Direct answer: the 25 homepages carry 900 HTML comments and 29.1 KB, a median of 20 per site and a maximum of 110. Seven sites have an e-mail address in eight comments, one site has local paths or private hosts in four, two sites show CMS signatures in five, and 15 sites keep 160 blocks of commented-out HTML; 15 comments exceed 300 characters on seven sites, while TODO/FIXME and version strings are zero. Only counts are published, never comment bodies, addresses or paths.
Comments are invisible to visitors but are delivered with the source to every visitor, and are often read by scrapers and manual reviewers.
Method: extracting and classifying every HTML comment
On 2026-11-09 between 02:40 and 02:41 we requested the same 25 cached-200 homepages and extracted every <!-- … --> block, tagging its content: e-mail, local path or private host, TODO, author marker, version string, CMS signature, commented-out HTML and long comments (over 300 characters). Only counts are stored; comment bodies are never saved or published.
| Flag | Rule | Boundary |
|---|---|---|
An address of the form name@domain.tld | Deliverability not tested, addresses not published | |
| Local path / private host | Drive paths, /home/, /var/www, localhost, 127.0.0.1, 192.168./10./172.16–31. | Ordinary paths like /about/ excluded |
| Commented-out HTML | A <tag …> inside the comment | Template or stale content not distinguished |
| Long comment | More than 300 characters in one block | Character count approximates size |
Result: comments everywhere, sensitive content on few sites
| Measure | Count | Sites |
|---|---|---|
| HTML comments | 900 | 25 |
| Comment size | 29.1 KB | — |
| Containing an e-mail address | 8 | 7 |
| Containing a local path / private host | 4 | 1 |
| Containing a CMS signature | 5 | 2 |
| Containing an author marker | 1 | 1 |
| Commented-out HTML | 160 | 15 |
| Long comments (over 300 characters) | 15 | 7 |
| TODO / FIXME | 0 | 0 |
| Version strings | 0 | 0 |
The distribution is uneven: nine sites have fewer than 10 comments, three have 10–19, five have 20–49, six have 50–99 and two reach 110. Size is not the same as count — E04 has only seven comments but 5.7 KB, while E08 uses 49 comments for 4.9 KB; E11's 110 comments include four path/host hits and four CMS signatures.
E-mail addresses deserve separate attention: seven sites carry an address in eight comments, mostly contact mailboxes left by templates. Whether they still receive mail, or whether they are personal, cannot be confirmed, so no address is published. Commented-out HTML is more common: 15 sites and 160 blocks, where old prices, links or hidden sections may still sit in the source.
What this means for acceptance
- Strip comments at build time. 900 comments and 29.1 KB; after excluding IE conditional comments, one minifier setting removes the rest.
- Keep mailboxes out of comments. Seven of 25 sites are affected; grep the source for
@and domain patterns before launch and use a form or a role mailbox instead. - Delete commented-out HTML. 160 blocks on 15 sites; stale prices and links in the source add weight and mislead manual reviews.
- Look for staging traces before launch. Local paths or private hosts appear in four comments on one site, a template or configuration leftover that outranks size tuning.
- Put a grep list into acceptance.
<!--,@,localhost,192.168.,C:\,TODO,powered by. See the website development service.
Limits
- HTML comments only: comments inside JS/CSS files require separate resource fetches.
- Regex approximation: e-mail, path and CMS tests are literal; a few false positives or misses are possible.
- No deliverability test: no mail is sent and address existence is not verified; no address or path content is published.
- Single fetch: pages may differ by time, A/B test or login state.
- 25-site pilot: the same equipment-company sample; no industry claim.
Data and reproduction
Anonymised data: equipment-homepage-comments-2026.csv (25 rows × 13 columns: comment count, KB, e-mail/path/TODO/author/version/CMS/markup/long-comment counts and time). The repository keeps docs/research/2026-11-homepage-comments.csv.
Parser: scripts/comment_probe.py; unit tests: scripts/test_content_comment_probe.py (13, offline). Run:
python -m unittest scripts.test_content_comment_probe
Related: the homepage HTML weight composition pilot, the homepage privacy and analytics pilot, and the homepage resource inventory pilot.
Sources and definitions
- Sample: the 25 study-4 homepages that were cached as 200.
- Fetch: 2026-11-09 02:40–02:41 Asia/Shanghai, serial, 0.5 s apart, 15-second timeout.
- Comments: the regex
<!--([\s\S]*?)-->; unclosed comments are not counted. - Flags: e-mail, path/private host, TODO, author, version, CMS, HTML markup and long comments, as defined above.
Frequently asked questions
Is an e-mail address in a comment a vulnerability?
Not a vulnerability, but an information exposure that can be harvested. Seven sites carry addresses in eight comments; we cannot confirm deliverability and do not publish the addresses.
Why count commented-out HTML separately?
Fifteen sites keep HTML markup inside 160 comments, so old prices, links or hidden sections may still sit in the source. They do not change the visuals, but they add weight and can mislead manual reviews.
Does stripping comments break anything?
Normally not. Exclude IE conditional comments (<!--[if) and the rare script template that relies on a comment placeholder; the rest can be removed safely.
Is 29.1 KB of comments a lot?
The share of homepage HTML varies. E04 has only seven comments but 5.7 KB, so count and size must be read separately.
Why not count JS/CSS comments?
This round reads comments in the HTML document only; comments inside scripts and stylesheets require fetching those resources separately and are left for another study.
Can the data be re-checked?
Yes. The public CSV has 25 rows by 13 columns, and scripts/comment_probe.py has 13 offline unit tests.