Blocking HTML in Forms (XSS Prevention)

Attackers often inject Javascript and HTML into forms to gain access to admin areas, exfiltrate data from other users, or delete resources on your site. 

This rule catches forms that contain HTML and Javascript at the WAF level before they are pushed into your application. It is disabled by default, since your application may depend on accepting HTML input.

To turn it on, set HTML in Form Submissions to HTML Blocked on the Content Security page of your WAF dashboard. Available on the Advanced, Professional, Network, and Enterprise plans.

For the other controls on that page, see Managing HTTP Security Headers.