Security
Two things decide whether a WF-Algolia site is safe: which key you publish, and what happens to record content on its way into the page. The script handles the second. The first is on you.
Keys
Everything in a script tag is public. View source is enough.
| Key | Safe in a script tag | Can do |
|---|---|---|
| Search-Only | Yes | Query indices |
| Admin | Never | Add, overwrite and delete records and indices |
Use a Search-Only key with the search ACL and nothing more. If an Admin key has
ever been pasted into custom code, treat it as compromised and rotate it in the
Algolia dashboard — republishing the site does not undo it having been public.
For the same reason, WF-Algolia's own sync stores your Admin key server-side and never sends it to the browser.
Rendering untrusted content
Anything in your index is untrusted as far as the script is concerned — CMS content passes through editors, imports and APIs, and any of those can carry markup.
Plain text bindings
wf-algolia-text writes through textContent. Markup in the field is displayed
as characters, never parsed. This is the default and the safe one.
HTML bindings
wf-algolia-html exists for fields that legitimately contain rich text. It is
sanitized before insertion, using the browser's own parser plus a strict
allow-list.
Only these tags survive:
p · br · em · strong · b · i · u · mark · ul · ol · li ·
h1 · h2 · h3 · h4 · blockquote · code · pre · a · img
Any other element is unwrapped: the tag is dropped and its text is kept. A
<script> in a field becomes its own text content, not an executing script.
Attributes work the same way — an allow-list, not a blocklist:
| Tag | Attributes kept |
|---|---|
a | href, title, target, rel |
img | src, alt, title, width, height |
| everything else | none |
This is why onclick, onerror and style cannot get through. They are not
blocked by name — they are simply not on the list, so nothing has to anticipate
the next event-handler attribute someone invents.
URLs
Every URL-bearing attribute — a href, img src — is additionally checked. A
value starting with javascript:, data: or vbscript: (case-insensitively,
after trimming) is replaced with # and logged:
[wf-algolia] Blocked unsafe URL: javascript:alert(1)
Seeing that warning means a record in your index contains an attack payload, not that your markup is wrong. It is worth finding out how it got there.
Content Security Policy
If your site sets a CSP, the script needs:
script-src—https://cdn.jsdelivr.netconnect-src—https://*.algolia.netandhttps://*.algolianet.com
Add Insights to connect-src as well if you have enabled it.
Privacy
Insights tracking is off unless you set data-insights="true".
When on, it is cookieless by default — the user token lives only for the page
session. Setting data-insights-cookie="true" persists it across visits, which
is what makes personalization work and what may put it in scope for your cookie
consent flow.
Reporting a vulnerability
Please report security issues privately rather than in a public issue.