When adding a YouTube video to a rich text field the video embed appears as expected. The entry then fails to save with no error (if I make other changes at the same time they don't save either).

Strangely, this only happens on the live server (my local MAMP setup saves the entry as expected) so I'm thinking it might be a server config thing?

I have unchecked the 'Clean up HTML' and 'Purify HTML' options for the field. It's in a Matrix field if that makes any difference.

Here's my Redactor config (added everything to allowedTags to try to figure it out):

  "buttons": ["html","formatting","bold","italic","unorderedlist","orderedlist","link","image","video"],
  "toolbarFixed": true,
  "pastePlainText": true,
  "allowedTags": ["a", "abbr", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "blockquote", "br", "button", "canvas", "caption", "cite", "code", "col", "colgroup", "dd", "del", "dfn", "div", "dl", "dt", "em", "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "header", "hgroup", "hr", "i", "iframe", "img", "input", "ins", "kbd", "keygen", "label", "legend", "li", "map", "mark", "menu", "nav", "ol", "optgroup", "option", "p", "picture", "pre", "q", "rp", "rt", "ruby", "s", "samp", "section", "select", "small", "source", "span", "strong", "sub", "summary", "sup", "table", "tbody", "td", "textarea", "tfoot", "th", "thead", "time", "title", "tr", "track", "u", "ul", "var", "video", "wbr"],
  "replaceDivs": false,
  "formatting": ["p"],
  "formattingAdd": {
    "heading": {
      "title": "Heading",
      "args": ["h2", "class", "h2", "toggle"]
    "subheading": {
      "title": "Subheading",
      "args": ["h3", "class", "h3", "toggle"]
  • Have you checked the Craft log for any errors? – Luke Pearce May 31 '16 at 17:59
  • @LukePearce Yeah – when I submit with the YouTube embed it hits a 403 so I think it's some kind of security/server config issue. – samlester Jun 1 '16 at 10:34

My guess is you're running into one of two issues.

  1. You're bumping into your php.ini file's max_intput_vars and/or post_max_size limitations.

  2. Your server has something like Suhosin or mod_security installed and the content you're trying to save in the Rich Text field is triggering one of their security rules.

|improve this answer|||||
  • The test content I'm trying to submit is just a few words and then the YouTube embed so I don't think it's max_input_vars or post_max_size (these are currently set to 1000 and 24M which seems ok). – samlester Jun 1 '16 at 10:45
  • The logs do show a 403 so I'm going to investigate the security stuff further. – samlester Jun 1 '16 at 10:47
  • Turns out it was a mod_security issue – thanks for your help! – samlester Jun 1 '16 at 12:47
  • mod_security strikes again! – Brad Bell Jun 2 '16 at 5:25
  • Is there any way to allow inserting iframe's into rich text fields without disabling HTML purifier? I want Youtubes, but don't want to compromise security. – certainlyakey Nov 19 '16 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.