<p>Following from Brad's answer (I'm not able to comment) I had to escape the backslashes to avoid JSON decode error.</p>

<p>Version for Youtube and Vimeo</p>

<pre><code>{
    "HTML.SafeIframe": true,
    "URI.SafeIframeRegexp": "%^(https?:)?//(www\\.youtube(?:-nocookie)?\\.com/embed/|player\\.vimeo\\.com/video/)%",
    "Attr.AllowedFrameTargets": ["_blank"],
    "HTML.AllowedComments": ["pagebreak"]
}
</code></pre>

<p>Or just YouTube</p>

<pre><code>{
    "HTML.SafeIframe": true,
    "URI.SafeIframeRegexp": "%^(https?:)?//(www\\.youtube(?:-nocookie)?\\.com/embed/)%",
    "Attr.AllowedFrameTargets": ["_blank"],
    "HTML.AllowedComments": ["pagebreak"]
}
</code></pre>

CC BY-SA 4.0
2019-12-11T09:01:39.953Z
What should be the name of the config file? No one ever mentions that, are all files in config/htmlpurifier/*.json loaded automatically? I've tried adding one named the same as my redactor config file, but it doesn't seem to work.
Nicolas Connault
CC BY-SA 4.0
2020-02-04T18:51:43.460Z
Any filename will do, then you can choose your config in the "Advanced" tab in your Craft field settings under "HTML Purifier Config".
weotch
CC BY-SA 4.0
2018-07-20T14:54:54.760Z
2018-07-20T14:54:54.760Z
sanscheese
<p>Something like this in a <code>.json</code> file should work:</p>
<pre><code>{
  &quot;HTML.SafeIframe&quot;: true,
  &quot;URI.SafeIframeRegexp&quot;: &quot;%^(https?:)?//(www\\.youtube(?:-nocookie)?\\.com/embed/)%&quot;,
  &quot;Attr.AllowedFrameTargets&quot;: [&quot;_blank&quot;],
  &quot;HTML.AllowedComments&quot;: [&quot;pagebreak&quot;]
}
</code></pre>
<p>Note that the first two lines were adapted from <a href="https://stackoverflow.com/a/12784081/684">https://stackoverflow.com/a/12784081/684</a> and the last two are the default options that Craft uses if no custom config is set.</p>
<p>Probably also worth giving this a read: <a href="http://htmlpurifier.org/docs/enduser-youtube.html" rel="nofollow noreferrer">http://htmlpurifier.org/docs/enduser-youtube.html</a></p>

CC BY-SA 3.0
2017-05-02T10:25:15.437Z
Just note that the HtmlPurifier link is pretty out of date since it talks about YouTube videos as being a Flash embed. I think they've been using iframes for a few years now which have a better security model.
Simon East
CC BY-SA 3.0
2017-08-03T23:48:26.887Z
Sorry for the delay in replying Brad! Just a quick comment to say that this did the trick for me, thanks.
Stephen
CC BY-SA 4.0
2018-12-30T16:46:35.830Z
What should the json file be named though? Cant find any info on that
Laurence Cope
CC BY-SA 4.0
2020-02-04T18:51:38.513Z
Any filename will do, then you can choose your config in the "Advanced" tab in your Craft field settings under "HTML Purifier Config".
weotch
CC BY-SA 4.0
2017-04-22T04:43:53.863Z
2020-06-26T13:03:35.000Z
2020-06-26T13:03:35.000Z
Brad Bell
<p>I noticed the following new feature in Craft CMS <a href="https://craftcms.com/changelog#2-6-2973" rel="noreferrer">2.6.2973</a>: <em>Added the “HTML Purifier Config” setting to Rich Text fields</em>.</p>

<p>I can't see any mention or any example of config files in the Craft CMS <a href="https://craftcms.com/docs/rich-text-fields" rel="noreferrer">docs for Rich Text fields</a> though, and the only thing I can see in the Rich Text Field settings in the control panel is this:</p>

<blockquote>
  <p>You can save custom HTML Purifier configs as .json files in craft/config/htmlpurifier/. <a href="http://htmlpurifier.org/live/configdoc/plain.html" rel="noreferrer">View available settings</a></p>
</blockquote>

<p>Can someone help me with a custom HTML Purifier config .json file that I can use with Craft that would allow me to start using YouTube video embed code like this in Rich Text fields?</p>

<pre><code>&lt;iframe width="560" height="315" src="https://www.youtube.com/embed/HdYfAmrzVlc" frameborder="0" allowfullscreen=""&gt;&lt;/iframe&gt;
</code></pre>

<p>At the moment, the above code will disappear when saving an entry unless I disable the <em>Purify HTML?</em> option in the Rich Text field settings. Thanks in advance for any help with this.</p>

<config><json>
HTML Purifier Config File
# HTML Purifier Config File

(Asked by: username_0 on 2017-04-21)

I noticed the following new feature in Craft CMS 2.6.2973: Added the “HTML Purifier Config” setting to Rich Text fields.
I can't see any mention or any example of config files in the Craft CMS docs for Rich Text fields though, and the only thing I can see in the Rich Text Field settings in the control panel is this:

You can save custom HTML Purifier configs as .json files in craft/config/htmlpurifier/. View available settings

Can someone help me with a custom HTML Purifier config .json file that I can use with Craft that would allow me to start using YouTube video embed code like this in Rich Text fields?


At the moment, the above code will disappear when saving an entry unless I disable the Purify HTML? option in the Rich Text field settings. Thanks in advance for any help with this.

**Tags:** config, json

---

## 2 answers

### Answer by username_4 on 2017-04-22. Score: 9 | Accepted answer

Something like this in a .json file should work:
{
  "HTML.SafeIframe": true,
  "URI.SafeIframeRegexp": "%^(https?:)?//(www\\.youtube(?:-nocookie)?\\.com/embed/)%",
  "Attr.AllowedFrameTargets": ["_blank"],
  "HTML.AllowedComments": ["pagebreak"]
}

Note that the first two lines were adapted from https://stackoverflow.com/a/12784081/684 and the last two are the default options that Craft uses if no custom config is set.
Probably also worth giving this a read: http://htmlpurifier.org/docs/enduser-youtube.html

> **Comments:**
> **username_5**: Just note that the HtmlPurifier link is pretty out of date since it talks about YouTube videos as being a Flash embed. I think they've been using iframes for a few years now which have a better security model.  
> **username_0**: Sorry for the delay in replying Brad! Just a quick comment to say that this did the trick for me, thanks.  
> **username_6**: What should the json file be named though? Cant find any info on that  
> **username_3**: Any filename will do, then you can choose your config in the "Advanced" tab in your Craft field settings under "HTML Purifier Config".  

---

### Answer by username_1 on 2018-07-20. Score: 3

Following from Brad's answer (I'm not able to comment) I had to escape the backslashes to avoid JSON decode error.
Version for Youtube and Vimeo
{
    "HTML.SafeIframe": true,
    "URI.SafeIframeRegexp": "%^(https?:)?//(www\\.youtube(?:-nocookie)?\\.com/embed/|player\\.vimeo\\.com/video/)%",
    "Attr.AllowedFrameTargets": ["_blank"],
    "HTML.AllowedComments": ["pagebreak"]
}

Or just YouTube
{
    "HTML.SafeIframe": true,
    "URI.SafeIframeRegexp": "%^(https?:)?//(www\\.youtube(?:-nocookie)?\\.com/embed/)%",
    "Attr.AllowedFrameTargets": ["_blank"],
    "HTML.AllowedComments": ["pagebreak"]
}

> **Comments:**
> **username_2**: What should be the name of the config file? No one ever mentions that, are all files in config/htmlpurifier/*.json loaded automatically? I've tried adding one named the same as my redactor config file, but it doesn't seem to work.  
> **username_3**: Any filename will do, then you can choose your config in the "Advanced" tab in your Craft field settings under "HTML Purifier Config".  

---

