Skip to content

Your users create.
Your data stays safe.

Froala sanitizes every input, filters malicious scripts, and runs inside your own application, so editor content stays on your infrastructure and under your control.

Content sanitized before it renders

Scripts and event handlers stripped on the way in.

Pasted input
<p>Welcome</p> <script>steal(document.cookie)</script> <img src="logo.png" onerror="attack()">
Sanitized in the DOM
Stored in your content
<p>Welcome</p> <img src="logo.png">
Content sanitizationOn by default
Script & style tagsRemoved
URL validationBuilt in
Default
Content sanitization
Client-side
Runs inside your app
Strict CSP
Supported since v5.2
10+
Years in production
4.4★
G2 rating

Secured from the first keystroke

Protection ships inside the editor, filtering content the moment a user types, pastes, or edits the underlying HTML.

Content sanitization

Froala removes <script> and <style> tags and JavaScript event handlers from content before it reaches the DOM.

XSS filtering

Pasted content and Code View input are filtered against defined rules for acceptable tags and attributes.

URL safety

The sanitizeURL helper validates every link and clears unsafe schemes like javascript: before insertion.

Client-side architecture

Froala runs inside your own application, so editor content stays on your infrastructure and under your control.

CSP compliance

Froala v5.2 applies font and style formatting in a CSP-safe way, so the editor runs inside strict Content Security Policy configurations that block unsafe-inline.

Built-in security vs building it yourself

Rolling your own protection turns editor security into a standing engineering line item. Froala includes it.
Security in-house
  • Custom sanitizer to write and maintain
  • XSS vulnerabilities to track and patch
  • URL and link validation to build yourself
  • Content rules to define and keep current
  • CSP-safe formatting to engineer yourself
  • Ongoing engineering cost as threats evolve
Froala · how we do it
  • Content sanitization on every editor instance
  • Script and style tags removed automatically
  • URL validation through the sanitizeURL helper
  • Defined rules for allowed tags and attributes
  • Strict CSP compatibility since v5.2
  • Protection shipped and maintained with the editor
Built-in Filestack integration

Secured from the first keystroke

Protection ships inside the editor, filtering content the moment a user types, pastes, or edits the underlying HTML.

Virus scanning

Filestack scans every uploaded file for malware and filters by MIME type on the server before it reaches storage.

Encrypted storage

Filestack stores uploads with AES-256 encryption and secures data in transit over TLS.

Certified compliance

Filestack holds SOC 2, ISO 27001, GDPR, and HIPAA compliance for the files it stores.
Available in Froala v4.3 and above. Filestack features require an active Filestack account.

Security your team inherits

Content protection is part of the editor on every paid plan. File-level protection is one integration away through built-in Filestack.
  • Content sanitization on every editor instance
  • Script and style tags removed automatically
  • URL and link validation built in
  • Strict CSP compatibility on v5.2 and above
  • Perpetual or annual licensing to match your governance cycle
Read Security Docs
Protection layers
Content sanitizationEDITOR
XSS & URL filteringEDITOR
CSP complianceEDITOR
Virus scanningFILESTACK
Encrypted storageFILESTACK
Certified complianceFILESTACK

Ship faster. Stay protected.

Enterprise-grade protection built into the editor, from prototype to production.