Asserts that the rendered HTML response of the current page does not contain a given piece of text. The step reads the text content of the whole <html> element, so it also inspects text that never appears visually: content inside <head>, <noscript> fallbacks, or hidden regions of the markup. This makes it a good guard against leftover debug strings, error messages, or restricted content leaking into the page source.
The single parameter is the text that must be absent, and matching is a plain case-sensitive substring check. The step fails if the text is found anywhere in the response. The positive counterpart is Then the response should contain "...".
Accepted phrasings
Then the response should not contain "text"
Then response should not contain "text"Examples
Then the response should not contain "Access denied"
And the response should not contain "TODO"
Then response should not contain "Fatal error"
And the response should not contain "lorem ipsum"In a real scenario
Feature: No restricted or placeholder content leaks to visitors
Scenario: Anonymous visitors never see internal notes in the source
When I go to "https://example.org/news"
And wait 2s
Then I should see "Latest news"
And the response should contain "<title>Latest news</title>"
And the response should not contain "TODO"
And the response should not contain "Access denied"