---
title: Configure forbidden URL characters
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

In URLs, some characters are considered unsafe because they may be used for special purposes or could cause issues with browsers or servers. The system automatically replaces or removes forbidden characters in [URL slugs and vanity URLs](https://docs.kentico.com/documentation/business-users/website-content/manage-page-urls.md).

By default, the following characters are forbidden:

```text
\/:*?"<>|&%.'#[]+=„“ and the space and tab characters
```

## Specify additional forbidden characters

To specify additional forbidden characters:

1. Open the **Settings** application.
2. Select the **URLs and SEO** category.
3. Type the characters into the **Forbidden URL characters** setting (without any separator).
4. **Save** the settings.

Alternatively, you can enter a [regular expression](http://en.wikipedia.org/wiki/Regular_expression) into the **Allowed URL characters** setting to precisely specify which characters are allowed in URLs.

## Override default forbidden characters

The default characters listed above are always forbidden unless you override the `CMSForbiddenURLValues` key in your project's configuration file (_appsettings.json_ by default). For example:

```json title="appsettings.json"
"CMSForbiddenURLValues": "\\/:*?\"<>|&%.'#[]+ ="
```

> **Note:** **Note**: Support for the slash ('/') character in [vanity URLs](https://docs.kentico.com/documentation/business-users/website-content/manage-page-urls.md#manage-vanity-urls-of-pages) always requires additional [configuration](#allow-the-slash-character-in-vanity-urls), even if the slash character is not included in the forbidden characters specified by the `CMSForbiddenURLValues` key.

You can either use the key to allow some of the default forbidden characters or add new ones. We **strongly recommend keeping the default set of forbidden characters** – entering the characters into URL values may prevent certain types of URLs from resolving correctly.

### Allow the slash ('/') character in vanity URLs

Support for the slash character in [vanity URLs](https://docs.kentico.com/documentation/business-users/website-content/manage-page-urls.md#manage-vanity-urls-of-pages) can't be configured through the `CMSForbiddenURLValues` key, but has to be enabled separately. When the setting below is enabled, the slash character is always allowed in vanity URLs, regardless of other settings.

To allow the slash character in vanity URLs:

1. Open the **Settings** application.
2. Select the **URLs and SEO** category.
3. Select the **Allow '/' in vanity URLs** setting.
4. **Save** the settings.

> **Note:** **Note:**
>
> The following vanity URL paths are always forbidden:
>
> - paths starting with '/' or '\~/'
> - paths ending with '/'
> - paths containing multiple '/' in a row (e.g., `vanity//path`)

## Specify forbidden character replacement

To specify forbidden character replacement:

1. Open the **Settings** application.
2. Select the **URLs and SEO** category.
3. Enter the character into the **Forbidden character replacement** setting.
4. **Save** the settings.

By default, forbidden characters located at the beginning or end of the path are removed completely and consecutive forbidden characters are only replaced by a single replacement character. For example, "_Articles\*and%%%blogs_" is replaced with "_Articles-and-blogs_" when using the default replacement character: '_-_' hyphen. If no replacement character is specified, the underscore '_\__' character is used.