Feroot PageScanner

Observe technologies, trackers, cookies, scripts and API endpoints. Export findings for privacy, security and payment-page audits.

Every tracker, cookie, script and API on any page, with evidence. Export the report for an audit, an investigation or a lawsuit: GDPR, CIPA, CCPA, HIPAA, PCI DSS. Feroot PageScanner turns any web page you open into an evidence report. Trackers, tags, pixels, beacons, scripts, cookies, API calls and form-data collection, named and sorted, not buried in developer logs, organized for GDPR, CIPA, CCPA/CPRA, PCI DSS 4.0.1 Requirements 6.4.3 and 11.6.1, HIPAA online tracking and 50+ privacy regulations. Free, and the analysis runs in your browser. NEW IN VERSION 6 Version 6 is a brand-new release of PageScanner, rebuilt around five evidence reports and a cleaner popup. New: a Tech Stack tab (technologies, products and vendors, with versions and network associations, for one page or the whole website), full-screen flow reports for scripts and API endpoints, an interactive HTML export alongside JSON, Excel, PDF and Word, per-tab page history with Prev and Next, light and dark mode, and a managed-deployment notice for browser fleets. Works in Chrome, Edge and Brave. HOW IT WORKS 1. Add it to Chrome and pin it. Nothing to set up. Pages are scanned as they load and the toolbar badge shows the count for the tab. 2. Click the icon. The whole page is laid out for you in five tabs, named and sorted, with a flow report you can expand to full screen. 3. Export a clean report in Excel, PDF, Word, JSON or interactive HTML to keep or to share. WHAT YOU GET Five reports in one popup: 1. Tech Stack: every technology, product and vendor observed on the page or across the whole website, grouped by category (analytics, tag managers, JavaScript libraries, fonts, e-commerce and CMS, payment and more), each with its proof, network associations and version where observed. 2. Privacy: trackers, pixels and data brokers by name and category, cookies, web forms that collect data (such as a checkout form), and a data-transfer world map showing which countries a page connects to. A starting point for GDPR, CCPA/CPRA, HIPAA and CIPA reviews. 3. PCI DSS: a payment-page script inventory with first-party, third-party, inline and eval counts for PCI DSS 4.0.1 Requirement 6.4.3, integrity checks for Content Security Policy, Subresource Integrity and nonce coverage under Requirement 11.6.1, marked Pass, Warn or Fail, and a script flow report for your assessor. Results are observations from your visit, not an audit result. 4. AppSec: a browser-local security report scored 0 to 100 by a formula printed in the product, findings grouped from Transport Security to XSS and Injection Signals, each with its evidence and a recommendation, plus known-vulnerable JavaScript libraries matched against a bundled retire.js repository. 5. APIs: the runtime API endpoints a page calls, with their HTTP method, telemetry and noise kept separate, and an endpoint flow report that traces each call back to the script or technology that made it. Step back through the pages you visited in a tab with Prev and Next. Deep Scan is on by default and reads the page's own JavaScript files for closer analysis; Light Scan is available. Light and dark mode. WHO IT IS FOR Privacy officers, attorneys and privacy counsel answering a CIPA demand letter or a HIPAA tracking question. QSAs, ISAs and merchants facing a PCI DSS assessment who need the payment-page script list for Requirement 6.4.3. CISOs, AppSec engineers and developers closing an audit finding on page scripts. Product managers and marketers checking their own site. Built for people who need the depth underneath and defensible evidence, not a consumer ad blocker. DEPLOY ACROSS YOUR FLEET PageScanner rolls out to a managed browser fleet the same way as any other extension you push through policy. No license keys, no account, no server-side setup. Force-install it from the Google Admin console (Devices, Chrome, Apps and extensions) or through ExtensionInstallForcelist in Group Policy with the extension ID onnonipjbalfikdmakiohocdkbnmgpph. Edge takes the same policy through Intune or GPO, and Firefox through policies.json. Managed devices show a one-line notice with an Enterprise resources button. Running this check by hand every week? Tell the PageScanner team what your fleet needs: managed configuration, report collection and deployment tooling ship first to the teams that ask. Deployment guide and enterprise resources: https://www.feroot.com/pagescanner/enterprise YOU ARE SAFE Analysis runs entirely in your browser against databases bundled inside the extension. No browsing data and no scan results are sent to Feroot, even from a fleet deployment. There is no telemetry endpoint and no remote code. Cookie and form-field values are never captured, and exports redact URL query values and path parameters. Values the scanner cannot verify are marked Not verified rather than invented. Questions or bugs go straight to Feroot engineers from the extension footer. WHY DOES CHROME ASK FOR ACCESS TO ALL WEBSITES? To observe what runs on a page, the scanner has to run on that page. PageScanner uses that access to observe and report on the page you visit, locally. Add Feroot PageScanner to Chrome, open the page you need to check, and export the findings when your reviewer asks.