Is DNS Checker - SEO and Domain Analysis safe?
We analyzed DNS Checker - SEO and Domain Analysis version 1.0.10's actual code and gave it a 52/100 trust score. This is a broadly privileged analyzer…
Bottom line
This is a broadly privileged analyzer that automatically tracks navigation and sends destination-server information to its provider.
What it can access
It can inspect every ordinary webpage, observe navigation, enumerate or delete cookies, and use network details across all sites, exceeding a typical click-only analyzer [Q1].
Security weaknesses
Always-on all-site monitoring and powerful cookie controls create meaningful exposure if the extension or its service is misused [Q1][Q18].
Signs of misuse
It automatically records page visits and sends destination server addresses to DNSChecker without requiring the popup to be opened [Q8][Q12][Q6].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, cookies, storage, webRequest, activeTab and access to every site. Broad page and navigation access supports its advertised SEO, redirect, DNS, IP and cookie tools, but the access is always enabled and substantially exceeds a click-only analyzer.
Requests tabs, cookies, storage, webRequest and activeTab plus both *://*/* and <all_urls>. — manifest.json:31-47
Injects the content script into every HTTP and HTTPS page at document_idle. — manifest.json:48-58
Which websites can it run on, and can it read or change what appears on those pages?
It can read the complete HTML of any ordinary webpage when the popup opens. The page source is parsed locally for SEO, text, image, link, schema and metadata reports; the package does not send that source to DNSChecker or modify the visited page.
Returns document.querySelector('html').outerHTML for the internal popup.getSource command. — dist/js/content.min.js:1-10
On popup initialization, requests popup.getSource, parses it with DOMParser and builds local SEO/content reports. — dist/js/popup.min.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Returns serialized page HTML only after the extension popup requests source; no event monitoring exists. — dist/js/content.min.js:1-10
Parses page source for SEO/content elements, with no credential or form-submission sink. — dist/js/popup.min.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can enumerate cookies across the browser and delete site or browser cookies. The code uses names/domains/paths for deletion and does not transmit cookie values.
Declares cookies and storage permission. — manifest.json:31-39
removeCurrentDomainCookies uses cookies.getAll for the active origin; removeAllCookies enumerates all cookies and attempts deletion only after the respective UI actions. — dist/js/popup.min.js:1
Provides Delete All Cookies controls and a separate warning/confirmation popup. — dist/popup.min.html:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
When the popup opens it uses WebRTC candidates to display local IP addresses and asks DNSChecker to return public IP/geolocation details. It does not access files, precise device location, camera, microphone or installed applications.
Creates RTCPeerConnection, gathers ICE candidate addresses locally and displays them in the popup. — dist/js/popup.min.js:1
Handles popup.getClientIpDetail by POSTing service=get_clientIp to dnschecker.org. — dist/js/dnschecker.min.js:116-120
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Each newly observed destination server IP is POSTed to dnschecker.org/extension/services.php for geolocation. That is a complete automatic source-to-sink path and can indirectly reveal the visited service, although no full URL or page HTML is sent.
Defines credentialed requests to DNSChecker and get_ipData/get_clientIp services. — dist/js/dnschecker.min.js:33-55
On every completed main-frame request, takes data.ip and calls getSiteIpData(data.ip); exact data.url is stored locally instead. — dist/js/dnschecker.min.js:86-99
Popup commands fetch public-IP detail and tools.json from DNSChecker. — dist/js/dnschecker.min.js:116-120
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads a JSON catalog of DNSChecker tool links when the popup opens. The server can change those visible outbound links and icon classes, but the data is not executed as JavaScript and cannot command privileged page actions through this path.
Defines tools.json and downloads it as JSON. — dist/js/dnschecker.min.js:5-6, 47-55
Uses returned link/title/icon fields to construct popup tool links with textContent, href and classList. — dist/js/popup.min.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Navigation inspection, session recording, server-IP geolocation lookup and a same-origin robots.txt fetch happen automatically for every completed top-level navigation. The popup need not be opened.
Registers webRequest listeners at worker startup and automatically records navigation, calls getSiteIpData and fetches robots.txt. — dist/js/dnschecker.min.js:68-99
Immediately calls onWebRequests during background-worker initialization. — dist/js/dnschecker.min.js:126-151
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no browser override, search-provider, proxy or settings permission. — manifest.json:1-58
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Despite its filename, the worker logic is formatted and directly inspectable. — dist/js/dnschecker.min.js:1-151
Minified popup bundle retains descriptive strings and ordinary DOM/API operations. — dist/js/popup.min.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Background logic uses ordinary packaged functions and fetch with no dynamic execution sink. — dist/js/dnschecker.min.js:1-151
Content script only answers one internal source request. — dist/js/content.min.js:1-10
Popup logic contains no eval or Function constructor. — dist/js/popup.min.js:1
Does it track the websites, pages, searches, or links you visit?
It actively observes every top-level page URL and redirect chain and retains them per tab in Chrome session storage. It sends server IPs—not exact URLs—to DNSChecker automatically.
Captures data.url, redirectUrl, headers, status, duration and IP for all main-frame requests and sends each changed IP for geolocation. — dist/js/dnschecker.min.js:68-99
Persists the per-tab object in chrome.storage.session and restores it when the worker restarts. — dist/js/dnschecker.min.js:10-31, 150-151
Deletes data when a tab closes and replaces navigation data when the main request ID changes. — dist/js/dnschecker.min.js:69, 95-99
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Uses userAgent only to choose Chrome/Firefox UI and WebRTC to display local IPs. — dist/js/popup.min.js:1
Session storage contains per-tab navigation data, not a generated client identifier. — dist/js/dnschecker.min.js:8-31
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Shared fetch helper uses credentials: include for the requested destination. — dist/js/dnschecker.min.js:33-49
Vendor API receives only service/IP parameters; robots.txt is fetched from the visited site's own origin. — dist/js/dnschecker.min.js:50-55, 95-99
Page source is returned only to the extension popup through internal messaging. — dist/js/content.min.js:1-10
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
copyToClipboard creates a temporary textarea and runs only from popup click handlers; no page key/input/capture listener exists. — dist/js/popup.min.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Handles only packaged popup permission, tab data, client IP and tools commands. — dist/js/dnschecker.min.js:100-123, 126-149
Remote tools data affects popup links/titles/icons and requires a user click to navigate. — dist/js/popup.min.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Content script reads source on request and performs no page mutation. — dist/js/content.min.js:1-10
Constructs tool/report links only in the extension popup. — dist/js/popup.min.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It passively intercepts metadata for every main-frame request: URLs, redirect targets, response headers, methods, server IPs, status and timing. It does not cancel, redirect, modify headers, proxy traffic or inspect subresource requests.
Grants webRequest plus all-site host access. — manifest.json:31-47
Registers non-blocking onBeforeRequest, onBeforeRedirect and onCompleted listeners limited to main_frame and records response metadata. — dist/js/dnschecker.min.js:68-99
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Uses RTCPeerConnection ICE candidates for local IP display; no local network destination is contacted. — dist/js/popup.min.js:1
No nativeMessaging permission is present. — manifest.json:31-47
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses declared JSON API responses and robots.txt text without an execution sink. — dist/js/dnschecker.min.js:47-55
Uses DOMParser for page-report extraction and JSON.parse for structured-data display. — dist/js/popup.min.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Listens only on browser.runtime.onMessage and supports one popup.getSource command. — dist/js/content.min.js:1-10
No externally_connectable or web_accessible_resources section exists. — manifest.json:1-58
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses a fixed all-site main_frame filter with no remote flag or selective target list. — dist/js/dnschecker.min.js:68-99
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
SEO/text analysis is finite popup initialization work; timers only manage UI and deferred session writes. — dist/js/popup.min.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Content script only returns page outerHTML and never mutates the page. — dist/js/content.min.js:1-10
Input handlers target popup meta-title/description preview controls, not the active tab document. — dist/js/popup.min.js:1