John Godley

HTML Purified replaces the default WordPress comments filters with HTML Purifier, a super HTML filtering 
library.
<blockquote>
HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will 
 not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet 
 permissive whitelist, it will also make sure your documents are standards compliant, something 
 only achievable with a comprehensive knowledge of W3C’s specifications.
</blockquote>
An additional feature of HTML Purifier is that it will produce valid well-formed XHTML code, something 
which KSES does not do.
Features:
<ul>
<li>Configurable KSES or HTML Purifier</li>
<li>Configurable list of HTML elements and attributes for both KSES and HTML purifier</li>
<li>Additionally process comments with HTML Tidy</li>
<li>URL blacklist</li>
<li>Fully localized (and awaiting translations)</li>
<li>Automatically escape PHP or anything inside backticks</li>
</ul>
HTML Purifier is available in:
<ul>
<li>English</li>
<li>Spanish, thanks to José Cuesta</li>
<li>Belorussian, thanks to Marcis Gasuns</li>
<li>Russian, thanks to Ilyuha</li>
<li>Uzbekistan, thanks to Alexandra Bolshova</li>
<li>Dutch, thanks to Pieter</li>
<li>German, thanks to Andreas Beraz</li>
<li>Polish, thanks to Kasia Ciszewski & Dawid Śpiechowicz</li>
<li>Romanian, thanks to Alina @ InboxTranslations.com</li>
<li>Lithuanian, thanks to Nata Strazda</li>
<li>Ukranian, thanks to Iflexion Design</li>
</ul>
<h3>Documentation</h3>
Full documentation can be found on the <a href="http://urbangiraffe.com/plugins/html-purified/" rel="nofollow ugc">HTML Purified</a> page.

HTML Purified

HTML Purified replaces the default comments filters with the more secure HTML Purifier.

Sami Ahmed Siddiqui

This plugin helps safeguard your website against two common types of Cross-Site Scripting (XSS) vulnerabilities:
<ul>
<li>Reflected XSS: This happens when harmful scripts are hidden in a website’s URL. If a user clicks a link with such a script, it can run in their browser, potentially stealing their data or taking control of their system.</li>
<li>Self-XSS: This occurs when a user’s own input on your website is displayed back to them in an unsafe way, allowing malicious scripts to run in their browser.</li>
</ul>
This plugin provides several layers of protection:
Blocking: When active, the plugin checks URLs for specific characters. If it finds any of these characters in the URL, it redirects the user to prevent a potential XSS attack. You can customize which characters to block or allow.
<ul>
<li>Opening Round Bracket <code>(</code></li>
<li>Closing Round Bracket <code>)</code></li>
<li>Less than Sign <code><</code></li>
<li>Greater than Sign <code>></code></li>
<li>Opening Square Bracket <code>[</code></li>
<li>Closing Square Bracket <code>]</code></li>
<li>Opening Curly Bracket <code>{</code></li>
<li>Pipe or Vertical Bar <code>|</code></li>
<li>Closing Curly Bracket <code>}</code></li>
</ul>
Encoding: For an extra layer of security, the plugin encodes certain characters found in URL parameters. This stops harmful code from running, even if it’s present in the URL. You can also choose to exclude specific parameters from being encoded.
<ul>
<li>Exclamation Mark <code>!</code></li>
<li>Double Quotation <code>"</code></li>
<li>Single Quotation <code>'</code></li>
<li>Opening Round Bracket <code>(</code></li>
<li>Closing Round Bracket <code>)</code></li>
<li>Asterisk Sign <code>*</code></li>
<li>Less than Sign <code><</code></li>
<li>Greater than Sign <code>></code></li>
<li>Grave Accent “`</li>
<li>Cap Sign <code>^</code></li>
<li>Opening Square Bracket <code>[</code></li>
<li>Closing Square Bracket <code>]</code></li>
<li>Opening Curly Bracket <code>{</code></li>
<li>Pipe or Vertical Bar <code>|</code></li>
<li>Closing Curly Bracket <code>}</code></li>
</ul>
Escaping HTML in <code>$_GET</code>: This plugin automatically makes HTML characters safe within the <code>$_GET</code> variable. This is vital if your website pulls data from URLs and displays it as part of your web page. It helps prevent malicious scripts from being injected through user-provided input.
<h3>Important Notes:</h3>
<ul>
<li>After activating the plugin, thoroughly test your website forms, especially if you use WooCommerce. Make sure the plugin doesn’t interfere with your shopping cart and checkout processes.</li>
<li>We welcome bug reports for this plugin on GitHub: <a href="https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues" rel="nofollow ugc">https://github.com/samiahmedsiddiqui/prevent-xss-vulnerability/issues</a>. Please remember that GitHub is for bug reports only, not general support.</li>
</ul>
By using this plugin and following these recommendations, you can significantly improve your website’s defense against XSS attacks.

Prevent XSS Vulnerability

Very useful plugin.

This WP plugin blocks XSS by encoding harmful URL characters & safely handling HTML in $_GET. Customizable settings for enhanced website security.

HTML Purified vs Prevent XSS Vulnerability