In short: This extension does not collect, transmit, sell, or share any personal data. All scanning happens locally in your browser. No analytics, no tracking, no external servers operated by the developer are involved.
Web Security Headers Checker lets you check the HTTP security headers of any website you choose to scan, assigns a security grade, and shows recommended fixes. It also optionally scans the response body of a scanned page for accidentally exposed API keys or credentials (e.g. Google API keys, AWS keys, Stripe keys), showing only a redacted preview of anything found.
Every scan is manually triggered by you — clicking "Scan," "Live capture," or opening the DevTools panel. The extension does not run in the background or scan anything automatically without your action.
| Data | Purpose | Where it goes |
|---|---|---|
| URL of the site you scan | To request that page's HTTP headers and (for the exposed-secrets check) its response body | Sent directly from your browser to the website you're scanning — the same as visiting it normally. Never sent to the developer. |
| HTTP response headers of the scanned site | Displayed to you as the grade breakdown and raw headers table | Stays in the extension's side panel / DevTools panel. Not transmitted anywhere else. |
| Response body text of the scanned site | Scanned locally, in your browser, against known credential patterns (e.g. AIza… for Google API keys) |
Processed entirely on-device. The full body text and any matched secret are never sent anywhere — only a redacted preview (e.g. AIzaBBBB…MBc) is ever shown or exported. |
| Active tab URL | To power the "Auto-detect this tab" and "Live capture" scan modes | Read locally via Chrome's tabs API. Not transmitted anywhere. |
| Captured headers per tab (Live capture) | Lets you view headers from the tab's actual page load | Stored temporarily in chrome.storage.session (in-memory, per browser session). Automatically deleted when the tab closes. Never leaves your device. |
| Permission | Why it's needed |
|---|---|
sidePanel | Renders the extension's main results interface in Chrome's side panel. |
tabs | Reads the active tab's URL only, to support auto-detect and live-capture scanning. |
webRequest | Read-only observation of response headers for the page you're viewing, to power the "Live capture" feature. No requests are blocked or modified. |
storage | Temporary, session-only storage of captured headers per tab, cleared automatically when the tab closes. |
Host permissions (http://*/*, https://*/*) | Required so you can scan any website you choose — the site is only ever contacted when you explicitly trigger a scan. |
Scan results exist only in the extension's UI for your current session and are cleared when you close the
side panel, DevTools panel, or browser. Live-capture data in chrome.storage.session is deleted
automatically when its associated tab closes, and does not persist across browser restarts. If you use the
"Export report (.md)" feature, the resulting file is saved to your own device via your browser's normal
download mechanism — the developer has no access to it.
This extension does not integrate with any third-party analytics, advertising, or data-processing service. The only network requests it makes are (a) to the website you explicitly choose to scan, and (b) none others. No data is sent to the developer.
This extension is a developer/website-operator tool and is not directed at children. It does not knowingly collect data from children.
If this policy changes, the updated version will be posted at this same URL with a revised effective date. Continued use of the extension after a change constitutes acceptance of the updated policy.
Questions about this policy or the extension can be sent via drfaizazizan.com.