Is SEMRush Rank safe?
SEMRush Rank transmits the full URL of each visited tab to rank.trellian.com on every page load and tab switch.
Each time you activate a tab or finish loading a page, the extension captures the full URL — including path and query string — and sends it to rank.trellian.com as a query parameter. Only the scheme and 'www.' prefix are stripped before transmission. A 20-slot in-memory cache prevents duplicate requests for the same hostname, but any hostname not recently seen is sent unconditionally.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Full tab URLs sent to Trellian for rank lookups
On tab open, reload, or switch, SEMRush Rank sends the active tab URL to rank.trellian.com/add.txt, stripping only the scheme and leading www., so paths and queries remain.
A GET carried the extension's own options-page URL.
You open, reload, or switch to a browser tab.
The extension sends the current tab address to Trellian when its local rank cache does not already have that host.
The code keeps a 20-entry host cache, so first visits and cache misses cause the request.
| Field | Value | Why it matters | |
|---|---|---|---|
Current tab address | chrome-extension://idbhoeaiokcojcgappfigpifhpkjgmab/options.html | Reveals the exact page you had open, not just the site name. Search terms or query values in the address stay in the value sent. | |
Path and query string | example.com/account/transfer?token=abc123 (illustrative) | The extension keeps the part of the address after the hostname, which can expose what you viewed or searched for on a site. | |
Source tag | sid=semrush | The request labels the lookup as coming from the SEMRush Rank extension integration. |
The shipped code reads the active tab URL and appends it to the Trellian request
semrush_rank: function () {
//xml url
var service_url = 'https://rank.trellian.com/add.txt?sid=semrush&url=';
var host = this.getHost(selectedUrl);
var url = this.getUrl();
var popularity = -1;
if(selectedUrl.match('^about:') || selectedUrl.match('^chrome:') || selectedUrl == '') {
chrome.action.setBadgeText({"text": ''});
return;
}
var last_use= -1;
for(var i=0; i<20 && popularity < 0; i++) {
if(semrush_cache[i] == null && last_use == -1) {
last_use = i;
}
if(semrush_cache[i] && semrush_cache[i][0] && semrush_cache[i][0] == host) {
popularity = semrush_cache[i][1];
}
}
if(popularity < 0) {
fetch(service_url + url).then(response => {
if (response.ok) {
return response.text();
} else {
throw new Error('Network response was not ok.');
}
}).then(text => {
var match = text.match(/[0-9]+/);
var popularity;
if (match) {
popularity = match;
} else {
popularity = "5M";
}
if (popularity >= 5000001 || popularity == 0) {
popularity = "5M";
}
semrush_cache[last_use]=new Array(2);
semrush_cache[last_use][0]=host;
semrush_cache[last_use][1]=popularity;
if(last_use >= 19)
semrush_cache[0] = null;
else
semrush_cache[last_use+1] = null;
toolBarBrowser.update_semrush_rank(popularity);
});
}
else {
toolBarBrowser.update_semrush_rank(popularity);
}
}getUrl: function () {
var url = selectedUrl.replace(/^https{0,1}:\/\//,'');
url = url.replace(/^www\./,'');
return url;
}chrome.tabs.onActivated.addListener(function() {
chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {
selectedId = tabs[0].id;
selectedUrl = tabs[0].url;
chrome.action.setBadgeText({"text": '', tabId: selectedId});
chrome.action.setTitle({title:"SEMRush Rank", tabId: selectedId});
toolBarBrowser.semrush_rank();
});
});
chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {
selectedId = tabs[0].id;
selectedUrl = tabs[0].url;
toolBarBrowser.semrush_rank();
});
chrome.tabs.onUpdated.addListener(function(tabId, props) {
chrome.tabs.query({active: true, currentWindow: true}, function(tabs) {
selectedId = tabs[0].id;
selectedUrl = tabs[0].url;
if (props.status == "complete" && tabId == selectedId)
toolBarBrowser.semrush_rank();
});
});- rank.trellian.com
Receives SEMRush Rank lookup requests at /add.txt with sid=semrush and the current tab address in the url query parameter.