Browser element allowlist
article, section, div, span, p, br, pre, code, i, b, strong, em, small, h1, h2, h3, h4, ul, ol, li, a, img, button, dl, dt, dd.
Browser attribute allowlist
class, style, href, src, alt, role, aria-label, loading, width, height, type, data-grind, data-ion-action, data-product-id, data-companion-id, aria-pressed.
The import path is stricter
importHtml() removes scripts, iframes, forms, inputs, selects, textareas, objects, embeds and external stylesheets. Unsupported elements, including buttons, become plain content. All data-* attributes are removed even if the browser allowlist supports some of them. Event handlers and arbitrary attributes are removed. Use anchors for imported actions.
Embedded CSS is inlined without fetching external resources. Media queries, custom fonts, keyframes, pseudo rules and remaining style tags are discarded. Use existing site CSS classes for responsive styling. The browser allowlist is not a promise that an HTML import preserves every listed feature.
href and src are resolved against the website origin by the importer; only HTTP(S) URLs without embedded credentials survive. Data URLs, JavaScript URLs and unsupported schemes are removed. Provide real, approved image addresses. The browser separately rejects unapproved URL prefixes.
Inline styles
Layout, spacing, typography, color, borders, sizing and image fit properties have an explicit property allowlist.position only accepts static or relative. URL values, expressions, !important, CSS comments, escapes and oversized values are rejected. Background images, transforms, fixed overlays and arbitrary CSS injection are not supported through this import path.
An imported component must retain text or an image and stay under 24,000 characters after sanitization. Inspect returned warnings, then preview the saved output. Do not infer behavior from the source HTML alone.