PageScanner: Website Privacy, Tracker, Cookie, API & Security Scanner

Free scanner for observed trackers, cookies, scripts and API endpoints on supported webpages. Export privacy and security evidence.

Find out what any webpage really loads: the trackers and pixels, cookies, third-party scripts, API calls and technologies behind it, each with the evidence the browser captured. Free. No account. The analysis runs in your browser. Open a page, click the PageScanner icon, and five reports are ready: - Tech Stack: what the website is built with - Privacy: which trackers, pixels and cookies are on the page, and where its data goes - PCI DSS: which scripts run on a payment page (Requirement 6.4.3) - AppSec: a 0 to 100 front-end security score with findings and fixes - APIs: which endpoints the page calls, and from which script Export any report as JSON, Excel, PDF, Word or HTML for your team, your client or your auditor. NEW IN THIS VERSION - Totals on every report tab. Each of the five tabs shows its count, so you see which report has evidence before you open it. - A clearer AppSec score. A marker shows where the page falls on a scale from Excellent to Critical, with the verdict in green, orange or red. - Sensitive Data Exposure. AppSec checks inline scripts and page configuration for suspected exposed OpenAI and Anthropic API keys. Findings show the provider and where it was found, with the key masked. Detection is by shape only; PageScanner never tests a key. - Clearer tracker evidence. Privacy separates trackers seen sending a request from products identified only by a cookie name, and a request known under two vendor names is listed once. - A guided start. After install, a short Welcome page shows how PageScanner works and how to pin the icon. Help in the popup opens it again and can reload tabs that were open before you installed. WHO USES IT - Privacy officers and counsel: see which trackers and cookies a page loads, accept or reject the consent banner, reload, and export both reports to compare. Useful for GDPR, CCPA/CPRA, HIPAA and CIPA reviews. - PCI DSS merchants and assessors: list every script observed on a payment page, first-party or third-party, with Content Security Policy, Subresource Integrity and nonce checks marked Pass, Warn or Fail. - Security engineers and developers: scan a staging or production page before release and read the score, missing headers, risky scripts and outdated JavaScript libraries. Intranet, localhost and local files work too. - Marketers, agencies and analysts: look up a competitor's tech stack, or audit your own site for leftover tags and pixels. - Vendor risk and GRC teams: see which third parties a site connects to, and in which countries, before you sign or renew. FIVE REPORTS, FIVE QUESTIONS 1. Tech Stack: what is this site built with? Technologies, products and vendors observed on the page or across the website, grouped by category, with the evidence and version where observed. 2. Privacy: who collects data on this page? Trackers, pixels and data brokers by name and category, cookies, web forms that collect personal data, and a map of the countries the page connects to. 3. PCI DSS: which scripts load on my payment page? A script inventory with first-party, third-party, inline and eval counts for PCI DSS 4.0.1 Requirement 6.4.3, and integrity checks relevant to Requirement 11.6.1. It is evidence from your visit, not an audit result. 4. AppSec: how exposed is the front end? A 0 to 100 score from a formula shown in the product, findings grouped from Transport Security to injection signals with evidence and recommendations, JavaScript libraries matched against a bundled vulnerability database, and suspected exposed AI API keys, masked. 5. APIs: what does this page call? Observed API endpoints with their HTTP method, telemetry and noise kept apart, and a flow report linking each call to the script or vendor where attribution is available. HOW IT WORKS 1. Add PageScanner and pin it. There is nothing to set up. 2. Open a website. Each page is scanned as it loads, and the icon shows a count for the current tab. 3. Click the icon. Switch between the five reports, open any finding for its evidence, and export. Step back through earlier pages in the same tab with Prev and Next. DEPLOY ACROSS YOUR FLEET Roll PageScanner out through browser policy like any other extension. No license keys, no account, no server. Force-install it from the Google Admin console or with ExtensionInstallForcelist in Group Policy, using the extension ID onnonipjbalfikdmakiohocdkbnmgpph. Managed installs skip the Welcome page and the rating request. Deployment guide: https://www.feroot.com/feroot-pagescanner/deployment-guide/ PRIVACY Analysis runs in your browser against databases bundled inside the extension. The extension sends no browsing data and no scan results to Feroot, has no telemetry and runs no remote code. Deep Scan reads a page's own script files from their original hosts for closer analysis; switch to Light Scan in Settings to skip that. Cookie values and the text you type into forms are not put in reports, and exports redact URL query values and path parameters. When you install or uninstall PageScanner, your browser opens a page on feroot.com. That is an ordinary website; the extension adds nothing about you to the address. WHY DOES CHROME ASK FOR ACCESS TO ALL WEBSITES? To observe what runs on a page, the scanner has to run on that page. PageScanner uses this access only to observe and report on the pages you visit, locally. PCI DSS is a standard of the PCI Security Standards Council. PageScanner is not affiliated with or endorsed by the PCI SSC and does not certify compliance. Add PageScanner, open the page you need to check, and see what it loads in one click.