When adding a YouTube video to a rich text field the video embed appears as expected. The entry then fails to save with no error (if I make other changes at the same time they don't save either).

Strangely, this only happens on the live server (my local MAMP setup saves the entry as expected) so I'm thinking it might be a server config thing?

I have unchecked the 'Clean up HTML' and 'Purify HTML' options for the field. It's in a Matrix field if that makes any difference.

Here's my Redactor config (added everything to allowedTags to try to figure it out):

  "buttons": ["html","formatting","bold","italic","unorderedlist","orderedlist","link","image","video"],
  "toolbarFixed": true,
  "pastePlainText": true,
  "allowedTags": ["a", "abbr", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "blockquote", "br", "button", "canvas", "caption", "cite", "code", "col", "colgroup", "dd", "del", "dfn", "div", "dl", "dt", "em", "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "header", "hgroup", "hr", "i", "iframe", "img", "input", "ins", "kbd", "keygen", "label", "legend", "li", "map", "mark", "menu", "nav", "ol", "optgroup", "option", "p", "picture", "pre", "q", "rp", "rt", "ruby", "s", "samp", "section", "select", "small", "source", "span", "strong", "sub", "summary", "sup", "table", "tbody", "td", "textarea", "tfoot", "th", "thead", "time", "title", "tr", "track", "u", "ul", "var", "video", "wbr"],
  "replaceDivs": false,
  "formatting": ["p"],
  "formattingAdd": {
    "heading": {
      "title": "Heading",
      "args": ["h2", "class", "h2", "toggle"]
    "subheading": {
      "title": "Subheading",
      "args": ["h3", "class", "h3", "toggle"]
  • Have you checked the Craft log for any errors? Commented May 31, 2016 at 17:59
  • @LukePearce Yeah – when I submit with the YouTube embed it hits a 403 so I think it's some kind of security/server config issue.
    – samlester
    Commented Jun 1, 2016 at 10:34

1 Answer 1


My guess is you're running into one of two issues.

  1. You're bumping into your php.ini file's max_intput_vars and/or post_max_size limitations.

  2. Your server has something like Suhosin or mod_security installed and the content you're trying to save in the Rich Text field is triggering one of their security rules.

  • The test content I'm trying to submit is just a few words and then the YouTube embed so I don't think it's max_input_vars or post_max_size (these are currently set to 1000 and 24M which seems ok).
    – samlester
    Commented Jun 1, 2016 at 10:45
  • The logs do show a 403 so I'm going to investigate the security stuff further.
    – samlester
    Commented Jun 1, 2016 at 10:47
  • Turns out it was a mod_security issue – thanks for your help!
    – samlester
    Commented Jun 1, 2016 at 12:47
  • mod_security strikes again!
    – Brad Bell
    Commented Jun 2, 2016 at 5:25
  • Is there any way to allow inserting iframe's into rich text fields without disabling HTML purifier? I want Youtubes, but don't want to compromise security. Commented Nov 19, 2016 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.