hugo/docs/content/en/functions/transform/HTMLEscape.md

title	linkTitle	description	categories	keywords	menu	function	relatedFunctions	aliases
transform.HTMLEscape	htmlEscape	Returns the given string with the reserved HTML codes escaped.	functions		docs parent functions	aliases returnType signatures htmlEscape string transform.HTMLEscape INPUT	transform.HTMLEscape transform.HTMLUnescape	/functions/htmlescape

In the result & becomes & and so on. It escapes only: <, >, &, ' and ".

{{ htmlEscape "Hugo & Caddy > WordPress & Apache" }} → "Hugo & Caddy > WordPress & Apache"