What HTML tags are allowed on Stack Exchange sites?

Question

The Stack Overflow site engine, as you know, uses Markdown for questions and answers. Per the Markdown specification, you are allowed to freely intermix HTML and Markdown tags.

Not all HTML tags are allowed, as that would be an XSS paradise. Which HTML tags have been whitelisted and are allowed to be used on Stack Exchange sites?

Return to FAQ index

Answer 1

Allowed HTML Tags

The Stack Exchange engine allows only the following safe, whitelisted subset of HTML tags:

<a>              - hyperlink.
<b>              - bold, use as last resort <h1>-<h3>, <em>, and <strong> are 
                   preferred.
<blockquote>     - specifies a section that is quoted from another source.
<code>           - defines a piece of computer code.
<del>            - delete, used to indicate modifications.
<dd>             - describes the item in a <dl> description list.
<dl>             - description list.
<dt>             - title of an item in a <dl> description list.
<em>             - emphasized.
<h1>, <h2>, <h3> - headings.
<i>              - italic.
<img>            - specifies an image tag.
<kbd>            - represents user input (usually keyboard input).
<li>             - list item in an ordered list <ol> or an unordered list <ul>.
<ol>             - ordered list.
<p>              - paragraph.
<pre>            - pre-element displayed in a fixed width font and and 
                   unchanged line breaks.
<s>              - strikethrough.
<sup>            - superscript text appears 1/2 character above the baseline 
                   used for footnotes and other formatting.
<sub>            - subscript appears 1/2 character below the baseline.
<strong>         - defines important text.
<strike>         - strikethrough is deprecated, use <del> instead.
<ul>             - unordered list.
<br>             - line break.
<hr>             - defines a thematic change in the content, usually via a 
                   horizontal line.

Note that since we allow the above HTML tags, to have tags show up as text you need to escape the < character. You can escape '<' by marking it as code (with indentation or backticks as is done below) or by using the HTML entity <

Allowed Attributes

img Attributes

The following attributes are allowed on the <img> tag, but note that the mobile theme enforces a maximum width of 90%, so specifying a height might not scale the image proportionally on the mobile sites.

The attribute order is important! Using a different order (e.g., height before width) will strip the tag!

src=""
width="" (up to 999; do not include the 'px' extension)
height="" (up to 999; do not include the 'px' extension; see note above)
alt=""
title=""

a Attributes

The following attributes are allowed on the <a> tag:

href=""
title=""

href attributes can only hold proper URL links, such as https://stackexchange.com/users/, or relative or protocol-relative URL links such as /q/3122. They cannot hold other types of links, such as relative fragments (e.g. #3122), or protocols other than HTTP or HTTPS (e.g. javascript, ftp, or mailto): having any of these types of links in the href will result in the link being stripped out.

Important Notes

• HTML tags unlisted above are stripped from the output. They may render in the client preview, but they will always be removed on the server.
  
  
• You must enter the tags exactly as shown. Any deviation from this list other than capitalization—adding extra spaces, using single quote or no quotes, etc.—means the tag will be stripped.
  
  
• We do not (and will not) allow <table> tags. Sorry. This is intentional and by design. If you need a quick and dirty "table", use <pre> and ASCII layout.