HTML Comments: Internal Details Left in the Page
HTML comments are invisible on the page but fully visible in the source, which anyone can open with “View source”. Developers use them for notes, for switching off a block of markup, or to record where a template came from. Over time, some of those notes contain things that should never be public.
Typical examples:
<!-- staging API: http://10.0.3.17:8080/api -->
<!-- TODO: move to db01.corp before launch -->
<!-- test login: admin / password=Summer2026! -->
<!-- rendered by app-node-3.internal -->
Why it matters
- Private IP addresses and internal host names map your internal network for an attacker: which systems exist, how they are named, which ports they use. On their own they are not an open door, but they make server-side request forgery and other attacks easier to aim.
- Credentials and keys, even “test” ones, are often still valid, or reused elsewhere.
- Disabled features. Commented-out links and forms can point at admin pages, old endpoints or unfinished features that are still deployed.
Search engines and archive services store the full source, so a comment can stay findable long after you remove it.
How to fix
Remove what is there. Search your templates and content for <!-- and delete anything that
does not need to reach the browser. If a credential appeared in a comment, change it: assume it
has been seen.
Use server-side comments for notes. Template languages have comment syntax that is stripped before the page is sent:
{# Twig: never sent to the browser #}
<?php /* PHP: never sent to the browser */ ?>
{{-- Blade (Laravel): never sent to the browser --}}
<%-- JSP: never sent to the browser --%>
In React and similar frameworks, JSX comments ({/* ... */}) are not rendered.
Strip comments in the build. HTML minifiers can remove comments from the output, for example
the removeComments option of html-minifier-terser. Many frameworks and static site generators
remove them in production builds or have an option to.
WordPress. Plugins (caching, SEO, page builders) often add their own HTML comments, such as “cached by” notes with timestamps. These are mostly harmless, but some include server names or paths. Most caching plugins have a setting to drop footer comments, and page-level HTML minification in caching or optimisation plugins removes the rest.
Never put credentials in markup at all, commented or not. Test accounts belong in a password manager; configuration belongs on the server.
How PerfoMetrix checks this
We read the HTML comments in the page we already downloaded. We send no extra requests to your
site. Legacy conditional comments for old Internet Explorer (<!--[if IE]>) are ignored.
A comment is flagged when it contains:
- a private IPv4 address (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16);
- an internal host name ending in
.local,.internal,.corp,.lanor.intranet; - a credential-like note: words such as
password,passwd,pwd,api_key,secret,tokenorcredentialsfollowed by:or=.
Any finding means the check needs attention. The report lists the kind of finding and, for IP addresses, the address; it never repeats a credential. We check only the scanned page, and only comments in the HTML itself, not in external scripts or stylesheets.
Further reading: OWASP Web Security Testing Guide: review webpage content for information leakage.