Capturing pages (incl. behind a login)

Capture any URL in a real browser, record authenticated flows, and how the credential vault protects secrets.

Letting Harpoon capture for you#

Instead of exporting a capture by hand, Harpoon can drive a real headless Chromium at your URL, record the load, and analyze it in one step. For pages behind a login, record the sign-in flow once in the live recorder, save it as a flow, and Harpoon replays it on demand — and on a schedule via schedules.

Every step of a run records a screenshot — thumbnails appear beside the step list (and on the report's capture card), and clicking one opens it full-size. Failure screenshots show exactly what the browser saw when a step broke.

URL capture is a Patrol-plan feature; authenticated flows and the credential vault are Fleet — see the plan matrix.

What actually gets measured#

A flow records one network log for the whole session — the sign-in page, every hop, and the page you were after. Only the last of those is scored. Harpoon starts measuring at the final page load in the flow, so your score reflects the page you asked about rather than the journey to it: the time you spent signing in isn't charged as load time, and the login page's scripts and trackers aren't counted against your dashboard.

One case can't be worked out automatically: a single-page app that swaps the view without a page load. There is nothing for Harpoon to anchor on, so the whole session would be measured as one page. Press Start measuring in the recorder at the moment the page you want begins to load — or add a START MEASURING step to a saved flow — and everything before it is excluded.

Flows recorded before this existed pick up the new behaviour on their next run. If a trend jumps at that run, it's the change in what's measured, not a change in the site — the run history marks the point where it happened.

The credential vault#

Secrets (passwords, TOTP seeds) are encrypted with AES-256-GCM before they're stored.
They are write-only: used during a replay, but never returned by any API, shown in any UI, or written to any log — you can only overwrite or delete them.
Captures are redacted before storage, and a secret-leak guard scans the capture output so vault values can't end up inside the recording itself.

Why some URLs are refused#

The capture browser runs inside Harpoon's infrastructure, so it refuses to visit anything that isn't the public web: localhost, private-network ranges, link-local addresses, and cloud metadata endpoints. That check runs before navigation and on every hop after it — a redirect, sub-resource, or in-page navigation to an internal address is aborted mid-flight.

Seeing a blocked host error on your own staging URL usually means it resolves to a private IP. Capture it from a network where it has a public address, or export a capture from your browser instead — see exporting a capture.

Containment & limits#

The browser runs as an unprivileged user with Chromium's own sandbox enabled.
Concurrent captures and each browser's memory are both capped, so a burst of runs can't take the service down.
Live recorder sessions time out after 3 minutes idle and 15 minutes total.

The full containment write-up lives in Security & your data.

Still stuck? Contact us or browse all guides.