Is Serpstat Website SEO Checker safe?
Serpstat Website SEO Checker records every URL visited and periodically uploads the full browsing history to plugin.serpstat.com.
On each tab switch, the extension collects the current URL and timestamp, building a local history array. This history is encoded and POSTed to plugin.serpstat.com/history at an interval set by the server. Separately, the extension fetches the user's real public IP address at startup and includes it in analytics events sent to Google Analytics and a third-party OWOX analytics endpoint.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Device and identity fingerprint sent to Google Analytics and a third-party host
On startup and navigation, the worker sends an analytics payload, ID UA-11773021-10, to google-analytics.com/collect and google-analytics.bi.owox.com: client ID (cid/cd6), Serpstat uid (cd1), device memory (cd7), resolution (sr), IP (uip).
You switch tabs or load a page with the extension installed.
Startup, install and tab-navigation events all trigger the analytics send() routine.
The service worker sends a fingerprint payload to Google Analytics and to a third-party OWOX host.
The same parameter set goes to both www.google-analytics.com/collect and google-analytics.bi.owox.com.
| Field | Value | Why it matters | |
|---|---|---|---|
Persistent client ID | f642579720.1781525329 | Long-lived identifier generated on install and stored locally, sent as cid and cd6. Ties events back to the same browser over time. | |
Account user ID | user_id ("Unregistered" when signed out) | Your Serpstat account user ID, sent as uid and cd1 when you are signed in. It links the analytics stream to a named account. | |
Public IP address | 82.3.220.102 | Your device's real public IP, fetched from api.ipify.org and sent as uip. | |
Device memory | 16 | The device's reported RAM in gigabytes from navigator.deviceMemory, sent as cd7. A fingerprinting input. | |
Screen resolution | 1920x1080 | The screen width and height, read via the scripting API and sent as sr. A fingerprinting input. | |
Browser | chrome | The detected browser name, sent as the browser parameter. |
send() serialises the parameter set and posts it to both the Google Analytics URL and the OWOX URL
var gaUrl = t.gaUrl, // https://www.google-analytics.com/collect
owoxUrl = t.owoxUrl; // https://google-analytics.bi.owox.com/UA-11773021-10
var qs = "?";
for (var key in t) {
qs += t[key] && t[key].length > 0 ? key + "=" + t[key] + "&" : "";
}
fetch({ url: owoxUrl + qs }); // send fingerprint to OWOX host
fetch({ url: gaUrl + qs }); // send identical payload to Google Analytics- www.google-analytics.com
Google Analytics collection endpoint; receives the full fingerprint payload under tracking ID UA-11773021-10.
- google-analytics.bi.owox.com
Third-party analytics host (OWOX BI), not Google Analytics; receives the same payload, including client ID, account ID, device memory, resolution and IP.
Public IP fetched from an echo service and attached to every analytics event
On startup, the background worker fetches the device's public IP from api.ipify.org and includes it as 'uip' on every analytics event, sent to Google Analytics and google-analytics.bi.owox.com.
The IP was unchanged across two test runs.
You start your browser with the extension installed.
No interaction is required; the analytics module initialises automatically.
The background service worker requests your public IP from api.ipify.org and stores it.
The returned IP string is held in memory and reused on every subsequent analytics event.
The analytics init routine fetches the public IP and saves it as the 'uip' parameter
e.gaParams.cd7 = "".concat(navigator.deviceMemory);
l.default.fetchText({
url: "https://api.ipify.org"
}).then(function (t) {
e.gaParams.uip = t; // store the returned public IP string
});- api.ipify.org
Public-IP echo service queried on startup; returns the device's real public IP.
- www.google-analytics.com
Google Analytics collection endpoint; receives the IP as the uip parameter on every event.
- google-analytics.bi.owox.com
Third-party analytics host (OWOX BI); receives the same event payload including the uip parameter under tracking ID UA-11773021-10.