CMS Markdown and embedded url

Elements
1

So in Elements when editing a md file I can use the format [Visit Realmac Software](https://realmacsoftware.com) and it works fine and shows as a hyperlinked piece of text.

However in the CMS online editor this format causes a ‘Network Error’ on saving, aka a file it doesn’t like. I have tried multiple variations of this but none work, I even spent a session with Claude trying various alternatives. But nothing worked.

Adding the straightforward ‘flat’ url works but it is not as ‘friendly’ as having a linked url to a piece of text. The online editor offers this when you highlight a piece of text but that also results in a ‘Network Error’ aka bad file.

2

No need for Markdown syntax, you can just use the styling actions in the toolbar, like this:

CleanShot 2026-06-22 at 9 .36.42

If you wanted to use Markdown syntax, you’d need to switch to the raw Markdown view:

CleanShot 2026-06-22 at 9 .40.05

3

Thanks @dan (sorry I put ben to start with) if i add a link in this way and press save i get a ’Network Error’ message. If i remove the link it saves fine. So i guess the issue must be something other than thenlink itself.

4

Hi @dan, please watch the attached video. I enter the url, save but it is not saved. If I enter the url to 2 different items I get a network error.

5

It looks like there might be a slight bug, that if you just enter a URL and save, it doesn’t actually save the document as it thinks nothings changed.

For now, try adding a link, then making another text change, i.e. type some more text not he page and then hit save.

Let me know how you get on.

6

Hi Dan, sadly nope, network error please see attached.

7

Do you always get this issue when trying to update a post (even without links)?

I’m wondering if this is a server issue, or a browser extension causing problems… Can you try another browser (without extensions) and see if it works.

8

If I do not include a URL the files save fine.

So I have tried DuckDuckGo (my default browser), Safari and Firefox. I left extensions alone except in Firefox where I disabled them. All 3 browsers returned the same error.

It might be worth pointing out that News Posts with URL links upload just fine from the Elements app, so I cannot see easily how it can be a server issue?

9

Hi @jwDave

The reason is that uploading files with links in them via FTP/SFTP is not the same as saving files on the server via a POST request. The former wouldn’t really trigger any network error in the browser, whereas the latter could if it were an issue with either the server config or code in the CMS (or both).

Any chance you could send over your login credentials via DM to your CMS Admin dashboard so we can hopefully see some more information regarding that network error that’s getting thrown? Feel free to DM them over to me. :slightly_smiling_face:

10

Hi @jwDave

Thanks for sending over those credentials and your patience while I investigated this.

So, two things are going on here:

  1. The Network Error you were seeing when adding links was caused by your web host’s ModSecurity ruleset. I disabled ModSecurity on the beta subdomain you are testing on, and I can now add links without that Network Error. Unfortunately your web hosting provider doesn’t allow excluding of specific mod_sec rules in their cPanel, so if you wanted to keep ModSecurity enabled and exclude the exact rule that is triggering that Network Error, you’d have to reach out to your web host and ask them to check their server logs while forcing that Network Error so they can see the rule ID that’s getting triggered and then they can just exclude that one rule.

  2. There is a caveat to the above, after adding a link to some text, I do still need to add at least 1 character to the page (or change something else on the page) in order to force a state update so the page will save. We’ll probably need to get @ben to check the code to make sure adding a link to some text via the Online Editor’s built-in “Add Link” button will mark the page state as “changed” so it will save properly without having to add/subtract/modify something else on the page.

Hope that helps for now though. :slightly_smiling_face:

11

What can I say! The support from @differentdan was excellent, both technically (well above my pay grade) and late into the evening.

It just re-enforces why RW and @dan, @ben et all are a great team to have on your side.

12

FYI @dan and @differentdan

We have reviewed the ModSecurity logs on our side and identified that rule 933210 (PHP Injection Attack: Variable Function Call Found) is being triggered by the CMS request when links are added in the blog content.

This is a known false positive in some CMS editors when processing Markdown/URL content.

Instead of disabling ModSecurity completely, we have now excluded/disabled only this specific rule for your subdomain so that security remains enabled while the CMS continues to work normally.