Text parked off the canvas
Text moved far outside the rendered area by a position offset, an indent or a transform.
How the text is hidden
The parser reads left, right, top, bottom, text-indent and margin-left, and the components of a transform: translate…. Where the absolute resolved distance reaches the parser's off-screen bound the element is marked off-canvas, and the same bound is used for the offsets and for the translate deliberately, so two numbers meaning "far enough away to be gone" cannot drift apart.
Why a model still reads it
The element is in the document, laid out, painted — just somewhere nobody scrolls to. Its text node is indistinguishable from any other to a DOM walker.
What we do about it
reasonFor returns off-canvas, and the rule fires at high with action flag when the run is not claimed by the accessibility idiom and the container clause is satisfied. The bound is OFF_SCREEN_PX, a constant in the HTML parser rather than a rule-pack limit — worth knowing if you are tracking which numbers a pack publish can move. The text is reported and retained; containerVisibility is never.
How often it fires
0.25% of 400 real pages from 400 distinct hosts (Common Crawl) — pages, not documents, measured 2026-08-21.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
Over a million phishing emails padded their HTML with filler text hidden three ways at once — zero font size, a container with zero height and width, and overflow pushed off-screen — so filters reading the markup saw harmless words while the reader saw the lure.
Twenty-two distinct payload techniques found on real malicious sites — zero font size, elements pushed 9,999 pixels off screen, display:none, attribute cloaking and prompts tucked inside SVG — aimed at everything from ad-review evasion to forced transactions. The SVG case reached us as `clean` until engine 0.263.0.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API