Is Google Search Console Enhanced Analytics safe?
We analyzed Google Search Console Enhanced Analytics version 2.6.1's actual code and gave it a 72/100 trust score. This appears purpose-aligned, but its…
Bottom line
This appears purpose-aligned, but its handling of stored service credentials and business-sensitive Search Console data warrants caution.
What it can access
Access is limited to Google Search Console and supports reading reports, changing the display, and exporting data [Q1][Q2]. It also handles business-sensitive queries and a separate service password [Q3][Q4].
Security weaknesses
The extension stores a service password in browser storage, including persistent storage when requested, increasing exposure if the browser profile is compromised [Q4].
Signs of misuse
No evidence shows tracking, unrelated collection, remote commands, or hidden behavior; data sharing is tied to user-requested keyword lookups [Q6][Q12][Q16][Q22].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has active-tab, scripting, and storage access, plus host access limited to Google Search Console and an optional web-navigation permission.
Declares activeTab, scripting, storage, optional webNavigation, and https://search.google.com/* host access. — manifest.json:8-20
Which websites can it run on, and can it read or change what appears on those pages?
It reads displayed Search Console metrics, query labels, table data, dates, and page URLs after its tools are enabled.
Reads metric titles and visible table values to calculate and display percentage changes. — statistieken.js:18-69,117-173
Reads summary, date, query, and metric table text to build local spreadsheets. — button.js:59-125,129-228
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Search queries and performance data may be business-sensitive, but no email contents, messages, or arbitrary forms are read.
Collects visible Search Console keyword text for search-volume lookup. — zoekvolumes.js:67-85
Collects visible Search Console report values for spreadsheet export. — button.js:59-125,129-228
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores the user's DataForSEO email and services password in plaintext extension storage, persistently with Remember Me or otherwise for the browser session.
Writes login and password to chrome.storage.local or chrome.storage.session and provides a delete action. — popup.js:684-722
Labels the DataForSEO credentials, Remember Me choice, and delete control. — popup.html:35-50
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It creates local XLSX downloads containing displayed Search Console data; it has no camera, microphone, or clipboard behavior.
Builds workbooks from visible Search Console values and saves them through XLSX.writeFile. — button.js:59-125,129-228
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The search-volume feature sends visible Search Console keywords, country/language choices, and DataForSEO Basic-auth credentials to services.dataforseo.com.
Builds a DataForSEO request containing keyword text, location, and language and authenticates with the stored login and password. — zoekvolumes.js:67-124
Polls DataForSEO for results with the same Basic-auth credentials. — zoekvolumes.js:165-187
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads /files/locations.json and /files/languages.json from the packaged extension. — popup.js:725-765
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
With the optional navigation setting enabled, packaged enhancements are injected automatically on Google Search Console navigation; search-volume requests still require a button click.
Registers Google Search Console navigation listeners and injects packaged scripts according to saved settings. — background.js:26-128
Search-volume generation begins only from the dedicated button handler. — popup.js:821-830
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no setting-control permissions. — manifest.json:8-20
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Packaged Bootstrap, date-picker, and XLSX libraries are minified, but the application logic is readable; this is not evidence of abuse.
Contains a large bundled spreadsheet library. — xlsx.js:1-2
The credential and network path is readable application code. — zoekvolumes.js:1-224
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Injects only named packaged scripts. — background.js:1-200
Treats remote responses as JSON data and does not execute them. — zoekvolumes.js:1-224
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads the active tab URL and updates that tab with sanitized Search Console date parameters. — background.js:14-24,184-186
Does not request the history permission and limits host access to Search Console. — manifest.json:8-18
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no tracking request or identifier generation. — background.js:1-200
Network traffic is limited to the requested DataForSEO lookup. — zoekvolumes.js:99-187
Does it send cookies, session details, authentication data, or page contents elsewhere?
It handles a user-entered DataForSEO login and services password and sends them only to DataForSEO; it does not access Google account credentials or cookies.
Collects DataForSEO email and password with a storage choice. — popup.html:35-50
Uses those credentials in HTTPS Basic-auth requests to api.dataforseo.com. — zoekvolumes.js:114-124,165-177
Requests no cookies permission. — manifest.json:8-18
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Credential entry is a labeled DataForSEO settings form. — popup.html:35-50
Declares no capture or device permissions. — manifest.json:8-18
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Handles a fixed set of internal messages and injects fixed packaged scripts. — background.js:139-200
DataForSEO responses supply search-volume result data only. — zoekvolumes.js:99-187
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It changes Google Search Console URLs and adds percentages, volume labels, and an export button to the page for the advertised feature.
Updates the active page URL with selected date parameters. — background.js:14-24,184-186
Adds percentage elements beside Search Console statistics. — statistieken.js:89-173
Adds returned search-volume values beside displayed keywords. — zoekvolumes.js:87-96
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It makes direct HTTPS DataForSEO services requests for user-requested keyword-volume data; it does not proxy or intercept unrelated traffic.
Posts keyword tasks and polls results at api.dataforseo.com. — zoekvolumes.js:99-187
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or system-level permission. — manifest.json:8-18
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses API responses as JSON and reads task status, keyword, and search_volume fields. — zoekvolumes.js:124-187
Injects only JavaScript files packaged with the extension. — background.js:38-125
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable entry or web-accessible script. — manifest.json:1-35
Uses internal Chrome extension messaging. — background.js:139-200
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Provides explicit buttons and switches for volume and automatic enhancement behavior. — popup.html:103-131
Only the volume button sends executeVolume to the background worker. — popup.js:821-830
Registers persistent navigation listeners only when optional webNavigation is granted. — background.js:26-137
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Loops and intervals wait for and process the advertised Search Console interface. — statistieken.js:1-174
Polling waits for DataForSEO task completion after a user request. — zoekvolumes.js:1-224
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Reads report values and inserts display-only percentage spans. — statistieken.js:18-173
Reads query labels and appends display-only volume spans. — zoekvolumes.js:51-96