Cleaning HTML in product and category descriptions

Installation

1. Download the dfhtmlcleaner.zip archive from your DataFirefly customer account.
2. In the back office, open Modules → Module Manager, click Upload a module and drop the archive.
3. Once installed, an HTML Cleaner tab appears under the Catalog menu.

Installation creates the ps_dfhtmlcleaner_backup table, which stores replaced values. It is dropped on uninstall.

Requirements

• PrestaShop 8.0 to 9.x
• PHP 7.4 to 8.3
• PHP dom and mbstring extensions enabled

First run: simulate before writing

Open Catalog → HTML Cleaner. The Run a cleaning panel sits at the top of the page.

1. Tick the content to process. Products and Categories are pre-checked; you can add CMS pages, brands and suppliers.
2. Pick a language, or leave All languages. On a multistore install, a store selector appears as well.
3. Click Simulate. Nothing is written to the database.

At the end of the pass you get three figures: how many records were scanned, how many the cleaning would change, and the total weight saved. Below that, up to ten before/after comparisons are shown side by side, each with a direct link to the record.

Cleaning for real

Once the simulation looks right, click Clean for real and confirm. The same pass runs again, but this time values are written.

Processing runs in successive AJAX batches. A progress bar shows how far along it is, a log lists the processed batches, and the Stop button interrupts cleanly at the end of the current batch. Leave the tab open while it runs.

Batch size

By default, 50 records are processed per request. On slow shared hosting, drop to 10 or 20 in the general settings. On a dedicated server you can go up to 500.

The rules in detail

Rules are grouped into four families further down the page. Any saved change applies immediately, including in the sandbox.

Legacy and unsafe markup

• Microsoft Word / Office markup: conditional comments, XML islands, <o:p>, <w:WordDocument> and <v:shape> tags, mso-* attributes.
• HTML comments.
• script, style, object and form elements. Event handlers such as onclick are removed in every case, whatever this option is set to.
• Iframes. Three modes: keep everything, keep trusted providers only (default), remove everything. The default list covers YouTube, Vimeo, Dailymotion, Google Maps, SoundCloud, Spotify and OpenStreetMap. Add your own domains in the field provided, one per line or comma separated. The check runs on the real host, so an address like youtube.com.example.tld is rejected.

Attributes

• Inline styles: Keep, Filter (default) or Remove. Filter mode drops mso-*, font-family, font-size, line-height, color and a few others, and keeps whatever is layout related.
• Classes: Keep, Remove editor classes (default: MsoNormal, ql-, gmail_, x_, western) or Remove.
• id attributes: off by default, since internal anchors may depend on them.
• data-* attributes: off by default, some themes and modules rely on them.
• Deprecated presentational attributes: align, bgcolor, border, cellpadding, face, valign and so on.
• Unrecognised attributes: only a safe list survives (href, src, alt, title, colspan…), extended with media specific attributes on iframe, video, audio and source.
• width and height on images. Off by default, because these attributes reduce layout shift (CLS).

Structure

• Unwrap span elements with no attribute, and as a more aggressive option div elements with no attribute.
• Unwrap font tags.
• Modernise deprecated tags: b to strong, i to em, center to div, strike to s, tt to code.
• Remove empty elements. Table cells, rows and structural elements are excluded from this rule so your layout does not shift.
• Tag whitelist: off by default. When on, any tag outside the list is unwrapped and its text content kept.

Typography and media

• Non-breaking spaces: runs are collapsed to one.
• Consecutive line breaks: three or more <br> become two, and <br> stuck against a closing block tag are dropped.
• Whitespace and indentation. The content of pre, code and textarea tags escapes this normalisation.
• Secure links: rel="noopener noreferrer" added on target="_blank" links, javascript: URLs removed.
• Missing alt attribute on images, and optional loading="lazy".

Backups and rollback

As long as Store a backup before writing is on, every replaced value is copied into the module table with a run identifier. The Backups and rollback panel lists runs by date and content type.

The Restore button puts every field of a run back, then deletes the matching entries. Retention is set in days in the general settings; leave 0 to keep the history indefinitely. Expired entries are purged when the page loads.

Auto-clean on save

The Clean automatically on save option applies the same rules every time a product or a category is saved in the back office, through the hooks fired before the object is written. It covers both the v2 product page and the legacy pages.

It is off by default. Validate your rules in simulation before turning it on.

Sandbox

The Sandbox panel applies the current rules to a pasted HTML snippet and shows the result along with the weight saved. Nothing is read from or written to the database. It is the quickest way to check the effect of a setting before running a full simulation again.

After a large run

• Clear the PrestaShop cache from Advanced parameters → Performance.
• If automatic search indexing is on and your index includes descriptions, rebuild it from Shop parameters → Search.

Troubleshooting

The Simulate and Clean buttons do nothing

First check that you are running 1.0.1 or later, then reload the page with Ctrl+F5 to clear the browser cache. If it persists, open the browser console: a dfHtmlCleanerAjaxUrl is not defined message means the module JavaScript file was not served, usually because of a server cache or read permissions on modules/dfhtmlcleaner/views/js/.

Processing stops after a few batches

Lower the batch size to 10 or 20 in the general settings, then start again. The pass restarts from the beginning, but already clean records are no longer modified: the engine is idempotent, so a second pass produces no useless writes. The log reports the HTTP status code when a batch fails, which tells a timeout (504) apart from a PHP error (500) or a token problem (403).

An embedded video disappeared

The provider is most likely missing from the trusted domain list. Add it, restore the affected run from the Backups panel, then run again.

A table lost its formatting

The width, border and cellpadding attributes on tables count as deprecated presentational attributes. If your theme has no CSS for tables, turn that rule off and restore the run.

Cleaning changes nothing

That is the expected behaviour on an already clean catalog. Use the sandbox to confirm that a snippet you know is problematic does get transformed, and that the matching rules are enabled.

Uninstall

Uninstalling from the module manager drops the backup table, deletes the configuration entries and removes the menu tab. Already cleaned descriptions are not reverted: restore the runs you care about before uninstalling if you want to go back.