Trust
Security
Fetching arbitrary URLs on behalf of a visitor is a sensitive operation. These are the controls that keep View Source Online safe for both users and the sites it inspects.
Private network blocking
Loopback, link-local, and RFC 1918 addresses (.local, .internal, 127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) are rejected before any request is made, preventing server-side request forgery.
Stateless by design
No database, no queue, no cache of analyzed content. Results exist only in the response returned to your browser.
Protocol allow-list
Only http and https are accepted. file:, ftp:, gopher:, and data: URLs are refused outright.
Bounded fetches
A 20-second timeout, a maximum of eight redirects, and a 5 MB read limit stop a single request from consuming unbounded resources.
Content-type gating
Responses must be HTML or XHTML. Binary and API responses are rejected rather than streamed back.
No source execution
Retrieved HTML is parsed as text and never executed, rendered, or evaluated — scripts in analyzed pages cannot run here.
Reporting an issue
If you believe you have found a vulnerability, please report it tosecurity@viewsourceonline.comwith steps to reproduce. We aim to acknowledge reports within two business days.