Is Detailed SEO Extension safe?
We analyzed Detailed SEO Extension version 2.2.7's actual code and gave it a 78/100 trust score. This is a mostly purpose-aligned SEO tool with moderate…
Bottom line
This is a mostly purpose-aligned SEO tool with moderate access and no established evidence of abuse, but optional broad access and traffic changes warrant caution.
What it can access
It reads SEO-related content from the active page and can request access across websites for optional checks, which fits its purpose but broadens exposure.[Q1][Q2]
Security weaknesses
A selected User-Agent profile can affect many outgoing requests, creating a broad traffic-change capability even though the user activates it.[Q18]
Signs of misuse
No evidence shows it collecting sensitive data, running downloaded code, tracking browsing, or accepting commands from websites or remote services.[Q7][Q12][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It analyzes the active tab on demand; persistent all-site and tabs access are optional and require a separate permission grant.
Declares activeTab and scripting by default, while HTTP/HTTPS host access and tabs are optional. — manifest.json:3
On popup mount, injects the packaged primary analyzer into the current active tab and explicitly requests optional permissions for broader features. — popup.js:29
Which websites can it run on, and can it read or change what appears on those pages?
It reads the current page's SEO-relevant content and structure.
Collects title, canonical URL, headings, meta tags, visible word count, images, links, language, URL components, hreflang links, and structured data. — src/content/primary/main.js:13
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The analyzer queries SEO elements and visible page text, not form values or credentials. — src/content/primary/main.js:13
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores interface settings and a temporary selected User-Agent profile.
Stores dark mode, highlighting, permissions, and People Also Ask settings. — popup.js:29-30
Stores the selected User-Agent in session storage. — serviceWorker.js:5
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can create local CSV and JSON downloads containing SEO data the user chooses to export.
Creates local CSV or JSON blobs and clicks temporary download links for explicit exports. — popup.js:29
Exports the collected People Also Ask results to a local CSV after the user selects a depth. — src/content/googleScript/index.js:6
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It makes page and hreflang checks and opens selected SEO services with the active URL or domain, but does not upload the analyzed page body.
Requests the active URL for response headers, fetches hreflang target pages after optional permission, and constructs user-invoked links to Ahrefs, Semrush, SimilarWeb, and other tools. — popup.js:29-30
Returns collected SEO data only through extension runtime messages to the popup. — src/content/primary/main.js:13
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Behavior, endpoints, menus, and request rules are defined in the packaged code. — serviceWorker.js:5
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It opens a fixed publisher page on installation and injects its Google-results helper when matching search pages finish loading.
onInstalled opens detailed.com/extension, and tabs.onUpdated injects the packaged Google helper on Google search URLs. — serviceWorker.js:5
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No search, proxy, homepage, or browserSettings permission is declared. — manifest.json:3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most application and dependency code is bundled and minified, but feature names and data paths remain identifiable.
Vue application and dependencies are minified into long bundle lines. — popup.js:1-30
Analyzer and parsing libraries are bundled into a minified file. — src/content/primary/main.js:1-13
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Function references occur inside packaged framework and parser code; no downloaded script or remote-text execution path was found. — src/content/primary/main.js:4-12
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads window.location to classify links, report the analyzed URL, and parse host and path. — src/content/primary/main.js:13
Lists tabs as an optional permission rather than a default permission. — manifest.json:3
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Inspected SEO results are returned locally to the extension popup. — src/content/primary/main.js:13
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies permission is declared. — manifest.json:3
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No tabCapture or desktopCapture permission is declared, and the feature code analyzes DOM content after popup activation. — manifest.json:3
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Runtime actions are fixed local commands for menus, CSS, User-Agent selection, and popup coordination. — serviceWorker.js:5
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It adds an SEO panel to Google results and can highlight nofollow links when the user enables that feature.
Adds a People Also Ask extraction panel and locally clicks question expanders at the selected depth. — src/content/googleScript/index.js:6
Highlights nofollow anchors after a menu action or saved setting. — serviceWorker.js:5
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
A user-selected browser profile can replace the User-Agent header on all request types until reset; optional hreflang checks also fetch linked pages.
Installs a session DNR rule that replaces User-Agent for broad request types and removes it when Default is selected. — serviceWorker.js:5
Requests optional host access before fetching hreflang targets and active-page headers. — popup.js:29-30
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All executed popup, worker, and content scripts are packaged resources. — manifest.json:3
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable configuration is declared. — manifest.json:3
Communication uses extension runtime messages between the popup and isolated content script. — src/content/primary/main.js:13
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Prompts for optional tabs and HTTP/HTTPS origins before enabling persistent highlighting or hreflang checks. — popup.js:29-30
Applies User-Agent modification only after a user selects a non-default profile. — serviceWorker.js:5
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background activity manages menus, optional highlighting, and user-selected request headers. — serviceWorker.js:5
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
DOM analysis reads SEO elements and page text; no form-action or input-value manipulation was found. — src/content/primary/main.js:13