---
title: "Configuration"
canonical: "https://support.appfire.com/space/HTML/70615447/Configuration"
format: markdown
---
> Macro (aura-html)
After installing *HTML for Confluence*, navigate to the HTML for Confluence Configuration screen:
1. Log in with the System Administrator's [global permission](https://confluence.atlassian.com/doc/global-permissions-overview-138709.html).
2. Click the settings (gear) icon, then select **Manage apps**.
3. Either search for *HTML for Confluence* or scroll to *Bob Swift Configuration*, and click *HTML* to view app configuration.
> ✅ ### Older Confluence versions
> ✅
> ✅ 1. Click the settings (gear) icon, then select **Settings** > **Atlassian Marketplace** on the sidebar.
> ✅ 2. Scroll to *Bob Swift Configuration* and click *HTML* to view the configuration page.
The following configuration tabs are available:
- [Global Configuration](https://appfire.atlassian.net/wiki/x/l4E1B#Configuration-html_57_config_global)
- [Profiles](https://appfire.atlassian.net/wiki/x/l4E1B#Configuration-html_57_config_profiles)
## Global Configuration
Use the toggles to enable or disable the Global Configuration settings.
| **Parameter** | **Default** | **Description** |
| --- | --- | --- |
| Disable secure processing | Off | Allows the *XSLT* macro to use all XSLT features, including substituting XML entity references with their actual values. Available since 5.1.0. |
| Restrict URL access | Off | Restricts access to remote locations through the *Location* parameters in the *Html-bobswift* and *XSLT* macros to URLs that conform to the Confluence Whitelist, if whitelisting is enabled. Available since 5.3.0.
> 📝 **Known issue (Confluence 8.7+):** if this option is disabled and the Confluence whitelist is enabled, URL content cannot be accessed. Enable `Dnet.request.allow.all.hosts=true` in **/bin/setenv.sh** to resolve it. |
| Allow JavaScript | On | Controls whether JavaScript can be used in *HTML for Confluence* macros. Disable this to prevent users from adding JavaScript. Available since 5.4.0.
> ⚠️ You can also control JavaScript per-page using Macro Security for Confluence. See [Macro Security Configuration](https://appfire.atlassian.net/wiki/spaces/CMSP/pages/67404646) and [the Macro Security section below](https://appfire.atlassian.net/wiki/x/l4E1B#Configuration-html_57_config_macroSecurity). |
| Blacklist domains | Off | Blocks macro requests to a set of domains. Disabled by default for backward compatibility; if enabled, requests to a blacklisted site show an error instead. Available since 5.6.0.
> ⚠️ If this option is disabled, access to all domains is permitted.
- 10.0.0.0/8
- 100.64.0.0/10
- 127.0.0.0/8
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
- 192.0.0.0/24
- 198.18.0.0/15
- 255.255.255.255/32
- 0.0.0.0/32
- 192.0.2.0/24
- 192.88.99.0/24
- 198.51.100.0/24
- 203.0.113.0/24
- 224.0.0.0/4
- 240.0.0.0/4
|
| Blacklist domain values | Pre-defined set of domains | Comma-separated list of domains to blacklist. Only enabled if *Blacklist domains* is on. You can add to, edit, or remove from the pre-defined list. Available since 5.8.0.
> ⚠️ If *Blacklist domains* is enabled and this field is left blank, the pre-defined list above is used instead. |
## Apply restrictions through Macro Security for Confluence
Since 5.7.0, the macro name changed from *HTML* to *Html-bobswift*. If you use Macro Security for Confluence to restrict macros, you now need entries for both names, since existing pages may still use the old name while new content uses the new one.
### Already configured (no action needed)
Existing pages using the *HTML* macro name with Macro Security continue to work as-is. Their existing entries are:
- *html* = **ANY*
- *html.allowJavascript* = **ANY*
- *html.profile.** = **ANY*
- *xslt* = **ANY*
- *xslt.profile.** = **ANY*
### Action required: add entries for Html-bobswift
For any new HTML content, add these entries in **Macro Security for Confluence Configuration** > **Secured macros**:
- *html-bobswift* = **ANY*
- *html-bobswift.allowJavascript* = **ANY*
- *html-bobswift.profile.** = **ANY*
> ⚠️ If these entries are missing, users see the error: "Security restricted macro with parameter 'profile' is not allowed. An edit restriction is required that matches the macro authorization list."
## Profiles
Profiles are a shared set of parameters (URL, credentials, headers) for accessing external content. Available since 5.7.0. Use profiles to:
- Keep authentication details hidden from page viewers and editors, visible only to Confluence administrators.
- Reuse a shared URL configuration across multiple macros instead of repeating it.
- Reduce page edits when a base URL changes, since macros reference the profile rather than a hard-coded URL.
> ⚠️ Enter the base URL in the profile. Enter only the raw URL (the part after the domain, including any query string) in the macro's *Location of HTML data* or *Location of XML data* field. For example, for *http://www.contoso.com/articles/recent.aspx*, the raw URL is */articles/recent.aspx*.
On this page, you can click the edit icon to edit a profile, or the remove icon to delete one. Click **Add Profile** to create a new one:
| **Parameter** | **Description** |
| --- | --- |
| Profile name | Name shown in the *Profile* field in macro editors. Must be unique, or it overwrites the existing profile of the same name. |
| Profile type | *URL* (default), *GitLab*, or *GitHub*. |
| URL | The base URL of the remote location. If *Profile type* is *GitLab* or *GitHub*, a default URL is pre-filled and editable. |
| User | Username to access the URL, if required. |
| Password | Password to access the URL, if required.
> ⚠️ Use either *User*/*Password* or *Access token*, not both. |
| Access token | An access or API token for the connected application or service, used instead of *User*/*Password*.
- [Generate a GitLab token](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html)
- [Generate a GitHub token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line) |
| URL parameters | Extra query string parameters to append to the URL. |
| Request headers | Auto-populated name/value pairs based on the profile's settings (for example, GitHub requires *Authorization: token $accessToken*). Add more pairs, comma-separated, if needed. |
Click **Save profile** to create the profile.
> 📝 The **Help us improve the product** parameter was removed. We do not collect or transmit private user data or personally identifiable information. Refer to the [Appfire Trust Center](https://appfire.atlassian.net/wiki/x/TASNNQ) for EULA and other policies.