FR

Chrome extension · Manifest V3

Erdus Inspector, a one-click security and SEO audit of any page

Erdus Inspector is a Chrome extension I designed and built to audit the open page: security headers, cookies, exposed WordPress version, CDN cache and SEO tags. Every check is scored and explained, and the report copies as Markdown.

Install from the Chrome Web Store (opens in a new tab)Website development
  • Chrome Extension
  • Manifest V3
  • JavaScript
  • Web security

Erdus Inspector (in French)

The idea

I regularly run security audits of the sites I host and of my clients' sites. I wanted the core of those checks in the browser, on any page, with results I can show a client without jargon.

The extension collects nothing: the analysis runs in the browser and only contacts the audited site. It asks for the fewest permissions possible, and access to a site's cookies is granted only if the user decides so.

  • A score and an explanation for every check
  • No data collected
  • Minimal permissions, per-site access
  • Client-ready Markdown report

Key features

  • Security headers

    CSP (flagging 'unsafe-inline' and 'unsafe-eval'), HSTS, X-Frame-Options or frame-ancestors, nosniff, Referrer-Policy and Permissions-Policy, plus disclosed software versions.

  • Cookies

    Secure, HttpOnly and SameSite attributes of the site's cookies. Only session cookies lower the score: an analytics cookie set from JavaScript cannot be HttpOnly.

  • WordPress and CDN cache

    WordPress version exposed by the generator tag, ?ver= parameters or the readme.html file. Cache status read from Hostinger, Cloudflare, Vercel or LiteSpeed headers.

  • On-page SEO

    Title and meta description with their lengths, canonical, robots, Open Graph and Twitter card, single h1, heading hierarchy, images without alt, JSON-LD, lang and viewport.

  • Google and social previews

    The popup shows how the page will look in Google results and when shared on social networks, based on its tags.

  • On-page highlighting

    A toggle outlines images without alt, duplicate h1s and skipped heading levels on the page, in an isolated layer that leaves the site untouched.

  • Score and badge

    A score out of 100 per section and an overall score, shown in colour on the extension icon for the audited tab.

  • Markdown report

    The full report, with findings, explanations and the heading outline, copies in one click for a ticket, an email or a quote.

Technical choices

JavaScript with no framework, no dependencies and no build step: the extension folder ships as is.

  • Manifest V3

    A service worker runs the analysis; a script injected on demand reads the page and returns serialisable data, scored by the same code as the preview page.

  • Headers without webRequest

    Headers come from an anonymous HEAD request to the page, using activeTab's temporary access. webRequest would have required permanent access to every site.

  • Per-site cookie access

    Chrome does not hand cookies over under activeTab alone, so the extension then asks for access to the audited site only, through an optional, revocable permission.

  • Isolated highlight layer

    A closed shadow DOM and a constructed stylesheet: page styles cannot reach the layer, and the page's CSP does not block it.

  • Tested in a real Chrome

    The extension is loaded into a disposable headless Chrome driven over CDP, then run on several real sites to compare its findings with headers checked by hand.

  • Tooled publishing

    Dependency-free Node scripts build the Chrome Web Store package and the listing screenshots, rendered in headless Chrome from the real popup.

Technologies

  • JavaScript
  • Chrome Extensions
  • Manifest V3
  • Shadow DOM
  • Chrome DevTools Protocol
  • Node.js

Challenges and lessons learned

  1. Minimal permissions

    Reading a site's headers and cookies without asking for “access to all your data on all websites”: activeTab for the page, and optional access requested site by site for cookies.

  2. No false positives

    Trials on real sites fixed the analysis: SVG icon <title> elements, the jQuery version mistaken for WordPress's, and harmless cookies wrongly flagged.

  3. A report a client can read

    Each check carries a precise finding and a one-sentence explanation, so the report works for the developer and the client alike.

An audit of your site?

Security, performance, SEO: let's talk about your site in thirty minutes.

Free 30-min call

A 30-minute video call, no commitment, to frame your needs.