What HTML tags are allowed on Stack Exchange sites?

Question

The Stack Overflow site engine, as you know, uses Markdown for questions and answers. Per the Markdown specification, you are allowed to freely intermix HTML and Markdown tags.

Not all HTML tags are allowed, as that would be an XSS paradise. Which HTML tags have been whitelisted and are allowed to be used on Stack Exchange sites?

Return to FAQ index

Answer 1

Allowed HTML Tags

The Stack Exchange engine allows only the following safe, whitelisted subset of HTML tags:

Tag	Description
<a>	Hyperlink.
<b>	Bold, use as last resort. <h1>–<h3>, <em>, and <strong> are preferred.
<blockquote>	Specifies a section that is quoted from another source.
<code>	Defines a piece of computer code.
<del>	Delete, used to indicate modifications.
<dd>	Describes the item in a <dl> description list.
<dl>	Description list.
<dt>	Title of an item in a <dl> description list.
<em>	Emphasized text.
<h1> <h2> <h3>	Headings.
<i>	Italic.
<img>	Specifies an image tag.
<kbd>	Represents user input (usually keyboard input).
<li>	List item in an ordered list <ol> or an unordered list <ul>.
<ol>	Ordered list.
<p>	Paragraph.
<pre>	Pre-element displayed in a fixed width font and and unchanged line breaks.
<s>	Strikethrough.
<sup>	Superscript text appears 1/2 character above the baseline. Used for footnotes and other formatting.
<sub>	Subscript appears 1/2 character below the baseline.
<strong>	Defines important text.
<strike>	Strikethrough is deprecated, use <del> instead.
<ul>	Unordered list.
<br>	Line break.
<hr>	Defines a thematic change in the content, usually via a horizontal line.
<!-- [...] -->	Defines a comment, or text that will not be rendered in the post.

Note that since we allow the above HTML tags, to have tags show up as text you need to escape the < character. You can escape '<' by marking it as code (with indentation or backticks as is done below) or by using the HTML entity <.

Any tags not in the above list will be stripped out of the post. Do note that the sanitizer that strips out tags will recognize any text between < and > signs as HTML, and so any such text will be stripped out of the post; to prevent this, encode those signs as < and >. This does also mean that HTML comments cannot contain the > sign.

Allowed attributes

Attributes are only allowed on <img> and <a>. Other tags with attributes will be stripped.

Allowed attributes for img

The following attributes are allowed on the <img> tag, in the order shown below. Note that the mobile theme enforces a maximum width of 90%, so specifying a height might not scale the image proportionally on the mobile sites.

The attribute order is important! Using a different order (e.g., height before width) will strip the tag!

• src=""
• width="" (up to 999; do not include the px extension)
• height="" (up to 999; do not include the px extension; see note above)
• alt=""
• title=""

<a> Attributes

The following attributes are allowed on the <a> tag:

• href=""
• title=""

href attributes can only hold proper URL links, such as https://stackexchange.com/users/, or relative or protocol-relative URL links such as /q/3122 or //stackexchange.com/users/. They cannot hold other types of links, such as relative fragments (e.g. #3122), or protocols other than HTTP or HTTPS (e.g. javascript, ftp, or mailto). Having any of these types of links in the href will result in the link being stripped out.

Important Notes

• HTML tags unlisted above are stripped from the output. They may render in the client preview, but they will always be removed on the server.
• You must enter the tags exactly as shown. Any deviation from this list other than capitalization: adding extra spaces, using apostrophes ' instead of quotation marks " or no quotes at all, means the tag will be stripped.
• While it is possible to make tables using Markdown syntax, we do not support the HTML <table> element.