Implement `hx-swap` for `Element.setHTML()` and change `htmx.config.defaultSwapStyle` to use it.
Author: mozfreddybCreated Jan 7, 2026Updated Sep 9, 2026
Labelshtmx 4
Hi,
The web platform is soon going to universally offer an XSS-safe variant of innerHTML= assigments called Element.setHTML(), with Firefox and Chrome shipping in February 2026.
I think it could provide a great security improvment to htmx too:
- Implement an
hx-swapusingsetHTML() - Change the default value for
htmx.config.defaultSwapStyletosetHTML()instead ofinnerHTML.
I'm aware the second point would be a breaking change and needs additional considerations, but overall this would provide strong security by default, while still allowing developers to use a different method with hx-swap.
Source: bigskysoftware/htmx