Add a confirmation to an action whose consequence is difficult to reverse:

<button
  hx-delete="/tasks/42"
  hx-confirm="Permanently delete this task?"
  hx-target="closest li"
  hx-swap="delete">
  Delete
</button>

HTMX uses the browser’s confirm() dialog. Canceling prevents the request; accepting continues the normal request cycle.

Confirmation is friction, not security. The delete route must still authenticate, authorize the specific task, validate CSRF protection, and behave safely when repeated. A command-line client never sees the dialog.

Use confirmation sparingly. If nearly every action asks “Are you sure?”, people learn to approve without reading. An archive action or short-lived undo often protects users better than a modal warning.

Test both choices in the Network panel: cancel should produce no request, while confirm should produce exactly one. Then force a 403 or 500 and make sure the row is not visually removed when the server rejects the action.