Is Serpstat Website SEO Checker safe?
Serpstat Website SEO Checker records every URL visited and periodically uploads the full browsing history to plugin.serpstat.com.
On each tab switch, the extension collects the current URL and timestamp, building a local history array. This history is encoded and POSTed to plugin.serpstat.com/history at an interval set by the server. Separately, the extension fetches the user's real public IP address at startup and includes it in analytics events sent to Google Analytics and a third-party OWOX analytics endpoint.
Who publishes itserpstat.com - no other listings under this identity, 5 shared hostnames
serpstat.com - no other listings under this identity, 5 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 5 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Device and identity fingerprint sent to Google Analytics and a third-party host
On startup and navigation, the worker sends an analytics payload, ID UA-11773021-10, to google-analytics.com/collect and google-analytics.bi.owox.com: client ID (cid/cd6), Serpstat uid (cd1), device memory (cd7), resolution (sr), IP (uip).
What actually happens
You switch tabs or load a page with the extension installed.
Startup, install and tab-navigation events all trigger the analytics send() routine.
The service worker sends a fingerprint payload to Google Analytics and to a third-party OWOX host.
The same parameter set goes to both www.google-analytics.com/collect and google-analytics.bi.owox.com.
Parameters carried in each analytics event
- Persistent client IDf642579720.1781525329
Long-lived identifier generated on install and stored locally, sent as cid and cd6. Ties events back to the same browser over time.
- Account user IDuser_id ("Unregistered" when signed out)
Your Serpstat account user ID, sent as uid and cd1 when you are signed in. It links the analytics stream to a named account.
- Public IP address82.3.220.102
Your device's real public IP, fetched from api.ipify.org and sent as uip.
- Device memory16
The device's reported RAM in gigabytes from navigator.deviceMemory, sent as cd7. A fingerprinting input.
- Screen resolution1920x1080
The screen width and height, read via the scripting API and sent as sr. A fingerprinting input.
- Browserchrome
The detected browser name, sent as the browser parameter.
The code that does this
send() serialises the parameter set and posts it to both the Google Analytics URL and the OWOX URL
background.bundle.js — send(): one query string, two destinations
js/background.bundle.jsvar gaUrl = t.gaUrl, // https://www.google-analytics.com/collect owoxUrl = t.owoxUrl; // https://google-analytics.bi.owox.com/UA-11773021-10var qs = "?";for (var key in t) { qs += t[key] && t[key].length > 0 ? key + "=" + t[key] + "&" : "";}fetch({ url: owoxUrl + qs }); // send fingerprint to OWOX hostfetch({ url: gaUrl + qs }); // send identical payload to Google AnalyticsCaptured request
Captured during dynamic analysis: the fingerprint payload sent to the third-party OWOX host, carrying the persistent client ID, device memory (cd7=16), browser, public IP (uip) and screen resolution. The identical parameter set was also sent to www.google-analytics.com/collect. Reproduced across two runs.
Where the fingerprint payload is sent
- www.google-analytics.com
Google Analytics collection endpoint; receives the full fingerprint payload under tracking ID UA-11773021-10.
- google-analytics.bi.owox.com
Third-party analytics host (OWOX BI), not Google Analytics; receives the same payload, including client ID, account ID, device memory, resolution and IP.
Public IP fetched from an echo service and attached to every analytics event
On startup, the background worker fetches the device's public IP from api.ipify.org and includes it as 'uip' on every analytics event, sent to Google Analytics and google-analytics.bi.owox.com.
The IP was unchanged across two test runs.
What actually happens
You start your browser with the extension installed.
No interaction is required; the analytics module initialises automatically.
The background service worker requests your public IP from api.ipify.org and stores it.
The returned IP string is held in memory and reused on every subsequent analytics event.
The code that does this
The analytics init routine fetches the public IP and saves it as the 'uip' parameter
background.bundle.js — analytics init()
js/background.bundle.jse.gaParams.cd7 = "".concat(navigator.deviceMemory);l.default.fetchText({ url: "https://api.ipify.org"}).then(function (t) { e.gaParams.uip = t; // store the returned public IP string});Captured request
Returns the device's real public IP as a plain text string (the value captured during dynamic analysis was 82.3.220.102, the test machine's IP).
Captured request
The same IP returned by ipify appears as the uip parameter on the outbound Google Analytics event. The identical value was also sent to https://google-analytics.bi.owox.com/UA-11773021-10. Reproduced across two dynamic-analysis runs.
Hosts involved in obtaining and receiving the IP
- api.ipify.org
Public-IP echo service queried on startup; returns the device's real public IP.
- www.google-analytics.com
Google Analytics collection endpoint; receives the IP as the uip parameter on every event.
- google-analytics.bi.owox.com
Third-party analytics host (OWOX BI); receives the same event payload including the uip parameter under tracking ID UA-11773021-10.
What it can do
Permissions this extension asks for, as declared in version 5.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
See the address and title of every tab you have open
tabs
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
Where it sends data
Destinations our analysis observed Serpstat Website SEO Checker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Serpstat Website SEO Checker sends data to www.google-analytics.com. A widely used service: 388 other extensions we have analyzed send data here.
- api.ipify.orgwidely used
Serpstat Website SEO Checker sends data to api.ipify.org. A widely used service: 58 other extensions we have analyzed send data here.
- plugin.serpstat.com
Serpstat Website SEO Checker sends data to plugin.serpstat.com. One other extension we have analyzed sends data here.
- google-analytics.bi.owox.com
Serpstat Website SEO Checker sends data to google-analytics.bi.owox.com. No other extension we have analyzed sends data here.