Is SEOSpace - The SEO Plugin for Squarespace safe?
SEOSpace runs a content script on every site that relays page messages to its background worker, which can set the SEOSpace session cookie.
The extension injects a content script into every page you visit and relays window.postMessage and BroadcastChannel('seo-space') messages to its background service worker without checking which site or origin sent them. One relayed command, set_mirror_auth, writes a caller-supplied token into the SEOSpaceUserLogging session cookie on app.seospace.co, and other commands open caller-supplied URLs in new tabs. Because any web page can post these messages, an attacker page can set the value of your SEOSpace login cookie.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itAirwayz Capital SEO, LLC - no other listings under this identity, 1 shared hostname
Airwayz Capital SEO, LLC - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed SEOSpace - The SEO Plugin for Squarespace contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- app.seospace.co
SEOSpace - The SEO Plugin for Squarespace sends data to app.seospace.co. No other extension we have analyzed sends data here.