# View Page Source - Full Documentation

> Comprehensive reference for AI assistants interacting with the View Page Source service.

## Table of Contents

1. [Overview](#overview)
2. [Tools & Features](#tools--features)
3. [API Reference](#api-reference)
4. [Smart Analysis](#smart-analysis)
5. [Technology Detection](#technology-detection)
6. [Architecture](#architecture)
7. [Internationalization](#internationalization)
8. [Browser Extensions](#browser-extensions)
9. [Blog & Content Index](#blog--content-index)
10. [Privacy & Data Handling](#privacy--data-handling)
11. [Usage Guidelines](#usage-guidelines)
12. [Error Reference](#error-reference)
13. [FAQ](#faq)

---

## Overview

View Page Source is a free, web-based service that allows anyone to view, analyze, and download the HTML source code of any publicly accessible website. It has been online since 2018 and has analyzed over 10 million pages.

The service is designed for:
- **Web Developers**: Inspect HTML structure, debug rendering issues, compare implementations
- **SEO Specialists**: Audit meta tags, Open Graph, structured data, heading hierarchy, link structure
- **Security Researchers**: Check security headers, HTTPS implementation, CSP policies, mixed content
- **Web Designers**: Study layouts, CSS approaches, and front-end techniques used by other sites
- **Students & Educators**: Learn HTML structure by examining real-world websites
- **Mobile Users**: View source code on devices that don't natively support it (primary use case)

**URL**: [https://www.view-page-source.com/](https://www.view-page-source.com/)

---

## Tools & Features

The service ships six tools, each available in all 12 supported languages:

- [View Page Source](https://www.view-page-source.com/): View and analyze any website's HTML source code (homepage)
- [HTML Viewer](https://www.view-page-source.com/html-viewer/): View and format any web page's HTML source with syntax highlighting
- [View Page Source on Mobile](https://www.view-page-source.com/view-source-phone/): View a web page's HTML source on iPhone or Android - no app needed
- [HTML Text Extractor](https://www.view-page-source.com/html-extractor/): Extract plain text content from any webpage
- [Download Website Code](https://www.view-page-source.com/download-website-code/): Download a website's source code as a file
- [SEO Checker](https://www.view-page-source.com/seo-checker/): Audit a URL's on-page SEO (meta tags, Open Graph, structured data, headings)
- [HTTP Headers Check](https://www.view-page-source.com/headers-check/): Security-header report card with an A–F grade
- [Social Preview](https://www.view-page-source.com/social-preview/): Preview Open Graph / Twitter Card link appearance

### 1. View Page Source (Homepage)

**URL**: [https://www.view-page-source.com/](https://www.view-page-source.com/)

The primary tool. Enter any URL to:
- View the complete HTML source code with Prism.js syntax highlighting
- Toggle word wrap on/off for readability
- Copy source code to clipboard
- Download source code as an HTML file
- See performance timing breakdown (DNS, TCP, TLS, TTFB, download)
- View server information (software, HTTP version, status code)
- View page information (size, word count, line count, tag count, generator)
- Run Smart Analysis (SEO, social, structured data, links, resources, security)
- Run Technology Detection (100+ technologies identified)

**Options**:
- **Syntax Highlighting**: On by default. Uses Prism.js to color-code HTML/XML markup.
- **Word Wrap**: On by default. Wraps long lines for easier reading.

### 2. HTML Text Extractor

**URL**: [https://www.view-page-source.com/html-extractor/](https://www.view-page-source.com/html-extractor/)

Extracts plain text content from any webpage by:
- Fetching the HTML source code
- Stripping all HTML tags, scripts, styles, SVGs, iframes
- Cleaning whitespace and blank lines
- Displaying source code (left) alongside extracted text (right)
- Showing text statistics: word count, character count, line count, sentence count

**Localized versions**: Available in all 12 supported languages.

### 3. Download Website Code

**URL**: [https://www.view-page-source.com/download-website-code/](https://www.view-page-source.com/download-website-code/)

Downloads a website's source code as a local file:
- Fetches HTML source code
- Shows file metadata (size, line count, URL)
- One-click download as .html file
- Copy to clipboard option

**Localized versions**: Available in all 12 supported languages.

### 4. SEO Checker

**URL**: [https://www.view-page-source.com/seo-checker/](https://www.view-page-source.com/seo-checker/)

Audits a URL's on-page SEO and returns a scored report:
- Title, meta description, canonical, robots, viewport checks
- Open Graph and Twitter Card coverage
- Structured data (JSON-LD) and heading hierarchy
- Comparison against sibling pages on the same site
- Shareable read-only report link with a selectable expiry

### 5. HTTP Headers Check

**URL**: [https://www.view-page-source.com/headers-check/](https://www.view-page-source.com/headers-check/)

Grades a site's HTTP security headers (A–F report card):
- Strict-Transport-Security, Content-Security-Policy, X-Frame-Options
- X-Content-Type-Options, Referrer-Policy, Permissions-Policy
- Cross-checks and actionable remediation notes
- Shareable read-only report link with a selectable expiry

### 6. Social Preview

**URL**: [https://www.view-page-source.com/social-preview/](https://www.view-page-source.com/social-preview/)

Previews how a URL appears when shared on social platforms:
- Open Graph and Twitter Card tag inspection
- Rendered preview cards with image probing
- Warnings for missing or malformed tags


### 7. HTML Viewer

**URL**: [https://www.view-page-source.com/html-viewer/](https://www.view-page-source.com/html-viewer/)

A focused viewer that fetches and formats any web page's HTML source:
- Fetches the raw, server-rendered HTML (before JavaScript runs)
- Pretty-prints and syntax-highlights the markup with Prism.js
- Word-wrap toggle, copy to clipboard, and download as .html
- Shows page, server, and performance info (no Smart Analysis / Technology Detection)
- Works on any device, including mobile

**Localized versions**: English only.

### 8. View Page Source on Mobile

**URL**: [https://www.view-page-source.com/view-source-phone/](https://www.view-page-source.com/view-source-phone/)

Viewing a page's HTML source from a phone, with the tool inline:
- Formatted, syntax-highlighted source that works on iPhone and Android
- Step-by-step methods for iPhone Safari (no native view-source) and Chrome for Android (view-source:)
- No app or computer required
- Copy and download the HTML on-device

**Localized versions**: English only.
---

## API Reference

The API is a JSON-based REST API served from the same domain. All endpoints are under `/api/`.

### Authentication

Requests to `/api/fetch` require a time-based HMAC-SHA256 token. Tokens are valid for 5 minutes and are tied to the client's IP address.

#### Get Token

```
GET /api/token
```

**Response** (200 OK):
```json
{
  "token": "a1b2c3d4e5f6..."
}
```

### Fetch Source Code

```
POST /api/fetch
Content-Type: application/json
```

**Request Body**:
```json
{
  "url": "example.com",
  "token": "a1b2c3d4e5f6...",
  "stylize": true
}
```

| Field    | Type    | Required | Description |
|----------|---------|----------|-------------|
| url      | string  | Yes      | URL to fetch. `https://` is prepended if no scheme is provided. |
| token    | string  | Yes      | HMAC token from `/api/token`. |
| stylize  | boolean | No       | If true, HTML is prettified/indented. Default: false. |

**Response** (200 OK):
```json
{
  "html": "<!DOCTYPE html>...",
  "metrics": {
    "totalTime": 0.523,
    "dnsLookup": 0.042,
    "tcpConnection": 0.089,
    "tlsHandshake": 0.112,
    "serverWait": 0.198,
    "contentTransfer": 0.082
  },
  "serverInfo": {
    "server": "nginx",
    "httpVersion": "HTTP/2.0",
    "httpCode": 200,
    "method": "GET",
    "scheme": "https"
  },
  "pageInfo": {
    "totalSize": "45.2 KB",
    "totalChars": 46285,
    "totalWords": 3420,
    "totalLines": 890,
    "tagCount": 245,
    "generators": "WordPress 6.4"
  },
  "cacheHit": false,
  "executionTime": 534.2
}
```

**Timing values** in `metrics` are in seconds. `executionTime` is in milliseconds and includes all server-side processing.

**Error Response** (4xx/5xx):
```json
{
  "error": "Description of the error"
}
```

### Health Check

```
GET /api/health
```

Returns the health status of the application and cache connectivity.

---

## Smart Analysis

When source code is fetched on the main page, the client-side Smart Analysis engine parses the HTML and reports on 8 categories:

### 1. SEO Meta Tags
- Title tag (presence, length, content)
- Meta description (presence, length, content)
- Meta robots directives
- Canonical URL
- Viewport meta tag

### 2. Open Graph & Social
- og:title, og:description, og:image, og:url, og:type, og:locale
- Twitter Card tags (twitter:card, twitter:title, twitter:description, twitter:image)
- OG image preview with dimensions

### 3. Structured Data
- JSON-LD blocks (parsed and displayed)
- Schema.org types detected
- Microdata detection

### 4. Internationalization
- hreflang tags (all language/region variants)
- HTML lang attribute
- Content-Language headers

### 5. Link Analysis
- Total internal vs. external links
- Links with/without rel="nofollow"
- External domain breakdown with counts
- Anchor text analysis

### 6. Resources
- Total scripts, stylesheets, images, fonts, iframes
- External vs. inline resources
- Resource counts by type

### 7. Document Structure
- Heading hierarchy (H1-H6) with nesting visualization
- Heading count by level
- Missing heading level warnings

### 8. Security Indicators
- HTTPS vs HTTP
- Content Security Policy
- X-Frame-Options
- X-Content-Type-Options
- Strict-Transport-Security
- Referrer-Policy
- Permissions-Policy

---

## Technology Detection

The client-side Technology Detection engine identifies 100+ technologies across these categories:

- **CMS & Website Builders**: WordPress, Shopify, Wix, Squarespace, Drupal, Joomla, Ghost, Webflow, Hugo, Jekyll, etc.
- **JavaScript Frameworks**: React, Vue.js, Angular, Next.js, Nuxt.js, Svelte, jQuery, Alpine.js, etc.
- **CSS Frameworks**: Tailwind CSS, Bootstrap, Bulma, Foundation, Material UI, etc.
- **Analytics & Marketing**: Google Analytics, Google Tag Manager, Facebook Pixel, Hotjar, Mixpanel, Segment, etc.
- **Advertising**: Google AdSense, Google Ad Manager, Amazon Ads, etc.
- **CDN & Hosting**: Cloudflare, AWS CloudFront, Fastly, Vercel, Netlify, etc.
- **Payment Systems**: Stripe, PayPal, Square, Klarna, etc.
- **Fonts**: Google Fonts, Adobe Fonts, Font Awesome, etc.
- **Security**: reCAPTCHA, hCaptcha, Cloudflare Bot Management, etc.
- **Performance**: Lazy loading libraries, image optimization, etc.
- **SEO Tools**: Yoast SEO, Rank Math, All in One SEO, etc.
- **Chat & Support**: Intercom, Zendesk, Drift, LiveChat, Crisp, etc.
- **Email Marketing**: Mailchimp, Klaviyo, ConvertKit, etc.
- **Social**: Open Graph, Twitter Cards, social share buttons

Each detected technology shows:
- Name and icon
- Version (when detectable)
- Confidence level (definite, likely, possible, implied)
- Evidence (the HTML/header patterns that triggered detection)
- Category classification
- Link to technology website

---

## Architecture

### Current Stack (v2.0)

| Component     | Technology                       |
|---------------|----------------------------------|
| Backend       | Go 1.21+ with Fiber framework    |
| Web Server    | Nginx (reverse proxy)            |
| Caching       | Redis or Memcached (configurable)|
| Frontend      | Vanilla JavaScript, HTML5, CSS3  |
| Highlighting  | Prism.js (loaded from CDN)       |
| Fonts         | Google Fonts (JetBrains Mono, Plus Jakarta Sans) |

### Request Flow

```
User Browser → Nginx (port 443, SSL termination)
  ├─ Static files: served directly by Nginx
  └─ /api/* routes: proxied to Go app (port 8080)
       ├─ Rate limiting (per-IP, token bucket)
       ├─ Token validation (HMAC-SHA256, 5-min window)
       ├─ URL validation (scheme, domain blocklist, SSRF protection)
       ├─ Cache check (Redis/Memcached)
       ├─ HTTP fetch (with IP pinning to prevent DNS rebinding)
       ├─ HTML analysis (page info, generator detection)
       ├─ Optional prettification (HTML Tidy equivalent)
       └─ Response with metrics
```

### Security Measures

- **SSRF Protection**: DNS resolution with private IP range blocking (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, IPv6 loopback/ULA/link-local)
- **DNS Rebinding Prevention**: IP pinning — DNS is resolved during validation and the resolved IP is used for the actual HTTP connection
- **Token Authentication**: HMAC-SHA256 tokens tied to client IP, rotating every 5 minutes
- **Rate Limiting**: 10 requests per minute per IP (configurable)
- **Domain Blocklist**: Known abusive or inappropriate domains are blocked
- **IP Blocklist**: Known abusive IP addresses are blocked
- **Content Size Limit**: Maximum 2 MB response body
- **Request Size Limit**: Maximum 1 MB request body
- **Timeout**: 10-second fetch timeout
- **CORS**: Restricted to allowed origins
- **Redirect Limit**: Maximum 10 redirects followed
- **Content-Type Validation**: Only text/html, text/plain, application/xhtml+xml, application/xml accepted

### Limitations

- Only publicly accessible URLs can be fetched (no authentication passthrough)
- Only text/HTML content is supported (no PDFs, images, etc.)
- Maximum response size: 2 MB
- Fetch timeout: 10 seconds
- Rate limit: 10 requests per minute per IP
- Some domains are blocked for safety/legal reasons
- JavaScript-rendered content is NOT fetched (server-side HTML only)
- Redirects are followed (up to 10), but the final URL's content is returned

---

## Internationalization

The service is available in 12 languages:

| Language    | URL Path | Homepage | HTML Extractor | Download Code |
|-------------|----------|----------|----------------|---------------|
| English     | `/`      | Yes      | `/html-extractor/` | `/download-website-code/` |
| German      | `/de/`   | Yes      | `/de/html-extraktor/` | `/de/website-code-herunterladen/` |
| Spanish     | `/es/`   | Yes      | `/es/extractor-de-html/` | `/es/descargar-codigo-web/` |
| French      | `/fr/`   | Yes      | `/fr/extracteur-html/` | `/fr/telecharger-code-source-web/` |
| Indonesian  | `/id/`   | Yes      | `/id/ekstraktor-html/` | `/id/unduh-kode-sumber-website/` |
| Italian     | `/it/`   | Yes      | `/it/estrattore-html/` | `/it/scarica-codice-sito-web/` |
| Japanese    | `/ja/`   | Yes      | `/ja/html-extractor/` | `/ja/website-code-download/` |
| Dutch       | `/nl/`   | Yes      | `/nl/html-extractor/` | `/nl/website-code-downloaden/` |
| Polish      | `/pl/`   | Yes      | `/pl/ekstraktor-html/` | `/pl/pobierz-kod-strony-www/` |
| Portuguese  | `/pt/`   | Yes      | `/pt/extrator-de-html/` | `/pt/baixar-codigo-do-site/` |
| Turkish     | `/tr/`   | Yes      | `/tr/html-ayiklayici/` | `/tr/web-sitesi-kodunu-indir/` |
| Arabic (RTL)| `/ar/`   | Yes      | `/ar/html-extractor/` | `/ar/download-website-code/` |

The SEO Checker (`/seo-checker/`), HTTP Headers Check (`/headers-check/`), and Social Preview (`/social-preview/`) tools are also localized across all 12 languages.

Arabic is right-to-left (`<html lang="ar" dir="rtl">`) and uses English URL slugs under `/ar/`. All localized pages use proper `hreflang` tags with `x-default` pointing to the English version.

---

## Browser Extensions

Browser extensions are available that add a "View Source" option to the browser context menu, opening the current page's source in View Page Source.

### Chrome Extension
- Adds right-click context menu "View Page Source"
- Opens current tab URL in view-page-source.com with autorun
- Minimal permissions: activeTab, contextMenus

### Firefox Extension
- Same functionality as Chrome
- Uses WebExtension APIs

### Opera Extension
- Same functionality as Chrome (Chromium-based)

**Extension URL pattern**: `https://www.view-page-source.com/?url={encoded_url}&autorun=true`

Autorun is only permitted from trusted referrers (same origin or recognized browser extension origins) as a security measure.

---

## Blog & Content Index

The [blog](https://www.view-page-source.com/posts/) contains educational articles:

### Articles

- [All HTML5 Supported Tags: Complete Reference Guide](https://www.view-page-source.com/all-html-tags/): Complete list of all HTML5 tags with descriptions, grouped by category
- [New Features to Empower Your Web Exploration](https://www.view-page-source.com/code-viewer-new-features/): Changelog and feature announcements for the tool
- [Improving SEO Through Your Source Code](https://www.view-page-source.com/improving-seo-via-code/): Guide to optimizing HTML source for better search engine rankings
- [Top 10 Source Code Editors for Web Development](https://www.view-page-source.com/top-code-editors-web-dev/): Comparison of code editors and IDEs
- [How To View HTML Source in Different Browsers](https://www.view-page-source.com/howto-see-html-code-different-browsers/): Browser-by-browser guide to viewing source natively
- [How To Hide The Source Code Of A Website](https://www.view-page-source.com/howto-hide-website-source-code/): Techniques for source code obfuscation and protection
- [How to Read Source Code: A Beginner's Guide](https://www.view-page-source.com/how-to-read-source-code/): Tutorial for understanding HTML source code

---

## Privacy & Data Handling

### What We Collect

| Data Type         | Retention  | Purpose                          |
|-------------------|------------|----------------------------------|
| URLs entered      | 2 hours    | Cached for performance           |
| IP addresses      | 7 days     | Rate limiting and security logs  |
| Browser info      | Aggregated | Compatibility analysis           |
| Timestamps        | 30 days    | Service monitoring               |

### What We Do NOT Collect
- No user accounts or registration
- No personal information beyond what's listed above
- No permanent storage of fetched HTML content
- No tracking without cookie consent

### Cookie Consent

Analytics and marketing cookies are only loaded after explicit user consent via a cookie consent banner. Users can:
- Accept all cookies
- Reject all cookies
- Customize preferences (necessary, analytics, marketing, functional)
- Manage preferences at any time via "Manage Cookies" in the footer

### Cookie Categories

1. **Strictly Necessary**: Essential for site function (always enabled)
2. **Analytics**: Google Analytics with anonymized IP (requires consent)
3. **Marketing**: Ad-related cookies (requires consent)
4. **Functional**: Preferences like theme selection (requires consent)

### Third-Party Services

- **Google Analytics** (G-8RCQ4JFZ27): Anonymous usage statistics, loaded only after analytics consent
- **Google AdSense**: Advertisement delivery
- **Ahrefs Analytics**: Site analytics, loaded only after analytics consent
- **Google Fonts**: Font delivery (preconnected)
- **Cloudflare cdnjs**: Prism.js syntax highlighter delivery

### Compliance

- GDPR compliant for EU users
- CCPA compliant for California residents
- Children's privacy protection (13+ only)

### Data Sharing

- Never sold, traded, or rented to third parties
- Only shared when legally required or with explicit consent

### Security Contact

- Email: security@view-page-source.com
- [Security policy](https://www.view-page-source.com/security-policy/)
- [security.txt](https://www.view-page-source.com/.well-known/security.txt)

---

## Usage Guidelines

### Acceptable Use
- Educational purposes and learning web development
- SEO analysis and optimization research
- Security auditing of your own websites
- Web design inspiration and research
- Debugging and troubleshooting web pages
- Checking website compliance and standards
- Competitive analysis of publicly visible source code

### Restrictions
- Do not use for scraping copyrighted content
- Do not attempt to bypass authentication on target sites
- Do not use for malicious purposes (phishing, scraping PII, etc.)
- Do not make excessive requests (rate limits apply)
- Respect robots.txt and website terms of service of target sites
- Do not attempt to access internal/private networks via the tool

### Browser Alternatives

Most desktop browsers have built-in source viewing:
- **Chrome/Edge**: Ctrl+U (Windows/Linux) or Cmd+Option+U (Mac)
- **Firefox**: Ctrl+U (Windows/Linux) or Cmd+U (Mac)
- **Safari**: Develop menu > Show Page Source (must enable Developer menu first)
- **Mobile browsers**: Limited or no built-in support (this is the primary use case for View Page Source)

---

## Error Reference

| Error Message | HTTP Code | Cause | Resolution |
|---------------|-----------|-------|------------|
| Invalid request format | 400 | Malformed JSON body | Check request Content-Type and JSON structure |
| Invalid token | 403 | Expired or incorrect HMAC token | Fetch a fresh token from `/api/token` |
| invalid URL format | 400 | URL cannot be parsed | Provide a valid URL |
| only http and https schemes are allowed | 400 | Non-HTTP scheme (ftp, etc.) | Use http:// or https:// |
| domain is blocked | 400 | Domain is on the blocklist | This domain cannot be fetched |
| IP address is blocked | 400 | Resolved IP is on the blocklist | This IP cannot be reached |
| private IP ranges are not allowed | 400 | URL resolves to private/internal IP | Cannot fetch internal network addresses |
| DNS lookup failed | 400 | Hostname doesn't resolve | Check the domain name |
| Rate limit exceeded | 429 | Too many requests from this IP | Wait and retry (limit: 10/minute) |
| Failed to fetch URL | 500 | Connection error, timeout, or target server error | Check URL accessibility, try again |
| content type ... is not allowed | 500 | Non-HTML content type | Only text/HTML pages are supported |
| received status code NNN | 500 | Target server returned 4xx/5xx | The target website returned an error |

---

## FAQ

**Q: Does View Page Source execute JavaScript on the fetched page?**
A: No. Only the raw HTML returned by the server is fetched and displayed. JavaScript-rendered content (SPAs, client-side routing) will not appear.

**Q: Can I view source code of pages behind login/authentication?**
A: No. The tool fetches pages as an anonymous HTTP client. Pages requiring authentication will show login pages or error messages.

**Q: How fresh is the source code?**
A: Results are cached for 2 hours. The first request fetches live content; subsequent requests for the same URL within 2 hours return the cached version.

**Q: Is there a bulk/batch API?**
A: No. The API is designed for single URL fetches with rate limiting (10 requests/minute per IP).

**Q: Why can't I fetch localhost or internal IPs?**
A: SSRF protection prevents fetching private IP ranges (10.x, 172.16.x, 192.168.x, 127.x, etc.) to protect internal networks.

**Q: What is the maximum page size?**
A: 2 MB. Pages larger than this will be truncated.

**Q: Does the tool follow redirects?**
A: Yes, up to 10 redirects. The final destination's HTML is returned.

**Q: Can I use this tool programmatically?**
A: The API requires a token from `/api/token` tied to your IP, and is rate limited. It's designed for interactive use, not high-volume scraping.

---

## Terms of Service

Users must comply with all applicable laws and respect intellectual property rights. The service is provided "as-is" without warranties. Users are responsible for ensuring they have permission to access and view source code of websites they query. Excessive or abusive use may result in IP blocking.

---

## Last Updated

June 2026

---

*This file provides comprehensive documentation for AI assistants. For the concise version, see [llms.txt](https://www.view-page-source.com/llms.txt). For the most current information, visit [view-page-source.com](https://www.view-page-source.com/).*