Why Some Custom HTML Is Blocked From Saving

The HTML element in forms, surveys and quizzes checks your code as you type and blocks risky scripts. This protects your account and your visitors from data theft.

What the editor checks

When you add an HTML element and click Edit HTML, the code is scanned live. If something unsafe is found, a red message appears below the editor and Save stays disabled until you remove it.

Blocked patterns

• Reading cookies, including bracket-style variants.
• eval() and new Function(), which run text as code.
• setTimeout or setInterval given a string instead of a function.
• Reading values from localStorage.

Detection ignores capitalization.

Still allowed

Standard HTML, normal JavaScript logic, arrow functions, timers that receive functions, writing to or clearing localStorage, and sessionStorage.

Fix blocked code

1. Read the message under the editor to see which line is flagged.
2. Replace string timers with functions, for example setTimeout(() => run(), 1000).
3. Remove cookie or localStorage reads and find another way to pass the value, such as a hidden field.
4. Click Save again.

If the same issue appears repeatedly, only the first occurrence may be shown, so recheck after each fix.

Good to know: Third-party snippets such as trackers sometimes read cookies; if one is blocked, add it through your site's tracking settings instead of inside the form.