Code or HTML Not Saving in WordPress With TermsFeed AutoTerms

Find out why your code or HTML did not save and who makes the change

TermsFeed AutoTerms keeps the old code, or removes the HTML you added, when your WordPress account lacks the unfiltered_html capability. unfiltered_html is the WordPress permission to add JavaScript, CSS, and HTML that WordPress does not filter. The plugin prints these settings on every page of your WordPress website, so it accepts code only from an account trusted with that permission.

The plugin shows a message at the top of the screen after it filters a code field or a text field of the Cookie Consent kit. The message says what the plugin did with your change.

Which plugin settings need unfiltered_html

Every code setting, the Cookie Consent kit texts, and the notice bar messages depend on unfiltered_html, from the Callbacks and Additional CSS fields to the vendor scripts and Configuration Parameters. Code fields keep the stored value, and the text fields of the Cookie Consent kit save without their markup, with the second message. The Cookie Notice, Update Notices, and Endorsements messages lose only the HTML that a WordPress post does not allow, with no message. The Endorsements message prints only that HTML for every user anyway, so the capability changes nothing a visitor sees there. Look up what each field does on a save without the capability in TermsFeed AutoTerms Capabilities and Roles.

A user who sees either message lacks unfiltered_html. A developer checks the account with WP-CLI, replacing 1 with the user ID. The command prints bool(false) for an account without the capability.

wp eval 'var_dump( user_can( 1, "unfiltered_html" ) );'

Cause 1: You are a site Administrator on a multisite network

WordPress gives unfiltered_html only to Super Admins on a multisite network, so a site Administrator does not save new code in the plugin settings. The Callbacks, the Additional CSS, the vendor scripts, and HTML that a WordPress post does not allow in the Cookie Notice and Update Notices messages need a Super Admin.

Open the My Sites menu in the toolbar. The menu lists Network Admin only for a Super Admin, so a menu without that item means your account is a site Administrator.

Hand the code to a Super Admin, who saves it on your WordPress website. Read what else changes on a network in WordPress Multisite Legal Pages.

1. Send the code to a Super Admin of the network.
2. Ask the Super Admin to open the plugin screen on your WordPress website and save the code there.
3. Reload the screen and confirm that the code is still in the field.

Cause 2: wp-config.php sets DISALLOW_UNFILTERED_HTML

The WordPress constant DISALLOW_UNFILTERED_HTML removes unfiltered_html from every user, Administrators included. A host or a developer sets it in wp-config.php to harden a site. The plugin then keeps the old code for every account, with the first message.

Open wp-config.php and search for the constant. The line define( 'DISALLOW_UNFILTERED_HTML', true ); means the constant is set.

As the site owner, ask the developer or the host who manages wp-config.php to make the change, because only a change to that file allows the code.

As a developer, lift the constant for the length of the change and put it back afterward.

1. Set the constant to false for the time of the change, where your security policy allows it.
2. Ask an Administrator to save the code in the plugin.
3. Set the constant back to true, which keeps the saved code in place.

Cause 3: A security plugin removes the capability

Some security or hardening plugins offer an option that turns off unfiltered HTML, and where that option removes unfiltered_html from Administrators, it blocks their code saves as the constant does. Check in the documentation of your security plugin whether it sets DISALLOW_UNFILTERED_HTML or removes the capability from the role.

Look through the security plugin settings for an option that turns off unfiltered HTML. A switched-on option points here, and the WP-CLI user_can check returns bool(false) for an Administrator.

Save the code while the option is off, then switch it back on.

1. Turn the option off in the security plugin for the time of the change.
2. Save the code in the AutoTerms plugin.
3. Turn the option on again.

Cause 4: Your account has a legal pages role without unfiltered_html

A user with the plugin capabilities and without unfiltered_html saves legal pages with their HTML filtered, as WordPress does for any post. Markup that a post does not allow, such as a <script> or an <iframe>, disappears from the legal page on save, with no plugin message. Compliance Kits and Settings stay out of the menu for that user, so the code fields stay out of reach.

The TermsFeed menu shows which screens the account reaches. It lists Dashboard, All Legal Pages, Add Legal Page, and Help, with no Compliance Kits or Settings. A <script> or <iframe> that is gone from the legal page after you click Update confirms this cause.

Ask an Administrator, or a Super Admin on a network, to add the markup or the code. Give the user unfiltered_html only where you trust that user with code on every page of your WordPress website. Follow the role steps in WordPress Admin Menu Missing.

How to verify that the plugin saved your code or HTML

A save by an account with unfiltered_html does not show a message, keeps the code after a reload, and prints it on your WordPress website. The page source shows whether the code reached the visitors.

1. Save the code from an account with unfiltered_html and confirm that neither message appears.
2. Reload the screen and confirm that the code is still there.
3. Clear the page cache, close every private window, load your WordPress website in a new one, and open the page source with Ctrl+U (Cmd+Option+U on a Mac).
4. Search for the code, such as the callbacks in the script with the id termsfeed-autoterms-cookie-consent-callbacks or the CSS in termsfeed-autoterms-cookie-consent-style, and confirm that it matches the code you saved.