Block fails in multisite: missing attribute declarations in block.json

Hello,

I am reaching out regarding your extension TheIconBlock, which I find very well designed and genuinely useful. It provides features that are valuable for editors, and I would be happy to use it in production environments.

However, I have encountered a significant issue when the extension is used in a WordPress multisite installation. The block works perfectly in a single-site setup, but becomes unstable or impossible to save when running inside a multisite environment. The symptoms are:

• the block is flagged as “invalid content / attempt to recover”,
• some attributes disappear after saving,
• the page cannot be updated (“The update failed”),
• different behavior between Super Admin and regular Site Administrators.

After a detailed analysis, the cause appears to be the following:1. The block relies on many complex attributes…

TheIconBlock stores a large number of attributes:

• nested objects (Desktop / Tablet / Mobile),
• CSS-related structures,
• sizes, colors, icons, positions, etc.,
• JSON data that can be quite complex.

This is normal and consistent with the level of customization offered by the block.2. … but these attributes are not declared in the block’s block.json file

In multisite environments, WordPress enforces stricter validation rules:

• stronger REST API schema validation,
• tighter HTML sanitization (KSES) for non–super-admin roles,
• rejection of attributes that are not formally declared in block.json.

Because many attributes used by TheIconBlock are not defined in the block schema, WordPress:

• strips out some of the block’s JSON attributes,
• modifies or nullifies nested objects,
• marks the block as invalid upon reload,
• may completely block the page update through the REST API.

This behavior does not appear in a single-site installation but is systematic in multisite.3. To ensure multisite compatibility, one step is missing

👉 All attributes used by the block need to be declared in the block.json file.

Each attribute should include:

• a declared type,
• a default value,
• and, when relevant, a properly structured object definition (e.g., Desktop/Tablet/Mobile keys).

This is required for modern versions of WordPress and Gutenberg in multisite environments.4. Suggested directions for a long-term fix

• Add a complete list of attributes to your block.json file, matching what is used in your React components.
• Test the block inside a clean multisite environment without unfiltered_html permissions.
• Review how other block libraries handle complex attributes (Kadence Blocks, GenerateBlocks, Spectra, etc.).
• Consider using a dynamic block with a render_callback if certain content cannot be safely validated through REST.

Let me know if you need sample block output, traces, or any additional information to help you reproduce the issue.

Best regards,
Laurent