# HTML Filtering
> Compare HTML filtering policies in @humanspeak/svelte-markdown, rendering the same markdown with unrestricted, safe-only, and blocked tag rules.
**Source:** [https://markdown.svelte.page/examples/html-filtering](https://markdown.svelte.page/examples/html-filtering)
**Markdown mirror:** [https://markdown.svelte.page/examples/html-filtering.md](https://markdown.svelte.page/examples/html-filtering.md)
---
This mirror preserves the prose, implementation notes, and runnable Svelte source behind the live example page.
## FIG-001: allow all html.
Every HTML tag survives into the DOM. Iframes load, forms render, styles apply — only safe with content you fully trust.
**Metadata:** tag: `UNRESTRICTED` | policy: `allow-all-html`
### Notes
- Default behaviour — every HTML tag is rendered through its built-in renderer including `iframe`, `form`, and `style`.
- Only safe for content you fully trust. Untrusted markdown can inject phishing forms, redirect users, or load tracking pixels.
### Source
#### AllowAllHtml.svelte
Source file: [src/lib/examples/html-filtering/demos/AllowAllHtml.svelte](https://github.com/humanspeak/svelte-markdown/blob/main/docs/src/lib/examples/html-filtering/demos/AllowAllHtml.svelte)
```svelte
POLICY / UNRESTRICTED
trusted content only
```
## FIG-002: allow only safe tags.
Allow-list a tight set of formatting tags via allowHtmlOnly. Script, iframe, and anything else dangerous drops silently.
**Metadata:** tag: `SAFE-ONLY` | policy: `allow-only-safe`
### Notes
- Pass a tag allow-list to `allowHtmlOnly` — only those tags render, everything else drops out silently.
- The right default for user-generated content. Keeps formatting like ` `, ` `, and ` ` while killing script + iframe vectors.
### Source
#### AllowOnlySafe.svelte
Source file: [src/lib/examples/html-filtering/demos/AllowOnlySafe.svelte](https://github.com/humanspeak/svelte-markdown/blob/main/docs/src/lib/examples/html-filtering/demos/AllowOnlySafe.svelte)
```svelte
POLICY / SAFE ONLY
allowHtmlOnly
```
## FIG-003: block all html.
Strip every HTML tag via buildUnsupportedHTML — markdown formatting only, raw HTML stripped from the output.
**Metadata:** tag: `BLOCKED` | policy: `block-all-html`
### Notes
- `buildUnsupportedHTML()` returns a renderer map that drops every HTML tag — only markdown formatting survives.
- Best when the source is a markdown editor with no need for raw HTML. Smallest attack surface, predictable output.
### Source
#### BlockAllHtml.svelte
Source file: [src/lib/examples/html-filtering/demos/BlockAllHtml.svelte](https://github.com/humanspeak/svelte-markdown/blob/main/docs/src/lib/examples/html-filtering/demos/BlockAllHtml.svelte)
```svelte
POLICY / HTML BLOCKED
buildUnsupportedHTML
```