Is Siteimprove Accessibility Checker safe?
We analyzed Siteimprove Accessibility Checker version 2026.8.10.934's actual code and gave it a 78/100 trust score. This appears to be a legitimate…
Bottom line
This appears to be a legitimate accessibility checker with moderate page-reading access, limited concerns, and no established abuse.
What it can access
It can inspect rendered text and page structure on the tab you choose, and temporarily alter the page for accessibility checks.[Q1][Q2][Q3]
Security weaknesses
Minified bundles make review harder, while the only evaluated code is locally built and user-triggered.[Q10][Q11]
Signs of misuse
Optional signup details go to HubSpot, but the review found no evidence that scan results or page contents leave the browser.[Q6][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It asks for temporary active-tab access, script injection, local storage, and unlimited local storage, plus a website access for hello.siteimprove.com. Temporary page access and injection are necessary for an accessibility scan.
Declares activeTab, scripting, storage, unlimitedStorage, and *://hello.siteimprove.com/*; it does not request <all_urls>. — manifest.json:permissions and host_permissions
Injects the packaged serializer only after a toolbar click and records only hasVisited and popupsMap in local storage. — api.js:F5 audit handler and action.onClicked listener
No runtime use of hello.siteimprove.com was found in the executable bundles. — api.js/app.js/signup.js:complete network-string review
Which websites can it run on, and can it read or change what appears on those pages?
After the user clicks the toolbar button, activeTab lets it scan the current ordinary webpage. It reads the page's rendered structure and can add a temporary finding highlight or apply a body color-vision filter.
Uses activeTab and scripting with no content_scripts declaration and no all-sites host permission. — manifest.json:permissions
Injects packaged serialization code for audits, a fixed highlight function, or a fixed body filter function into the selected tab. — api.js:F5, J5, ze, and D5 handlers
Walks elements, attributes, text nodes, CSS, open shadow roots, same-origin frame documents, and layout boxes. — serialize-page.js:fromNode serializer
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
A scan can see private text already rendered in the page and HTML attributes, so it may include messages, account details, or values a site placed in the page.
Serializes text-node data and every DOM attribute value across the active document, shadow roots, and same-origin frames. — serialize-page.js:fromNode/o/l serializer functions
No read of input.value, textarea.value, selectedIndex, document.cookie, localStorage, or sessionStorage occurs in the page serializer. — serialize-page.js:complete form-value review
The complete snapshot is returned to the extension worker for local accessibility evaluation. — api.js:F5 audit handler
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
No cookies, history, bookmarks, downloads, webRequest, or debugger permission is declared. — manifest.json:permissions
No document.cookie, browser-cookie API, or browser-history access appears. — serialize-page.js:complete source review
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the permissions needed for these device capabilities. — manifest.json:permissions
No matching device or native-messaging API calls were found. — api.js/app.js/signup.js:complete privileged-API review
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Its optional first-run signup form sends the user's name, company, email, industry, country/state, referral answer, consent choices, and submission time to a HubSpot form services. This happens only after the user fills and submits that form.
POSTs JSON fields to api.hsforms.com/submissions/v3/integration/submit/146950224/... after form validation. — signup.js:signup form submit handler near the sole fetch call
The marketing form can be skipped without submitting it. — signup.js:first-run UI
No fetch, XHR, beacon, WebSocket, or form submission carrying the page snapshot or audit output was found. — api.js/app.js/serialize-page.js:network-sink review
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Runtime entry points are local and extension pages allow scripts only from self. — manifest.json:background, devtools_page, content_security_policy
Runs the bundled Alfa/Siteimprove accessibility rule set locally. — api.js:F5 audit handler
Sends a HubSpot form submission and does not parse or execute the response. — signup.js:sole fetch call
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The first toolbar click automatically opens the extension's local signup page instead of running a scan, and later toolbar clicks open its audit panel. Scanning, highlighting, color adjustment, DevTools reveal, and signup submission otherwise follow direct user actions.
On the first click, sets hasVisited and opens packaged signup.html; later clicks toggle a local panel window for the active tab. — api.js:action.onClicked listener
Privileged page operations are triggered from the extension interface. — app.js:audit/highlight/adjust-color message senders
The only outbound POST follows explicit valid form submission. — signup.js:form submit handler
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Does not declare proxy, management, privacy, settings, or search-provider capabilities. — manifest.json:permissions
Browser calls are limited to tabs/windows, scripting, runtime messaging, action events, and local storage. — api.js:privileged API call review
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The main worker, application, and signup logic are large one-line production bundles with shortened identifiers and no source maps. They are ordinary compiled JavaScript rather than encrypted or intentionally concealed code, and their important data flows remained traceable, but the packaging meaningfully raises review difficulty.
Approximately 1.5 MB minified Webpack bundle with many bundled dependencies and no source map. — app.js:entire file
Approximately 1.05 MB minified worker bundle containing the accessibility engine and extension control flow. — api.js:entire file
Approximately 650 KB minified signup bundle; license files identify bundled open-source components. — signup.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The DevTools helper calls chrome.devtools.inspectedWindow.eval to reveal a selected finding's page node. The evaluated string is built from a locally generated path containing fixed property names, numeric child indexes, and page attribute names, and runs only after the user chooses Show in DevTools.
Evaluates a string declaring const node = <path> and passes that node to the DevTools inspect function. — devtools.js:B port-message handler
Builds paths only from document/contentDocument/shadowRoot, childNodes[n], and attributes[qualifiedName], then posts one after a user click. — app.js:nZ path builder and Fde Show in DevTools control
Contains new Function('return this') only as a fallback after globalThis and this; globalThis exists in the supported MV3 runtime. — app.js:Webpack global-object helper
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Stores tab ID, panel window ID, and the active URL locally, then compares the current URL to close a stale panel. — api.js:popupsMap storage and tabs.onUpdated listener
No history or webNavigation permission and no persistent content script are declared. — manifest.json:permissions
No active-page URL is sent to an external endpoint. — api.js/app.js/signup.js:network-sink review
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Records viewport, pixel ratio, scripting status, and media preferences inside the local audit snapshot. — serialize-page.js:fromWindow device serializer
Uses user-agent browser family only to choose one fixed form ID; it does not create or store a user ID. — signup.js:HubSpot endpoint selector
No generated persistent identifier is saved or sent. — api.js/app.js/signup.js:storage and network review
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Decompresses the injected serializer result, evaluates bundled rules, and returns the result to the extension UI. — api.js:F5 audit handler
The POST body is explicitly assembled from signup fields rather than scanned-page content. — signup.js:sole fetch call
No cookies permission is declared. — manifest.json:permissions
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads DOM nodes and attributes but not input.value, textarea.value, clipboard APIs, or pixel captures. — serialize-page.js:fromNode serializer
No clipboardRead, tabCapture, desktopCapture, or persistent content script is declared. — manifest.json:permissions
Form state belongs to the extension's optional signup UI and is sent only after submit. — signup.js:signup form
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or web_accessible_resources entry is declared. — manifest.json:entire manifest
Handles only three named internal actions: audit, highlight, and adjust-color. — api.js:D5 runtime.onMessage dispatch
Does not interpret the server response or turn it into an action. — signup.js:fetch call
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds a fixed shadow-root overlay or sets document.body.style.filter; neither rewrites links or commerce content. — api.js:J5 highlight and ze adjust-color handlers
No content scripts, declarativeNetRequest, webRequest, or search-provider permission is declared. — manifest.json:permissions
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads, or proxy permission is declared. — manifest.json:permissions
No corresponding browser API calls appear in the executable control flow. — api.js/app.js:privileged API review
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission or localhost host access is declared. — manifest.json:permissions and host_permissions
The only runtime endpoint is the HTTPS HubSpot form submission. — api.js/app.js/signup.js:endpoint review
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Uses atob, a Uint8Array, pako ungzip, TextDecoder, and JSON parsing on the serializer result before local rule evaluation. — api.js:F5 audit handler
Produces the compressed snapshot locally inside the selected page. — serialize-page.js:packaged serializer output
Decoded fields are modeled as page/device data and passed to the accessibility engine, not eval or scripting.executeScript. — api.js:decoded-data consumers
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable, content_scripts, or web_accessible_resources entry exists. — manifest.json:entire manifest
The privileged action dispatcher receives internal extension messages from the packaged UI. — api.js:runtime.onMessage handler
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Selects one fixed form ID for Opera, Firefox, Edge, or other browsers. — signup.js:HubSpot endpoint selector
Skips the navigation-close behavior on Firefox; it does not activate hidden functionality. — api.js:tabs.onUpdated listener
No remote feature configuration or targeted malicious branch was found. — api.js/app.js/signup.js:condition and endpoint review
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
CPU-intensive work is the local Alfa accessibility-rule evaluation initiated by an audit request. — api.js:F5 audit handler
No mining library, proof-of-work loop, hidden worker pool, or periodic background task was found. — api.js/app.js:background scheduling review
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Injected functions contain no assignment to input values, form.action, submit handlers, or fetch destinations. — api.js:F5, J5, and ze injected operations
Reads page nodes for the audit; aside from an unused optional data-alfa-id feature, the invoked configuration does not modify form elements. — serialize-page.js:fromNode serializer
No persistent website script is declared. — manifest.json:content_scripts