How to check if a blank page has hidden text in its source code

A blank-looking browser page is not proof that the response contains nothing. It may be a JavaScript gate, a failed redirect, a bot check, or a page whose styling hides every element. A page offering only “Click here to proceed” and an obfuscated link parameter deserves inspection before you follow it. The wording alone does not establish fraud, but it provides little useful context and no obvious destination. Learn more about How Many Days Until New Year S Day 2030 Checklist.

Knowing how to check if a blank page has hidden text in its source code means comparing three layers: what the browser displays, the HTML returned by the server, and the DOM created after scripts run. A quick visual check cannot reveal all three. Working through these layers in order can identify harmless broken markup, concealed navigation, or content aimed at search engines rather than visitors.

Treat the result as evidence, not a verdict. Comments and unused templates are common, and even a legitimate Australian business can publish a broken page. The useful questions are what the concealed material does, who appears to benefit from it, and whether the destination is consistent with the service you expected. Keep the suspicious link separate from your accounts and personal details while you check.

Start with what the browser actually displays

First, record the exact address, the time you received it and where you found it. If the page contains only a generic link, do not follow that link yet. Take a screenshot so you can compare later behaviour, and note whether the address uses a shortened URL, embedded tracking parameters or an unusual redirect domain. This information may be more revealing than the empty page itself.

Refresh the page and give scripts time to load. Then compare a desktop browser with a phone, since many Australians use Chrome or Edge on Windows and Android, while Safari on iPhone is also common. A page that looks blank on a computer may be displaying content only at a particular viewport, or it may fail because of a mobile-only error. Testing both prevents you from mistaking a responsive layout problem for deliberate concealment.

The domain provides useful context, but it cannot provide certainty. Australian businesses often use .com.au addresses, while the .au market has its own eligibility requirements and registration restrictions. A familiar domain is not proof that a particular page is safe. Weigh the visible domain alongside opinion and trust signals rather than treating any single clue as decisive.

Read the raw source without running it

Most desktop browsers can display the source received from the server. Press Ctrl+U on Windows or Linux, or Cmd+Option+U on macOS, and choose “View Page Source” from the browser menu if necessary. In Chrome, Edge and Firefox, this normally opens a separate source tab. You can inspect the markup without clicking the suspicious navigation.

Begin with the major HTML regions: head, body, script, style and iframe. Use the browser’s find function to search for the business name, expected service name, cities, email addresses and words such as “click”, “continue”, “login” or “account”. Search without assuming that the missing text will appear near the visible part of the page. It may be tucked inside a script, an attribute or a conditional block.

Do not execute code copied from an unknown page. Saving a page is different from running it, but opening downloaded HTML may activate embedded scripts, and instructions embedded in the source should never be treated as commands. If the page was sent through a workplace network in Canberra, a university library or a shared device, avoid signing in or entering information while investigating it.

Search for hidden words and dynamically inserted content

Raw source and rendered content are not always the same. JavaScript can insert a warning, countdown or destination after the page loads, meaning that nothing useful appears in the original HTML. Look for references to innerHTML, textContent, document.write, appendChild and functions that change an element’s style attribute. You do not need to understand every script; you only need to identify where visible text is being created.

A New Year countdown guide is a useful example of the kind of page where scripts may calculate and insert text. Date calculations also illustrate why Australian users should check the time zone. Sydney, Perth and Adelaide observe different offsets, so a countdown that appears correct elsewhere may display an unexpected value or date depending on the script’s settings.

Use two separate searches. Search the rendered page for words you expect to see, then search the source tab for the same terms and inspect whether the matches sit inside comments, noscript elements or JavaScript strings. If needed, copy the source into a plain-text editor on your own computer and use its search tools. A find operation returning zero results does not prove that the response is empty because dynamically generated content will not be present in the initial file.

Inspect the rendered page in developer tools

Open the browser’s developer tools with F12 or Ctrl+Shift+I; macOS users can generally use Cmd+Option+I. Select “Elements” or “Inspector”, then expand the html and body elements in the DOM tree. This shows the current document after JavaScript has had an opportunity to modify it. Text can therefore be visible in the element tree even when the browser canvas appears completely blank.

In the styles or computed panel, look for common concealment techniques. These include display: none, visibility: hidden, zero opacity, text matching the background colour, zero-sized containers and content positioned thousands of pixels outside the viewport. A collapsed menu, an inactive tab panel and an off-canvas mobile menu may use similar techniques for legitimate purposes. Diagnostic resources such as developer testing notes can provide a useful second reference while comparing markup with behaviour.

Check frames and network responses as well. Select each iframe in the elements panel and inspect its document separately. Under the “Network” tab, look for HTML, JSON or script files that contain the missing wording. The device-emulation controls can also reproduce an iPhone or Android viewport, helping determine whether the blank display is connected to responsive styling rather than hidden content.

Separate ordinary markup from deceptive concealment

Not every item that does not appear on screen is suspicious. HTML comments can contain build notes, template markers or disabled content. Metadata may include a description intended for search results, and aria-hidden text can relate to accessibility behaviour. Collapsed panels and inactive tab content remain part of normal page construction. Their presence alone does not indicate manipulation or an attack.

More concern arises when concealed text contains unrelated keywords, city names, links or instructions that visitors cannot see. Hidden keyword blocks can be designed to influence search rankings, while scripts may replace a legitimate offer with another destination depending on the visitor. Also examine anchors for suspicious href values and scripts for encoded strings, eval, atob or embedded remote documents. Do not paste suspicious code into an online decoder or run it in a terminal merely to see what it produces.

Source code can also expose information that should remain private, including internal addresses, analytics identifiers and unfinished API endpoints. Australian privacy obligations vary between the federal Privacy Act and state or territory laws, so do not assume every organisation follows the same rules. Avoid republishing an entire source file when a short excerpt or screenshot would suffice, especially if it contains access tokens or personal information.

Run the check and make a safe decision

Put the findings together before proceeding. Source-only text may be a harmless comment; styled-away text may be an inactive interface component; script-created text may explain why the page looked empty. Record whether the concealed content describes the expected service, introduces another company or attempts to trigger a download. Apply the same evidence-based approach to the domain itself: the domain history guide explains how age, registration history and visible ownership can support or weaken confidence without proving either safety or fraud.

If the page belongs to a business you already know, contact that organisation through details obtained independently rather than through the blank page. If the link appears fraudulent, do not enter passwords, card details, identity documents or tax information. Australians can report suspected scams to Scamwatch, while an organisation’s security or IT team can investigate a compromised business page. If credentials have already been entered, change the affected password and review account activity promptly.

Have a squiz now: open the questionable address in a private window, inspect it rather than following its link, and record the source, DOM and redirect destination. Close the tab and report it through the appropriate channel if the page remains generic, redirects unexpectedly or asks for sensitive information. A couple of minutes of checking can prevent a vague technical trick from becoming a costly security problem.