Simon Willison’s Weblog

Default styles for h1 elements are changing (via) Wow, this is a rare occurrence! Firefox are rolling out a change to the default user-agent stylesheet for nested <h1> elements, currently ramping from 5% to 50% of users and with full roll-out planned for Firefox 140 in June 2025. Chrome is showing deprecation warnings and Safari are expected to follow suit in the future.

What's changing? The default sizes of <h1> elements that are nested inside <article>, <aside>, <nav> and <section>.

These are the default styles being removed:

/* where x is :is(article, aside, nav, section) */
x h1 { margin-block: 0.83em; font-size: 1.50em; }
x x h1 { margin-block: 1.00em; font-size: 1.17em; }
x x x h1 { margin-block: 1.33em; font-size: 1.00em; }
x x x x h1 { margin-block: 1.67em; font-size: 0.83em; }
x x x x x h1 { margin-block: 2.33em; font-size: 0.67em; }

The short version is that, many years ago, the HTML spec introduced the idea that an <h1> within a nested section should have the same meaning (and hence visual styling) as an <h2>. This never really took off and wasn't reflected by the accessibility tree, and was removed from the HTML spec in 2022. The browsers are now trying to cleanup the legacy default styles.

This advice from that post sounds sensible to me:

• Do not rely on default browser styles for conveying a heading hierarchy. Explicitly define your document hierarchy using <h2> for second-level headings, <h3> for third-level, etc.
• Always define your own font-size and margin for <h1> elements.

# 11th April 2025, 3:54 am / browsers, chrome, css, firefox, html, mozilla, safari, web-standards

Jeremiah Grossman: I know who your name, where you work, and live. Appalling unfixed vulnerability in Safari 4 and 5 —if you have the “AutoFill web forms using info from my Address Book card” feature enabled (it’s on by default) malicious JavaScript on any site can steal your name, company, state and e-mail address—and would be able to get your phone number too if there wasn’t a bug involving strings that start with a number. The temporary fix is to disable that preference.

# 22nd July 2010, 8:44 am / apple, autocomplete, browsers, exploit, safari, security, vulnerability, recovered

Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari. You just can’t trust browser security: Current versions of Safari, IE8 and Firefox all fell to zero-day flaws at an exploit competition. None of the vulnerabilities have been disclosed yet.

# 19th March 2009, 3:30 pm / browsers, firefox, ie, ie8, pwn2own, safari, security

Safari CSS Reference. Official documentation covering the CSS properties supported by Safari, including the -webkit proprietary extensions.

# 22nd November 2007, 11:51 pm / browsers, css, documentation, safari, webkit

CSS Transforms. WebKit can now do transforms (scale, rotate, translate and skew) in CSS via a new -webkit-transform property. Transforms behave like position relative in that they don’t affect the layout of the page. You can also provide a full affine transform matrix as a shortcut.

# 26th October 2007, 9:45 pm / affinetransformation, apple, browsers, css, graphics, matrix, safari, transforms, webkit

Native DOMContentLoaded is coming to Safari. I filed this bug over two years ago. They’ve just committed the resulting patch to trunk.

# 8th October 2007, 1:07 am / browsers, domcontentloaded, javascript, onload, safari, webkit

Multi-Safari. Lets you run multiple versions of Safari on the same Mac. As with the multi-IE hacks, all versions use the same underlying HTTP libraries (which belong to the OS) so the simulation isn’t entirely accurate.

# 5th October 2007, 11:51 pm / browsers, multisafari, safari

WebCore Rendering I—The Basics. Dave Hyatt has started a series of posts explaining the internals of WebCore’s rendering system.

# 10th August 2007, 3:21 pm / browsers, css, dave-hyatt, html, internals, safari, webcore

Enabling the debug menu on Safari for Windows. “Turn off site-specific hacks” is one of the menu options.

# 12th June 2007, 1:18 pm / apple, browsers, safari, safari3, windows

How to enable session saving in the new Camino 1.1a2 (via) I’ve stopped spending time in any browser that doesn’t have session saving built in—sorry Safari!

# 15th January 2007, 1:49 am / browsers, camino, safari, sessionsaving