What this HTML preview protects against
The preview iframe has no allow-same-origin permission. By default it also has no script permission. A restrictive Content Security Policy blocks network requests, external images, frames, objects, form submission and base-URL changes. If you explicitly enable scripts, only inline scripts can run in the origin-isolated frame; connections remain blocked.
This is safer than opening unknown HTML directly, but it is not a security guarantee. Never preview a file with browser or operating-system privileges you do not intend to grant, and sanitize untrusted HTML before inserting it into a real application.
Checks included
- Document title, language, meta description and H1 structure.
- Images missing useful alternative text.
- JavaScript blocks, inline event-handler attributes and embedded frames or objects.
javascript:and HTML-bearingdata:URLs.- External scripts, stylesheets, media and other network-dependent resources.
How to use it with AI-generated HTML
- Ask the coding agent for one self-contained HTML document.
- Paste the result here with scripts disabled.
- Review the static findings and visual output.
- Enable scripts only when you understand the code and need to test interaction.
- Download the reviewed file and keep it under version control.
FAQ
Is the HTML sent to EasyTool?
No. The source is parsed and rendered in your current browser tab. It is not saved by this tool or uploaded to EasyTool.
Why are external fonts and images missing?
The preview deliberately blocks network resources. Use embedded CSS and data or blob URLs when you need a self-contained artifact.
Does a green result mean the page is secure?
No. These are selected static checks. The tool does not prove that business logic, dependencies or generated JavaScript are safe.