---
title: How to Allow Unfiltered HTML to Editors on WordPress Multisite
date: 2024-11-29T08:20:45+00:00
modified: 2024-11-29T08:52:27+00:00
image:: https://kaspars.net/wp-content/uploads/2024/11/unfiltered-html-cap-wp.png
permalink: https://kaspars.net/blog/allow-unfiltered-html-multisite
post_type: post
author:
  name: Kaspars
  avatar: https://reverse.kaspars.net/gravatar/avatar/92bfcd3a8c3a21a033a6484d32c25a40b113ec6891f674336081513d5c98ef76?s=96&d=mm&r=g
post_tag:
  - PHP
  - Snippet
category:
  - WordPress
---

# How to Allow Unfiltered HTML to Editors on WordPress Multisite

WordPress multisite [prevents everybody but super-admins](https://github.com/WordPress/WordPress/blob/dd967e2a2ea96e3a93b05a887477a0d487aa7d79/wp-includes/capabilities.php#L592-L601) from adding HTML blocks with `<script>` and `<iframe>` tags — also known as `unfiltered_html` capability which adds [the following restrictions](https://github.com/WordPress/WordPress/blob/dd967e2a2ea96e3a93b05a887477a0d487aa7d79/wp-includes/kses.php#L2264-L2294) ([enabled here](https://github.com/WordPress/WordPress/blob/dd967e2a2ea96e3a93b05a887477a0d487aa7d79/wp-includes/kses.php#L2338-L2340)). This is done for security reasons on sites where anyone could register and post content that could do nasty things with shared cookies (on subdomain and sub-directory setups).

However, most multisite setups are actually private where you trust the content creators. On non-multisite setups this capability is enabled for *all users*. Here is a filter to [disable this limitation](https://github.com/WordPress/WordPress/blob/dd967e2a2ea96e3a93b05a887477a0d487aa7d79/wp-includes/capabilities.php#L592-L601) for all users with the `editor` capability, for example:

```
add_filter( 
	'map_meta_cap', 
	function ( $caps, $cap, $user_id ) {
		if ( 'unfiltered_html' === $cap && user_can( $user_id, 'editor' ) ) {
			return [ 'unfiltered_html' ];
		}

		return $caps;
	}, 
	10, 
	3 
);
```

It works by “enabling” the requested capability `$cap` by including it in the requested capabilities `$caps` for the requested action. You can change `editor` to [any other capability](https://wordpress.org/documentation/article/roles-and-capabilities/#capabilities). Consider if you should still honour the `DISALLOW_UNFILTERED_HTML` constant which should prevent all unfiltered HTML.

Note that any content edits by users without this capability will simply remove the restricted HTML so you should ensure that everyone who can edit the respective content has the necessary capability.