1. A method performed by data processing apparatus, the method comprising: accessing, by a data processing apparatus, personally identifiable information (PII) type definitions that characterize PII types; identifying, by the data processing apparatus, PII type information included in a sub-portion of content of a web page, the PII type information being information matching at least one PII type definition, the sub-portion of content defined by a predefined text distance relative to a location of the PII type information; identifying, by the data processing apparatus, secondary information included in the content of the web page, the secondary information being information that is predefined as being associated with PII type information, the identifying the secondary information comprising: comparing text within the pre-defined text distance of the sub-portion of content to a plurality of keywords that are defined as being associated with the PII type information; and identifying, within the predefined text distance of the sub-portion of content, text that matches one or more of the keywords as secondary information; determining a risk score from the PII type information and the secondary information; and classifying the web page as a personal information exposure risk if the risk score meets a confidentiality threshold, wherein the personal information exposure risk is indicative of the web page including personally identifiable information.