SECURITY
Maintained DivisionDesk documentation · Updated 2026-08-18
# Publishing content security
Publishing sanitizes content on the server even when the browser editor has already filtered it.
Allowed: normal document HTML, links, images, tables, classes/IDs, safe inline style declarations, and scoped custom CSS.
Rejected or removed: JavaScript, `<script>`, event attributes such as `onclick`, `javascript:`/`vbscript:` URLs, PHP tags, server-side includes, forms/inputs, iframes, object/embed content, CSS `@import`, CSS expressions/bindings and CSS external-resource `url()` loads.
Custom stylesheet selectors are scoped beneath `.dd-publication` so article styling cannot intentionally restyle DivisionDesk navigation, messenger UI, footer or unrelated page components.
Publishing sanitizes content on the server even when the browser editor has already filtered it.
Allowed: normal document HTML, links, images, tables, classes/IDs, safe inline style declarations, and scoped custom CSS.
Rejected or removed: JavaScript, `<script>`, event attributes such as `onclick`, `javascript:`/`vbscript:` URLs, PHP tags, server-side includes, forms/inputs, iframes, object/embed content, CSS `@import`, CSS expressions/bindings and CSS external-resource `url()` loads.
Custom stylesheet selectors are scoped beneath `.dd-publication` so article styling cannot intentionally restyle DivisionDesk navigation, messenger UI, footer or unrelated page components.
Still need help? Search the Community for real-world discussion, or submit a Feature Request if the product itself needs to change.