Browser extensions can read and change what you see online, manage downloads and sometimes access data on every site you visit. A useful-looking coupon, AI, PDF or productivity extension can therefore become a serious privacy and account-security risk. Use this checklist before installing one.
Read the permission request literally
Permissions describe capability, not intent. “Read and change all your data on all websites” is broad access. It may be necessary for a password manager, but it is hard to justify for a simple clock or wallpaper extension. Choose the narrowest tool that solves the problem.
Check the real publisher
- Follow the extension link from the vendor’s official website.
- Compare the developer name, domain and privacy policy.
- Watch for misspellings and copied logos.
- Be cautious when a famous product has many near-identical listings.
Do not trust ratings alone
High ratings can be manipulated, inherited after ownership changes or based on an older version. Read recent critical reviews, check update history and look for reports of unexpected redirects, ads or search changes.
Warning signs
| Signal | Why it matters |
|---|---|
| Unrelated broad permissions | The extension can access far more than its function requires |
| No clear privacy policy | You cannot assess data collection or sharing |
| Forced search-engine or homepage change | Common sign of monetization or hijacking |
| Installed from outside the official store | Store review and automatic update protections may be bypassed |
| Sudden new behavior after an update | The code or ownership may have changed |
Use separate browser profiles
Keep banking and business administration in a clean profile with very few extensions. Use a separate profile for testing tools. This limits exposure if a low-trust extension misbehaves.
Audit extensions every month
- Open the browser’s extension manager.
- Remove anything you no longer use.
- Review site-access settings.
- Check whether permissions expanded.
- Update the browser and remaining extensions.
If you suspect an extension
Disable or remove it, restart the browser and check search, proxy and notification settings. Change important passwords from a clean device if credentials may have been exposed, and revoke active sessions. Run a trusted security scan. For a business website, review administrator accounts and recent changes as well.
Frequently asked questions
Are extensions from an official store always safe?
No. Store review reduces risk but cannot guarantee safety forever. Extensions can change behavior after updates or ownership transfers.
Can an extension steal passwords?
An extension with broad page access may be able to read information entered on pages, depending on browser protections and its permissions. Treat extensive access seriously.
Should I remove all extensions?
Not necessarily. Keep a small set from trusted publishers, grant minimum access and remove unused tools.
Extension hygiene is one part of business security. Also secure your domain, WordPress accounts and backups. See SiteChai’s WordPress 2FA guide and contact SiteChai if you need hosting support.