The regex validator acts as a whitelist in that the string the user enters must match the regex entered so you would have to create a regex which defines what you want to allow. Specifying a string you don't want to appear is quite a bit trickier than specifying what you do want to see but it should be possible with a negative lookahead operator or similar, something like this: ^((?!:\/\/).[\r\n]*)*$