WordPress Security
Overview
During the import operation, an admin has to choose how to handle HTML filtering. Here are additional details.
Unfiltered HTML
What is the unfiltered_html Permission in WordPress?
The unfiltered_html permission is a security feature in WordPress that prevents users from using potentially dangerous tags such as iframes and embed, and also more advanced code such as JavaScript.
This unfiltered_html permission could be very dangerous in the wrong hands. Do not give this permission to any user you do not trust. WordPress has disabled this permission for most users because they rarely need it.
If you just want those users to be able to insert content like YouTube video iframes, use WP’s built-in embed shortcode to embed that content instead.
Reference: Add unfiltered_html Capability to Admins or Editors in WordPress Multisite
Learn more about how to enable the unfiltered_html if you decide to do so: What is the unfiltered_html permission in WordPress?
Note that DISALLOW_UNFILTERED_HTML is a WordPress configuration constant that can be defined in the wp-config.php file to restrict the ability of users with the unfiltered_html capability to post unfiltered HTML code. By defining this constant and setting it to true, WordPress will restrict the use of the unfiltered_html capability and enforce the use of the wp_kses function to filter HTML code. When this constant is defined and set to true, users with the unfiltered_html capability will be forced to use the wp_kses function to filter their HTML code before posting it.
WordPress HTML Filter​
What is the force_filtered_html_on_import filter in the WordPress?
This filter determines whether to filter imported data. Multisite uses this hook to filter all data by default, as a super administrator may be assisting an untrusted user. Other plugins or custom code can set this filter as well.
What are WordPress Allowed Mime Types?
WordPress restricts the file types and MIME types that can be used. This is also checked during import when retrieving files from the source site. Learn more.
