Extension support

Chrome hands each shortcut to one extension only, and it refuses to assign one that is already taken, silently. Open chrome://extensions/shortcuts to see what is actually bound and to set your own. Chrome also reserves some combinations for itself, including Ctrl+Shift+I for DevTools, which no extension can claim.

Each settings page has a reset that empties its entire local store: "Reset WebInspect", "Reset WebGuard", "Reset SiteExtract" and "Reset ShopInspect". Uninstalling removes it all too. Nothing is held on a server, because there is no server, so there is nothing else to request and nobody to ask.

Where an extension asked for host access after install, the same settings page can withdraw it. You can also manage it in Chrome, under the extension's Details, "Site access". Anything the extension can no longer do, it will say so rather than failing quietly.

Chrome does not allow extensions to read its own pages, the Chrome Web Store, or the built-in PDF viewer. That restriction is the browser's and applies to every extension. The popup will tell you that is what it has run into rather than showing an empty result.

Each extension publishes its own, saying exactly what that one reads and stores: WebInspect, WebGuard, SiteExtract and ShopInspect. There is a link to it inside each settings page too.

It is probably on the skip list: 522 well-known sites that WebInspect does not read unless you ask. Large platforms, where a report is not actionable, and pages that routinely hold personal information. The popup names the site and why, and offers both ways out: inspect it this once, or turn "Inspect major and personal sites" on in settings.

Two settings govern that. "Show the score on the toolbar" puts it there after an inspection, and "Inspect a page when it loads" is what produces one without you asking. The second is off by default and needs access to the pages you visit, which Chrome will ask about separately.

Link checking is off by default and needs a permission you grant explicitly, because it makes real requests to every link on the page. Turn on "Allow link checking" in settings and grant host access when asked. It only ever runs when you press the button.

Detection is rated detected, likely or possible rather than asserted, and every entry shows the evidence behind it. If the evidence looks right but the conclusion is wrong, send us the page address and what it actually runs on: that is exactly the kind of report that improves the detector.

Reports are cached for five minutes, keyed by address, so reopening the popup on the same page is instant. "Clear cached reports" in settings empties it immediately, and the cache holds at most twelve entries in any case.

Add it to your trusted sites from the popup and WebGuard stops warning you about it; the list is editable in settings under Trusted sites. Every signal shows what it saw, so you can judge whether the finding is wrong or whether the site is genuinely doing something odd. If it is a real false positive, please send us the address.

Because a warning that arrives after you have typed your password is not a warning. Automatic protection means checking each page as it loads, and Chrome asks for that access at install. What is read is listed in full in the privacy policy, and it is sent nowhere. You can turn the individual warnings off in settings if you would rather it stayed quiet.

That is the honest answer rather than a clean one: an empty or stale database is never presented as a pass. Lists need "Allow online checks" on, since they have to be downloaded. Some feeds also need a key you supply yourself, because an extension cannot keep a secret; those stay off and say so until you add one.

It needs "Allow online checks" on, and that is off by default. With it off WebGuard makes no network requests at all. With it on, the password is hashed on your device and only the first five characters of the hash are sent, so the check never transmits the password itself.

"Warn me before I send sensitive data" in settings turns the paste and blur-time scan off. Worth knowing first: the scan runs inside the page, returns a label, a confidence, an offset and a masked preview, and there is no field in the result for the matched value. It is structurally unable to keep or send what it found.

History is off by default. Turned on, a record holds a hostname, a verdict, a score and a time, and pages you merely visit are never recorded. "Clear history" in settings empties it, and turning the setting off stops new records.

It is on the block list: 522 well-known sites SiteExtract never reads. Large platforms, and pages that routinely hold personal information such as webmail and banking. The popup names the site and why. There is no override, because a snapshot writes the page as you see it into a file.

Usually access to other domains was declined, so files on CDNs stayed remote. Grant it under "Host access" in settings and extract again. Every file that failed is listed in report.json with its reason, and it keeps its original URL, so the page still loads it while online.

Snapshot mode removes every script, so the page is static and safe to edit. Switch the popup to Source mode to keep the scripts, saved to js/. Apps that load their content at runtime may still need to be online.

Wherever your browser saves downloads. The extract tab also keeps a "Download ZIP" button until you close it, in case the first download was blocked or missed.

It reads one product at a time, so a search, category or basket page has nothing for it to inspect. The popup lists the signals behind that judgement, because it is occasionally wrong. If it is wrong on a real product page, send us the address.

The price section lists the runners-up, so check which figure it chose over which. Some stores draw the price only after you pick a size or colour, and the ↻ button reads the page again. If it is still wrong, "Save page evidence" at the foot of the report writes a file we can fix it from.

That is an answer, not an error. The listing stated too little of what ShopInspect looks for, under 40%, so any verdict would be a guess. The report still shows what it did read.

Only two features need it: automatic inspection, and reading a product from a listing page's grid, which happens in a tab ShopInspect opened. Both ask when you use them and do nothing if you decline. Withdraw it any time from settings.