless the source is allowed - see below), frameset, input |
| Inline event handlers | onblur, onchange, onclick, ondblclick, ondrag, ondragend, ondrop, onerror, onfocus, onkeydown, onkeypress, onkeyup, onmousemove, onmouseout, onmouseover, onmouseup, onmousewheel, onscroll |
| Link targets | Any attribute whose value contains javascript:, including links written to disguise it with extra spacing |
Everything else is preserved. Headings, paragraphs, lists, tables, images, links, formatting and inline styles all work as before.
Which Embedded Frames Are Still Allowed
An iframe is kept when its source is your own portal or a recognized video provider:
- YouTube
- Vimeo
- Wistia
- Vidyard
- Brightcove
- JW Player
- Dailymotion
- Metacafe
- Ooyala
- vzaar
- Loom (embed links)
- Synthesia (embed links)
- magentrix.com
- Your own portal address
An iframe pointing anywhere else is removed. If you need to embed a video, the Video widget is the supported option and does not depend on this list.
CSS in an HTML Widget Stays Inside That Widget
A style block inside an HTML widget no longer affects the rest of the page. When the widget renders, every selector you wrote is rewritten so that it applies only within that widget's own container, including selectors inside @media and @supports blocks.
In practice this means a rule such as p { color: red; } colors the paragraphs in your widget and nothing else on the page. Rules that were written to restyle the portal header, navigation or other widgets no longer reach them.
When the Check Runs
The content is checked when you save the Engagement Page, not when a user views it. This has two consequences worth planning around:
Older content is unchanged until the page is next saved. An Engagement Page authored before this behavior was introduced keeps whatever markup it had. The removal happens the first time somebody opens that page and saves it, even if they only changed an unrelated widget.
Removal is silent and is not reversible from the editor. You are not warned that something was taken out, and reopening the page shows the cleaned content. Keep a copy of any complex HTML outside the portal before you edit a page that contains it.
How to Run Custom Code on an Engagement Page
Use the Active Page widget. It embeds an Active Page you have built, which can contain your own JavaScript and CSS, and it is the supported route for anything the HTML widget will not keep.
- Build the Active Page with the markup, script and styling you need.
- Edit the Engagement Page and add an Active Page widget.
- Select your Active Page in the widget settings and save.
Creating Active Pages is restricted to administrators, which is what makes this the safe place for custom code. See ActivePages Properties and Features in the Developer Guide.
If Content Has Gone Missing
| Symptom | Cause and resolution |
|---|
| A script that used to run on the page no longer does. | The script was removed when the page was saved. Move the code into an Active Page and add it with the Active Page widget. |
| An embedded frame disappeared after an edit. | Its source is not on the allowed list. Host the content on an allowed provider, use the Video widget, or embed it through an Active Page. |
| Custom styling no longer affects the rest of the portal. | Expected. Widget CSS is confined to its own widget. Portal-wide styling belongs in the Theme Builder. |
| A button or form field vanished from an HTML widget. | input elements are removed. Build the form as an Active Page, or use a module that provides the form natively. |
| A link stopped working. | The link used a javascript: target, which is removed. Point the link at a URL, or move the behavior into an Active Page. |
Where to Go Next
<< Configuring Engagement Pages | Engagement Pages Troubleshooting >>