Security & Privacy Inspector

Inspect any site's security headers, CSP, cookies, trackers & tech. Get an A–F grade, fixes, and on-page alerts.

Ever wondered how secure a website really is? Security & Privacy Inspector answers that in one click. Open the popup on any page and you get a clear A–F grade, a breakdown of what's protecting you (and what isn't), and practical steps to fix each weakness. It's built for developers auditing their own sites, security-minded users who want to know what they're trusting, and anyone curious about what happens behind a web page. WHAT IT INSPECTS Security headers — Grades the page on Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy and X-Content-Type-Options, with a short explanation of why each matters. Cookies — Highlights cookies that are missing the Secure or HttpOnly flags. Cookie values are never read. Trackers and mixed content — Lists third-party tracker domains and any insecure HTTP resources loaded on an HTTPS page. Page scan — Catches real DOM issues: forms that submit over HTTP, password fields on non-secure pages, third-party scripts without Subresource Integrity, unsafe target="_blank" links, inline event handlers and more. Technology stack — Detects the CMS, frameworks, analytics, CDNs and libraries the site is running. Domain and DNS health — Optionally checks a domain's DNS records (A, AAAA, NS, MX, TXT, CAA) and email-security signals such as SPF, DMARC and DNSSEC. THE DETAILS THAT HELP - A score out of 100 alongside the letter grade - A Fixes tab that tells you exactly how to resolve each finding - Optional on-page alerts that warn you when a site has serious problems - A history of recently scanned domains - Copy the report or export the full results as JSON - Light and dark themes PRIVACY The extension keeps its analysis on your device. There are no accounts, no analytics, and no tracking, and your data is never sold or shared. The single exception is the DNS check, which is off until you click it and only ever sends the domain name to a public resolver (Cloudflare, with Google as a fallback). Privacy policy: https://bookmyspot.us/security-inspector/privacy.html