With Full HTML enabled and related filters off, CKEditor will strip any <script> tags from content it is editing. The editors who create content for this particular site need to be able to embed things like this in the content they are creating:

    <img src="http://s2.thingpic.com/images/TD/zKWJQJiFBsp3oP1etNC1.png" width="560" class="alwaysThinglink"/>
<script charset="utf-8" src="//www.thinglink.com/jse/embed.js#286861458501795840"></script>

In theory we can make this work by disabling CKEditor and working directly with HTML, but in practice it doesn't work: the editors are not HTML-savvy. They know enough to temporarily drop out of rich-text mode, paste in the above, and then switch back to rich-text mode. But if they go to edit that content again, CKEditor strips the <script> tags when opening the content.

How can I stop that behavior and have CKEditor leave the <script> tags in place? Is there a hidden setting somewhere for that?

BTW, we are using CKEditor in conjunction with Wysiwyg 7.x-2.1 module.

And yes, in general allowing <script> is very bad, but in this case the only people who have access to the Full HTML format are the editors (who are trusted).



5 Answers 5


You can resolve this by going to the "Advanced Options" section of your CKEditor profile and adding the following string into the text area: config.allowedContent = true;

This resolved the issue for me.

  • 2
    i don't see an advanced option in d8 where would that be?
    – Diana
    Dec 10, 2018 at 15:14

I was running into this too, and it was very frustrating.

For me, the problem was with the Teaser Break plugin that's bundled with the Wysiwyg module. Disabling that button for my Wysiwyg profile solved the problem for me.

You can disable the Teaser Break wysiwyg plugin in Administration › Configuration › Content authoring › Wysiwyg profiles (/admin/config/content/wysiwyg).

I'm very interested to know if this solves your problem also, or if you were running into a different issue. I just filed a new bug for this at http://drupal.org/node/1801166.

  • Thank you! "config.allowedContent = true;" didn't work for me. Feb 21, 2014 at 5:12

I think you are looking for the setting:

  • page admin/config/content/ckeditor/edit/advanced (replace advanced with your profile name).
  • tab Advanced content filter.
  • set to Disabled.

Alternatively you can set it to Enabled and add the script tag in "Extra allowed content", but with scripting allowed, you can as well allow anything.

This setting is from the CKEditor module thus this holds for when you are not using the Wysiwyg module. When using wysiwyg< I guess you have to find out what this setting does, probably setting some options in the CKEditor.

BTW: Why use wysiwyg in between instead of going for the full feature set of CKEditor. I stopped using wysiwyg when CKeditor 4 came out and wysiwyg could not offer support for that for a long time after. As I always and only use CKEditor, what's the point of having wysiwyg in between?


Have you checked the Textformat Settings? So that not "limit HTML Tags" is checked? Anyway i think the Ckeditor Module without WYSIWYG Module is more stable.

  • plz expand details
    – monymirza
    Feb 2, 2013 at 4:47

Old old question, but another way to handle this is to disable the WYSIWYG by default. If the WYSIWYG doesn't engage (turn on/whatever) in edit mode, then the script tag isn't stripped. In my use case this works out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.