Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →wp_kses() removes markup that is not permitted by the allow-list or context you pass to it. To find out why a tag disappeared, check the actual call, then check whether its lowercase tag name, required attributes, and any needed attribute values are allowed. The function returns filtered HTML; it does not explain which rule removed a particular part.
Start with the call that filters the HTML
Compare the exact string immediately before and after wp_kses(), and locate the call site that produced the change. Its second argument determines the rules: it may be an explicit array or a named context. The function expects unslashed input.
As an Amazon Associate I earn from qualifying purchases.
For example, wp_kses($html, 'post') uses the post context, while wp_kses($html, $allowed_html) applies the rules in the array. WordPress documents both forms in the wp_kses() reference.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check whether the element or an attribute was removed
KSES filters elements, attributes, attribute values, and entities. A tag can survive while an attribute is removed, or the whole element can disappear if it is not permitted. Allowing a tag does not automatically allow every attribute on it.
With an explicit allow-list, add the needed tag and only the attributes the output requires. Tag and attribute names in the rules must be lowercase; mixed- or uppercase entries are not recognized as permitted. The wp_kses_allowed_html() reference describes retrieving rules for a context, and the WordPress handbook shows a custom allow-list with selected tags and attributes in its Escaping Data – Common APIs Handbook.
Choose an explicit allow-list or a named context
| Choice | When it fits | Where to inspect rules |
|---|---|---|
| Explicit allow-list | When the output needs a specific subset of HTML that does not match a named context. | Inspect the array passed as the second argument to wp_kses(). |
| Named context | When the rules for an existing context fit the content being filtered. | Use wp_kses_allowed_html() to retrieve the context rules. The wp_kses_allowed_html filter can customize them. |
For a named context, check the rules actually in effect rather than assuming the defaults: a plugin or theme may change them through the documented wp_kses_allowed_html filter. The context reference explains the available retrieval function.
Rank #2
Use the post wrapper only when post rules fit
wp_kses_post() applies the post context: WordPress documents it as calling wp_kses($data, 'post'). Use it when that context matches the HTML you intend to keep. If the needed markup is narrower or different, pass an appropriate custom allow-list or context to wp_kses() instead. See the wp_kses_post() reference.
Keep input slashing separate from output escaping
Direct calls to wp_kses() and wp_kses_post() expect unslashed data. Do not confuse them with wp_filter_post_kses(), whose reference specifies slashed input and describes stripping and restoring slashes around the call. That separate contract is not the contract for direct wp_kses() use; see the wp_filter_post_kses() reference.
Rank #3
Sanitizing permitted HTML does not remove the need to escape at output time. WordPress’s handbook says, “You always want to escape when you echo, not before.” When HTML should remain, use KSES with an appropriate context or selected tags; when the output is plain text, use escaping suited to that output context. The handbook discusses escaping data and common APIs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
