HTTPS web form DLP test (POST)
Accepted files
For DLP this is a standard control channel. Someone fills a form and clicks Submit — the data leaves in the body of an HTTPS request. Your DLP should catch that request (endpoint agent or centralized proxy). Paste sample data from the panel on the right or from Sample data, then submit. Click Refresh — you should see your text under Accepted files. If you see it, the request reached us. If you do not, your DLP or another security control blocked it.
curl
curl -sS -X POST https://dlpbench.com/api/upload/online-form/ -F "subject=Hello world - DLP smoke test" -F "message=Hello world, I love DLP. This is my powerful smoke test of the DLP system: a short story with ordinary words and no identifiers. If this request arrives, the path is open." # Plain text with no identifiers: the request should arrive. If it fails, check the network or an overly strict policy.
curl -sS -X POST https://dlpbench.com/api/upload/online-form/ -F "subject=Staff export" -F "message=SSN 478-21-3344, card 4111111111111111" # Test SSN and card: with DLP configured the request should not leave. If you get ok — the channel was not stopped.
curl -sS -X POST https://dlpbench.com/api/http-post/ -H "Content-Type: application/json" -d "{\"message\":\"Hello world, I love DLP. This is my powerful smoke test of the DLP system: a short story with ordinary words and no identifiers. If this request arrives, the path is open.\"}"
# Plain text with no identifiers: the request should arrive. If it fails, check the network or an overly strict policy.
curl -sS -X POST https://dlpbench.com/api/http-post/ -H "Content-Type: application/json" -d "{\"ssn\":\"478-21-3344\",\"card\":\"4111111111111111\"}"
# Test SSN and card: with DLP configured the request should not leave. If you get ok — the channel was not stopped.
FAQ
How does the web form test differ from a file upload test?
This path sends only the Subject and Message fields — no file — like a contact form or a chat message. The HTML5 and jQuery tabs next to it test file upload.
Do I need HTTPS decryption for the policy to fire?
All requests go to the HTTPS version of this site. Without TLS/SSL decryption, an agent on the workstation will not see the payload.
Where do I get data for the tests?
Use the panel on the right or Sample data — ready examples with names, SSNs, cards, and markers. For your own repeatable sets, open the generator.
How do I test the web channel through a proxy?
You need all three at once: (1) the test workstation browser really goes through the proxy; (2) the proxy hands PUT/POST bodies to DLP — often via ICAP, sometimes via a vendor protocol; (3) HTTPS inspection is on for the right site categories, and dlpbench.com is not excluded.
Enable a rule on SSN/IBAN/card and submit through this form. Start in monitor mode, then block — same payload. That validates a proxy + web DLP path. If control sits in a cloud gateway (SSE), see the next question.
How do I test the web channel through a cloud gateway?
Station traffic must enter your path (agent, PAC, tunnel). Rule on synthetic personal data → submit via this online form or POST to /api/http-post/ → event in the gateway console. Repeat off the corporate network; otherwise you only prove the office path.
Also check domain inspection exceptions and QUIC/HTTP3 bypass — those often keep the channel quiet while the policy looks green.
Submissions stay on this page for one hour and are visible only to you. Beyond submit and block tests, check file upload interception too — we have HTML5 and jQuery upload tests. Repeat this POST intercept check after every DLP upgrade or policy change.
Keep testing exfil channels
Check how DLP sees a file upload, or try another sample set.