Browser extension
A score before you click, not after
Checking a domain is only useful if you do it in time. An extension puts the score beside the link — in a search result, in an email, on a marketplace listing — while you are still deciding.
This does not exist yet
There is no extension to install today, and no store listing. This page describes what is intended and what is actually done, because a product page for a thing that does not exist is worse than no page at all — and because the site used to advertise this extension in its footer with nowhere to go. That link is gone; this page replaced it.
What it would do
Three things, and nothing else
An extension sees everything you browse, which makes restraint the most important design decision in it. The scope below is deliberately narrow.
-
A badge in the toolbar
The score for the site you are on, coloured by band. One glance, no click, no panel that covers the page.
-
A warning before a form
If a page in the bottom band asks for a card number or a password, say so before it is typed rather than after.
-
Scores next to search results
An unobtrusive marker beside links in a results page, so the choice is informed before the click rather than after the landing.
The hard part
Why it is taking a while
The engineering is straightforward. The privacy design is not, and it is the reason this has not shipped as a quick win.
The obvious implementation asks our server about every page you visit. That builds a complete browsing history on a server belonging to a site whose entire argument is that it does not collect anything — which would be indefensible, whatever the privacy policy said.
The alternatives each cost something, and the choice has not been made yet:
- Ship the corpus with the extension. No requests at all, but that is a large download that goes stale between updates.
- Query a hash prefix. Ask about a truncated hash so the server sees a bucket rather than a domain — the approach password-breach checkers use. Workable, and more complex than it sounds.
- Ask only on demand. Nothing is sent until you press the button. Perfect privacy, and it gives up the thing that made an extension worth having.
Whichever is chosen, two commitments hold: it will be open source, so the claim can be checked rather than believed, and it will never send a full URL — only ever a domain, or less.
In the meantime
Two things that work today
A bookmarklet-length habit
Any report is at a predictable address — /check-website/ followed by
the domain. Adding a browser keyword search for
https://legitsonar.com/check-website/%s gets you a report from the address bar
in two keystrokes, with no extension and nothing installed.
Or wire it into your own tools
The public API needs no key and answers in JSON. If you already have a moderation queue or a support desk, scoring links there is a few lines and does not wait for this page to change.