Is Link Research SEO Toolbar safe?
We analyzed Link Research SEO Toolbar version 1.1.5.28's actual code and gave it a 65/100 trust score. This is a purpose-aligned SEO extension, but its…
Bottom line
This is a purpose-aligned SEO extension, but its all-site reach and transmission of browsing-related URLs create meaningful privacy and access concerns.
What it can access
It can read and change pages across all HTTP and HTTPS sites and send search or page URLs for metrics, which is broader than a narrow SEO feature.[Q1][Q2][Q6]
Security weaknesses
No downloaded-code execution, obfuscation, or major browser-setting weakness was found in the reviewed package.[Q7][Q10][Q11]
Signs of misuse
The extension sends search and optional visited-page URLs to its own metrics service, but this is described as supporting its SEO feature rather than unexplained misuse.[Q6][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has access to all HTTP/HTTPS pages, tab URLs, response headers, scripting, and local settings. Those capabilities support its SEO overlays and optional toolbar.
Declares all-page content scripts, tabs, webRequest, scripting, storage, and all HTTP/HTTPS hosts. — manifest.json:20-62
Which websites can it run on, and can it read or change what appears on those pages?
It reads search-result links, canonical tags when enabled, page URLs, and X-Robots response headers, then adds SEO overlays to pages.
Extracts search results and inserts metric UI. — js/SERPController.js:145-203
Reads main-frame response headers and retains X-Robots directives by tab. — js/XRobots.js:26-61
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads search-result link URLs and DOM roots, not form contents. — js/SERPController.js:145-179
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores feature settings and short-lived cached metric responses locally. It does not access cookies, history, bookmarks, or saved passwords.
Loads and saves the extension's settings in chrome.storage.local. — js/App.js:119-152
Requests storage but not cookies, history, bookmarks, or password access. — manifest.json:49-62
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of those permissions. — manifest.json:49-62
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends search-result URLs, domains, and search-page referrers to LinkResearchTools for metrics. If the optional toolbar is enabled, it sends the current page URL and domain to that same service.
Submits result URLs, domains, current search URL, and previous search URL for metrics. — js/SERPController.js:207-254
POSTs those values to plugin.linkresearchtools.com. — js/lrt/LRT.js:23-42,86-102
Requests metrics for the toolbar's current page and domain. — js/toolbar-content.js:107-128
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Defines defaults in the package and persists local changes. — js/App.js:7-30,119-153
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The search overlay is enabled by default and automatically analyzes supported search pages. The all-page toolbar and result-page fetching are off by default and have visible controls.
Sets enableSERP true, enableToolbar false, and fetchResults false. — js/App.js:7-30
Provides controls for the search overlay, page fetches, and toolbar. — html/options.html:30-47,85-102
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no override or browser-settings capability. — manifest.json:1-62
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Explicitly lists the packaged libraries and readable application modules. — sw_background.js:1-14
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads fixed packaged scripts only. — sw_background.js:1-14
Loads packaged templates and injects fixed packaged script files. — js/App.js:90-94,316-384
Does it track the websites, pages, searches, or links you visit?
It processes current tab URLs and automatically sends current and previous search URLs to its metrics service. Optional toolbar use sends other visited-page URLs.
Tracks current and previous search URLs and includes them in metrics requests. — js/SERPController.js:30-34,230-249
Passes the current page URL into the toolbar. — js/Toolbar.js:103-115
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Defines no-op analytics methods and leaves the prior analytics calls commented out. — js/App.js:35-40,48-51,84-87
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Uses credentials: include only on the vendor's own fixed API endpoint. — js/lrt/LRT.js:86-102
Requests no cookies permission. — manifest.json:49-62
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Listens only for scrolling and clicks on the extension's own metric controls. — js/SERPController.js:120-142
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Parses fixed API JSON and passes it to predefined callbacks. — js/lrt/LRT.js:86-121
Renders metrics through packaged Mustache templates. — js/App.js:427-449
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It modifies search-result pages and, if enabled, other pages to display its SEO interface. This is the advertised feature and is controlled by settings.
Adds the SEO widget and metric bars to search results. — js/SERPController.js:84-108,296-331
Adds the optional toolbar container and iframe. — js/Toolbar.js:80-109
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It observes completed main-frame response headers on all sites to identify X-Robots directives. It does not block, redirect, or alter network traffic.
Registers a read-only onCompleted listener and extracts only X-Robots values. — js/XRobots.js:26-61
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:49-62
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Calls the page fetch only when fetchResults is enabled. — js/SERPController.js:181-190
Removes active content and reads only canonical/base link metadata. — js/HTMLParser.js:19-71
Labels the option as involving a page fetch. — html/options.html:85-87
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Accepts matching window messages without validating origin or source. — js/Toolbar.js:64-76
Accepts only widget, close, sort, and export commands through the page message listener. — js/SERPController.js:56-80
Widget messages control only ready, size, visibility, and enabled state. — js/Widget.js:140-163
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines defaults and implements per-domain toolbar blocking. — js/App.js:7-30,475-491
Exposes the feature controls. — html/options.html:30-47,85-117
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Loads identifiable SEO, cache, icon, and header-processing modules. — sw_background.js:1-14
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Adds metric sections to result items. — js/SERPController.js:296-331
Adds extension-owned toolbar elements. — js/Toolbar.js:80-109