Extension Website Access Inspector

Extension website access inspector

Short answer

An extension website access inspector lists every host permission and content-script match pattern in the package. It shows whether access is limited to specific domains, expanded to wildcard subdomains or covers all sites. Website access is separate from API permissions and describes where the extension may read or change content.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Two sources of website access

Host permissions declare which URLs extension APIs can access. Content-script match patterns declare where injected files run. They often overlap but can differ, so the inspector reports both.

The report scores breadth and explains why: exact hosts, wildcard subdomains, wildcard schemes, all_urls and local file access each contribute differently.

Breadth is not behavior

A site-specific pattern is narrower than all_urls, but a narrow extension can still mishandle data on one sensitive site. A broad extension may be transparent and necessary, such as a content blocker.

The inspector provides the map. Code findings and the publisher's policy explain what happens inside it.

Reducing website exposure

Prefer extensions that use the narrowest host patterns, check whether the browser's site-access control can limit an installed extension, and remove extensions whose access is no longer needed.

Review access after updates, because new hosts or content scripts can appear in a new version.

Frequently asked questions

What is the difference between host permissions and content scripts?

Host permissions grant API access to URLs. Content scripts are code injected into matching pages. The patterns can be the same or different.

Does a content script run in iframes?

Only when all_frames is enabled and the frame URL matches the pattern. Otherwise it normally runs in the top-level document.

Can I restrict site access after installation?

Many Chromium browsers let you change site access for an installed extension. The extension's manifest still declares its intended reach.

Last reviewed: October 31, 2026

Or analyze from a store URL