Is Block Site safe?
We analyzed Block Site version 0.2.5's actual code and gave it a 82/100 trust score. This is a purpose-aligned site blocker with broad traffic control and…
Bottom line
This is a purpose-aligned site blocker with broad traffic control and a minor local password-storage weakness.
What it can access
It can block or redirect requests on every website, which fits its purpose but gives it broad traffic control. [Q1][Q18]
Security weaknesses
Rule-lock passwords are stored locally as plain text, creating a limited privacy weakness if local extension data is accessed. [Q14]
Signs of misuse
No evidence shows browsing tracking, remote commands, or deceptive traffic changes beyond user-configured blocking and redirects. [Q12][Q16][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has all-site host access and declarativeNetRequest so it can block or redirect configured page and iframe requests.
Declares *://*/* host access, storage, contextMenus, and declarativeNetRequest. — manifest.json:3
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content_scripts, activeTab, or scripting permission. — manifest.json:3
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Uses only a context-menu page URL and declarative request conditions; it does not inspect response or page bodies. — lib/common.js:71-170
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores blocklists, redirects, optional rule passwords, update timing, and rule scope in local extension storage.
Defines local storage-backed settings for blocklist, iframe list, passwords, notifications, and last update. — lib/config.js:7-23
Reads and writes settings with chrome.storage.local. — lib/chrome.js:62-100
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the related permissions. — manifest.json:3
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It can open fixed publisher and test pages and user-entered redirect URLs; no sensitive data upload was found.
Opens the publisher homepage on installation or infrequent updates and sets an uninstall URL with version and event-type parameters. — lib/runtime.js:4-22
Defines a fixed blocking-test page at webbrowsertools.com. — lib/config.js:5
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Fetches the relative packaged file explore/explore.json. — data/options/explore/explore.js:17-18
Runtime URLs and defaults are packaged locally. — lib/config.js:1-23
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Configured blocking rules apply automatically during browsing; publisher pages open only on installation, infrequent updates, uninstall, or explicit support actions.
Registers persistent or session declarative rules from the user's blocklists. — lib/common.js:102-170
Limits automatic publisher-page opening to install or an update after more than 45 days. — lib/runtime.js:4-22
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting, search-provider, or proxy permissions. — manifest.json:3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive names and straightforward blocking-rule construction. — lib/common.js:1-186
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads only packaged JavaScript files with importScripts. — background.js:1-5
Contains no dynamic execution primitive. — lib/common.js:1-186
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Extracts the hostname from context-menu info.pageUrl and adds it to the local blocklist. — lib/common.js:71-99
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Publisher links contain only extension version, previous version, and install/update/uninstall type. — lib/runtime.js:4-22
Does it send cookies, session details, authentication data, or page contents elsewhere?
Optional rule-lock passwords are stored as plain text in local extension storage; webpage credentials and cookies are not accessed.
Stores the password map under the local password key. — lib/config.js:17-23
Reads the stored password string and compares it directly when removing a protected rule. — data/options/options.js:121-151,192-210,227-255
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Has no page script or capture permission. — manifest.json:3
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Background commands come only from the packaged options page through extension runtime messaging. — lib/runtime.js:24-84
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates declarative block or redirect actions without injecting into the destination page. — lib/common.js:102-170
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It automatically blocks or redirects matching top-level and iframe requests according to the user's saved rules.
Builds dynamic declarativeNetRequest actions for main_frame and sub_frame resources. — lib/common.js:102-170
Installs those actions as Chrome dynamic or session rules. — lib/netrequest.js:28-75
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The only fetched data is a packaged relative JSON list used for Explore more links. — data/options/explore/explore.js:17-18
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content script, web-accessible script, or externally_connectable site. — manifest.json:3
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Lets the user create and edit rules; redirect changes are saved without the password check used for deletion. — data/options/options.js:78-92,121-259
All rule choices are local settings. — lib/config.js:17-23
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains only site-blocking, settings, and navigation logic. — lib/common.js:1-186
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or scripting permission provides access to page forms. — manifest.json:3