<p>My guess is you're running into one of two issues.</p>

<ol>
<li><p>You're bumping into your php.ini file's <a href="https://secure.php.net/manual/en/info.configuration.php#ini.max-input-vars" rel="noreferrer">max_intput_vars</a> and/or <a href="https://secure.php.net/manual/en/ini.core.php#ini.post-max-size" rel="noreferrer">post_max_size</a> limitations.</p></li>
<li><p>Your server has something like <a href="https://suhosin.org/stories/index.html" rel="noreferrer">Suhosin</a> or <a href="https://www.modsecurity.org/" rel="noreferrer">mod_security</a> installed and the content you're trying to save in the Rich Text field is triggering one of their security rules.</p></li>
</ol>

CC BY-SA 3.0
2016-06-01T10:45:46.903Z
The test content I'm trying to submit is just a few words and then the YouTube embed so I don't think it's max_input_vars or post_max_size (these are currently set to 1000 and 24M which seems ok).
samlester
CC BY-SA 3.0
2016-06-01T10:47:12.863Z
The logs do show a 403 so I'm going to investigate the security stuff further.
samlester
CC BY-SA 3.0
2016-06-01T12:47:36.910Z
Turns out it was a mod_security issue – thanks for your help!
samlester
CC BY-SA 3.0
2016-06-02T05:25:00.760Z
mod_security strikes again!
Brad Bell
CC BY-SA 3.0
2016-11-19T17:29:17.480Z
Is there any way to allow inserting iframe's into rich text fields without disabling HTML purifier? I want Youtubes, but don't want to compromise security.
certainlyakey
CC BY-SA 3.0
2016-05-31T18:55:41.547Z
2016-05-31T18:55:41.547Z
Brad Bell
<p>When adding a YouTube video to a rich text field the video embed appears as expected. The entry then fails to save with no error (if I make other changes at the same time they don't save either).</p>

<p>Strangely, this only happens on the live server (my local MAMP setup saves the entry as expected) so I'm thinking it might be a server config thing?</p>

<p>I have unchecked the 'Clean up HTML' and 'Purify HTML' options for the field. It's in a Matrix field if that makes any difference.</p>

<p>Here's my Redactor config (added everything to <code>allowedTags</code> to try to figure it out):</p>

<pre><code>{
  "buttons": ["html","formatting","bold","italic","unorderedlist","orderedlist","link","image","video"],
  "plugins":["fullscreen","video"],
  "toolbarFixed": true,
  "pastePlainText": true,
  "allowedTags": ["a", "abbr", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "blockquote", "br", "button", "canvas", "caption", "cite", "code", "col", "colgroup", "dd", "del", "dfn", "div", "dl", "dt", "em", "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "header", "hgroup", "hr", "i", "iframe", "img", "input", "ins", "kbd", "keygen", "label", "legend", "li", "map", "mark", "menu", "nav", "ol", "optgroup", "option", "p", "picture", "pre", "q", "rp", "rt", "ruby", "s", "samp", "section", "select", "small", "source", "span", "strong", "sub", "summary", "sup", "table", "tbody", "td", "textarea", "tfoot", "th", "thead", "time", "title", "tr", "track", "u", "ul", "var", "video", "wbr"],
  "replaceDivs": false,
  "formatting": ["p"],
  "formattingAdd": {
    "heading": {
      "title": "Heading",
      "args": ["h2", "class", "h2", "toggle"]
    },
    "subheading": {
      "title": "Subheading",
      "args": ["h3", "class", "h3", "toggle"]
    }
  }
}
</code></pre>

CC BY-SA 3.0
2016-05-31T17:59:19.773Z
Have you checked the Craft log for any errors?
Luke Pearce
CC BY-SA 3.0
2016-06-01T10:34:56.003Z
@LukePearce Yeah – when I submit with the YouTube embed it hits a 403 so I think it's some kind of security/server config issue.
samlester
<control-panel><redactor><richtext><saving>
YouTube video embeds in rich text field not saving
# YouTube video embeds in rich text field not saving

(Asked by: username_0 on 2016-05-31)

When adding a YouTube video to a rich text field the video embed appears as expected. The entry then fails to save with no error (if I make other changes at the same time they don't save either).
Strangely, this only happens on the live server (my local MAMP setup saves the entry as expected) so I'm thinking it might be a server config thing?
I have unchecked the 'Clean up HTML' and 'Purify HTML' options for the field. It's in a Matrix field if that makes any difference.
Here's my Redactor config (added everything to allowedTags to try to figure it out):
{
  "buttons": ["html","formatting","bold","italic","unorderedlist","orderedlist","link","image","video"],
  "plugins":["fullscreen","video"],
  "toolbarFixed": true,
  "pastePlainText": true,
  "allowedTags": ["a", "abbr", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "blockquote", "br", "button", "canvas", "caption", "cite", "code", "col", "colgroup", "dd", "del", "dfn", "div", "dl", "dt", "em", "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "header", "hgroup", "hr", "i", "iframe", "img", "input", "ins", "kbd", "keygen", "label", "legend", "li", "map", "mark", "menu", "nav", "ol", "optgroup", "option", "p", "picture", "pre", "q", "rp", "rt", "ruby", "s", "samp", "section", "select", "small", "source", "span", "strong", "sub", "summary", "sup", "table", "tbody", "td", "textarea", "tfoot", "th", "thead", "time", "title", "tr", "track", "u", "ul", "var", "video", "wbr"],
  "replaceDivs": false,
  "formatting": ["p"],
  "formattingAdd": {
    "heading": {
      "title": "Heading",
      "args": ["h2", "class", "h2", "toggle"]
    },
    "subheading": {
      "title": "Subheading",
      "args": ["h3", "class", "h3", "toggle"]
    }
  }
}

**Tags:** control-panel, redactor, richtext, saving

> **Comments:**
> **username_1**: Have you checked the Craft log for any errors?  
> **username_0**: @LukePearce Yeah – when I submit with the YouTube embed it hits a 403 so I think it's some kind of security/server config issue.  

---

## 1 answers

### Answer by username_2 on 2016-05-31. Score: 4 | Accepted answer

My guess is you're running into one of two issues.

1. You're bumping into your php.ini file's [max\_intput\_vars](https://secure.php.net/manual/en/info.configuration.php#ini.max-input-vars) and/or [post\_max\_size](https://secure.php.net/manual/en/ini.core.php#ini.post-max-size) limitations.
2. Your server has something like [Suhosin](https://suhosin.org/stories/index.html) or [mod\_security](https://www.modsecurity.org/) installed and the content you're trying to save in the Rich Text field is triggering one of their security rules.

> **Comments:**
> **username_0**: The test content I'm trying to submit is just a few words and then the YouTube embed so I don't think it's max_input_vars or post_max_size (these are currently set to 1000 and 24M which seems ok).  
> **username_0**: The logs do show a 403 so I'm going to investigate the security stuff further.  
> **username_0**: Turns out it was a mod_security issue – thanks for your help!  
> **username_2**: mod_security strikes again!  
> **username_3**: Is there any way to allow inserting iframe's into rich text fields without disabling HTML purifier? I want Youtubes, but don't want to compromise security.  

---

