Skip to content
Shahid Malla

SiteScout extension

SiteScout Privacy Policy.

Last updated October 12, 2026

Effective date: June 5, 2026 · Last updated: October 12, 2026

This privacy policy explains how the SiteScout Chrome extension ("the Extension") handles data.

Summary in plain language

SiteScout looks up public information about a website you choose to inspect. It only does anything when you click its toolbar icon. To run the lookups, it sends the domain name of that website to a few public lookup services. It never sends anything that identifies you: no browsing history, page contents, cookies or account details. SiteScout has no server of its own, no analytics, no telemetry, no accounts, and it stores nothing.

What the developer collects

Nothing. The Extension has no backend server, so no data is ever sent to the developer. It does not collect personal data, browsing history, page contents, form data, credentials or any identifiers.

What happens when you click the SiteScout icon

  1. Reads the current page in your browser. The Extension reads the page's performance timings (time to first byte, page load, transfer size, request count) from the browser's built-in Performance API. To read the page's HTTP response headers (server, CDN and security headers), it requests the current page's address once more from that website's own server, without cookies. That request goes only to the website you are already on. The results are shown in the popup and are not sent anywhere else.
  2. DNS lookups. The Extension sends the website's hostname and registrable domain (for example www.example.com, example.com and _dmarc.example.com), plus the website server's IP address for a reverse-DNS lookup, to Cloudflare's public DNS-over-HTTPS resolver at cloudflare-dns.com. Cloudflare's privacy commitments for this resolver: developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver.
  3. SSL certificate lookup. The Extension sends the website's hostname to the SSLMate Cert Spotter API at api.certspotter.com, which searches public Certificate Transparency logs (SSLMate privacy policy). If Cert Spotter is unavailable, the hostname is sent to crt.sh, a Certificate Transparency search operated by Sectigo (Sectigo privacy policy).
  4. Domain registration (WHOIS) lookup. The Extension sends the registrable domain to rdap.org, a public RDAP bootstrap service. rdap.org redirects the request to the official RDAP server of the domain's registry (for example, Verisign for .com), which receives the same domain name. RDAP is the official, standardized successor to WHOIS.

These services receive the domain name being looked up. Like any web server, they can also see your IP address and your browser's user-agent. The Extension sends them no cookies, browsing history or page contents.

Private addresses are never looked up. If the page is on an IP address, localhost, or an internal or special-use name (such as .local or .internal), SiteScout skips steps 2–4 entirely.

What the Extension does NOT do

  • Does not run in the background or on any page automatically. It acts only when you click its icon.
  • Does not read or transmit page content, form fields, passwords or cookies.
  • Does not track your browsing across sites.
  • Does not include analytics, telemetry, advertising or third-party trackers.
  • Does not store anything: no scan results, history or settings. Results are discarded when the popup closes.
  • Does not modify the pages you visit.
  • Does not sell or transfer data, and does not use data for any purpose other than producing the report you asked for.
  • Does not use data to determine creditworthiness or for lending purposes.

Permissions explained

  • activeTab gives the Extension temporary access to the current tab only, and only after you click the toolbar icon. It is used to learn which website to inspect and to read that page's timings and headers. Access ends when you navigate away or close the tab.
  • scripting lets the Extension run its own small, bundled data-collection function in the current tab after you click the icon. No remote code is ever run.
  • Host permissions are limited to the four public lookup services described above:
    • https://cloudflare-dns.com/* (DNS-over-HTTPS)
    • https://api.certspotter.com/* (Certificate Transparency search)
    • https://crt.sh/* (Certificate Transparency search, fallback only)
    • https://rdap.org/* (RDAP domain registration data)

Network requests per scan

For each scan of a public website, the Extension makes about:

  • 10 DNS queries to cloudflare-dns.com
  • 1 request to api.certspotter.com (up to 3 for domains with many certificates), or 1 to crt.sh if Cert Spotter is unavailable
  • 1 request to rdap.org, plus the redirect to the domain registry's RDAP server
  • 1–2 requests to the website you are inspecting, to read its response headers

Your control

The Extension does nothing until you click its icon. To stop it completely, uninstall it from chrome://extensions. Because it stores nothing, uninstalling leaves no data behind.

Limited Use disclosure

The use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the user-facing diagnostic report described above and on the Chrome Web Store listing.

Changes to this policy

If this policy changes, the new version will be published at the same URL and the "Last updated" date will be revised.

Contact

For privacy questions about this Extension, contact Shahid Malla.
Website: shahidmalla.com
Email: privacy@shahidmalla.com

See also the SiteScout terms of use and the SiteScout page.