Pasting HTML into a live WordPress site is an act of trust, especially when the HTML came from a template, an AI, or someone else’s page. The safest method is not caution — it is knowing exactly what is removed before anything reaches your editor. Here is that list, and the practices that cover the rest.
What is stripped before you ever paste
Conversion runs entirely in your browser, and the output is Elementor data — not the original markup. On the way through, these are removed or neutralised:
- Every script tag. No JavaScript from the source survives, full stop. Anything interactive arrives as static markup for you to rebuild with Elementor’s own widgets.
- Every inline event handler. Attributes like
onclickandonmouseoverare stripped from each element individually — the classic way script gets smuggled through markup that “has no script tags”. - Form endpoints. A form’s
actionandmethodare removed. The visible fields stay, but a pasted form can never silently post your visitors’ data to whoever wrote the original page. - Unknown embeds.
object,embedandapplettags are blocked. Iframes are allowed from exactly four hosts — YouTube, its nocookie variant, and the Vimeo player — and become Video widgets; every other iframe is not carried as a live frame. Ansrcdocattribute, which can hide an entire document inside an iframe tag, is removed too. - Dangerous link targets and risky CSS. Link targets and style declarations are cleaned rather than copied verbatim.
Everything removed is listed in the safety report on the result screen, so this is not silent policy — you can read exactly what was taken out of your specific page before you paste it.
Why the CSS cannot leak into your theme
The subtler risk of pasting styled HTML is not malice but collision: the source page’s stylesheet declaring body { font-family: … } or h2 { color: … }, and those rules restyling your whole site.
Carried styles are scoped to prevent this. Every selector in the imported CSS is rewritten so it only applies inside the imported content — and selectors that target html, body or :root are remapped to the imported block itself rather than being allowed to reach your page. The imported section keeps its look; your theme never sees those rules.
The same thinking is why position: fixed is downgraded to absolute during conversion: a fixed element from someone else’s page would otherwise float over your entire site, on every page using the template.
What safe does not mean
Two honest boundaries. First, the tool cannot vet your content — if the HTML contains text, images or links you do not have rights to, converting it does not change that. Second, stripping is about what executes and where data goes; it does not review what the page says. Read what you paste.
Best practices before you paste
- Convert, never paste raw. The dangerous route is pasting third-party markup into an HTML widget verbatim — that path has no stripping at all and ships whatever the source contained. Converting to native widgets is the safety layer.
- Read the safety report on the result screen. If it lists four stripped scripts and a cleaned form, you know what behaviour you need to rebuild — and what the original page was doing.
- Paste into a draft first. Not because conversion is risky, but because layout review belongs on a page nobody is visiting.
- Reconnect forms deliberately. The submit endpoint was removed on purpose; wire the Elementor Form widget to your own actions rather than hunting for the original destination.
- Keep backups regardless. Standard advice for any import of any kind, from any tool.
And your own HTML never leaves your browser
Safety runs in the other direction too. The page you convert is parsed, rendered and converted locally — your HTML and images are not uploaded to this site or anywhere else, no account exists to leak, and nothing touches your WordPress credentials. The tool produces data; you decide what happens to it, inside your own editor.
The safest method, in one paragraph
Convert in native components mode rather than pasting raw HTML into a widget. Read the safety report. Paste into a draft, rebuild the interactive parts with Elementor’s own widgets, reconnect the form to your site, and publish once it looks right at all three breakpoints. That is the whole method — the stripping above handles the part you cannot see, and the checklist handles the part you can.