---
url: 'https://dxpr.com/hc/documentation/learn-dxpr-builder/advanced/security'
title: 'Security | DXPR'
author:
  name: docs-sync
  url: 'https://dxpr.com/users/docs-sync'
date: '2026-10-23T14:31:17+00:00'
copyright: 'Copyright DXPR. All rights reserved.'
type: article
summary: 'Permissions, output filtering and the AJAX routes the editor uses'
tags:
  - 'Meet compliance requirements'
image: 'https://dxpr.com/themes/custom/dxpr_com/images/dxpr-share-card.jpg'
published: true
og:
  site_name: DXPR
  updated_time: '2026-10-23T14:31:17+0000'
  'image:alt': 'DXPR, powered by Drupal: AI-powered Drupal for marketers.'
schema:
  '@context': 'https://schema.org'
  '@graph':
    -
      mainEntity: {  }
    -
      '@type': TechArticle
      headline: Security
      description: 'Permissions, output filtering and the AJAX routes the editor uses'
      image:
        '@type': ImageObject
        url: 'https://dxpr.com/themes/custom/dxpr_com/images/dxpr-share-card.jpg'
        width: '1200'
        height: '630'
      datePublished: '2026-10-23T14:31:17+0000'
      dateModified: '2026-10-23T14:31:17+0000'
      author:
        '@type': Organization
        '@id': 'https://dxpr.com/#organization'
        name: DXPR
        url: 'https://dxpr.com/'
        logo:
          '@type': ImageObject
          url: 'https://dxpr.com/themes/custom/dxpr_com/dxpr-logo-dark.svg'
          width: '1348'
          height: '501'
      publisher:
        '@type': Organization
        '@id': 'https://dxpr.com/#organization'
        name: DXPR
        url: 'https://dxpr.com/'
        logo:
          '@type': ImageObject
          url: 'https://dxpr.com/themes/custom/dxpr_com/dxpr-logo-dark.svg'
          width: '1348'
          height: '501'
      mainEntityOfPage: 'https://dxpr.com/hc/documentation/learn-dxpr-builder/advanced/security'
      articleSection: 'Meet compliance requirements'
    -
      '@type': WebPage
      '@id': 'https://dxpr.com/hc/documentation/learn-dxpr-builder/advanced/security'
      description: 'Permissions, output filtering and the AJAX routes the editor uses'
      breadcrumb:
        '@type': BreadcrumbList
        itemListElement:
          -
            '@type': ListItem
            position: 1
            name: Home
            item: 'https://dxpr.com/'
      publisher:
        '@type': Organization
        '@id': 'https://dxpr.com/#organization'
        name: DXPR
      inLanguage: en
---
[Help Center](/hc)/[Documentation](/hc/documentation) /[Learn DXPR Builder](/hc/documentation/learn-dxpr-builder) /[Manage the site](/hc/documentation/learn-dxpr-builder/manage) /[Meet compliance requirements](/hc/documentation/learn-dxpr-builder/manage/compliance) # Security.

Permissions, output filtering and the AJAX routes the editor uses

 Learn DXPR BuilderManage the siteMeet compliance requirements

   ## In this guide

 Related guides

- [Performance](/hc/documentation/learn-dxpr-builder/advanced/performance)

This page lists what DXPR Builder protects on its own, and what you decide: who may edit, whether visitor output runs through text format filters, and which files editors may upload.

## Builder output and text formats

The builder saves a page as HTML in the field and shows that HTML as stored. Text format filters do not run on builder fields by default. A user who has **Edit with DXPR Builder** and may edit a page can therefore add any HTML to it, including scripts in an HTML element. Grant the permission to trusted roles only; Drupal marks it as restricted on the permissions page.

**Apply text format filters to frontend content**, under **DXPR Studio** > **DXPR Builder** > **General Settings** > **Text Filters**, runs the field's text format for users who are not editors. Editors keep seeing the raw content. A restrictive format can also strip builder markup, so test pages with it on.

AI output has its own filter. Under **DXPR Studio** > **DXPR Builder** > **AI**, **AI Output Filtering** limits generated content to the **Allowed domains** you list.

## User permissions

DXPR Builder defines three permissions:

| Permission | Label | Grants |
|---|---|---|
| `edit with dxpr builder` | **Edit with DXPR Builder** | Use the builder on content the user may edit; every such account uses a licence |
| `administer dxpr builder configuration` | **Administer DXPR Builder configuration** | **General Settings**, AI settings, **User Licenses**, **Content items** and **Migrations** |
| `administer dxpr_builder_profile` | **Administer dxpr builder profile** | **User Profiles** |

The **Page Templates** and **User Templates** admin pages need the core permission **Administer site configuration**.

The editor also needs update access to the content itself, such as **Basic page: Edit any content**. Every save checks it again on the server.

## AJAX routes and CSRF protection

These routes accept requests only with a CSRF token and only from an account that has **Edit with DXPR Builder** and is not excluded from editing:

- `/dxpr_builder/ajax` (saving, templates, blocks and Views)
- `/dxpr_builder/ajax/ai/chat` (AI text assistant)
- `/dxpr_builder/ajax/ai/image` (AI image generation)
- `/dxpr_builder/ajax/ai/image/edit` (AI image editing)
- `/dxpr_builder/ajax/file_upload` (file uploads)

`/dxpr_builder/user-settings` and `/dxpr_builder/entity-link-suggestions` also require a token and the permission. The editor fetches fresh tokens from `/dxpr_builder/csrf`, which answers only accounts that may edit. `/dxpr_builder/media-library` needs **View media**. No manual configuration is needed.

## User profiles

User profiles shape the editor for each role: which **Elements**, **Blocks**, **Views**, **Page templates**, **Global user templates** and **Icon sets** editors see, and which text editor buttons they get. A profile is not a security boundary. The save route accepts any HTML from a user with the permission, so hiding the HTML element does not stop a determined editor. More than one profile needs the DXPR Enterprise tier.

## File uploads

The upload route `/dxpr_builder/ajax/file_upload`:

- Accepts only GIF, JPEG, PNG, WebP, AVIF and SVG images, and WebM, Ogg, MP4 and QuickTime videos, through Drupal's file upload validation.
- Limits the file size to PHP's upload limit.
- Stores files in `dxpr_builder_images`, `dxpr_builder_videos` or `dxpr_builder_files` in the default files directory, as permanent files.

SVG files can contain scripts that run when someone opens the file directly. That is one more reason to keep the editing permission to trusted roles.

On a site whose default file system is private, files in the private `dxpr_builder_images` and `dxpr_builder_videos` folders are served to every visitor, because builder pages show them publicly. Do not upload confidential files through the builder.

## What's next?

[Performance tuning for faster pages](/hc/documentation/learn-dxpr-builder/advanced/performance) to continue exploring DXPR Builder.