Extenshiextenshi.io/blog
Back to articles
seo toolsextension reviewsprivacybrowser extensions

SEO toolbar extensions reviewed: which ones read every page you visit

SEO toolbar extensions have to read the page to grade it. I compared MozBar, Ahrefs, SEOquake, Keywords Everywhere and Similarweb on what each sends home.

Maxim Kosterin
11 min read

SEO toolbar extensions cannot grade a page without reading it. That's not a design flaw, it's the job. The interesting question is the one nobody asks at install time. Does it read the page when you click the button, or does it read every page you open, forever — including the ones that have nothing to do with SEO?

Both shapes ship in this category. The store listing looks nearly identical either way. And SEO people tend to install four or five of these at once and never revisit them. That makes this the most over-permissioned toolbar collection on the average marketer's laptop.

Semrush shipped a ground-up rebuild of SEOquake on September 9, 2026, so this felt like the right week to line the category up and look at it properly.

Quick verdict

  • Similarweb — the extension is the data product. Its own Chrome Web Store privacy disclosure describes collecting the list of pages you visit, along with page titles and visit times. It also lists categories of personal data the company may sell. Honest about it, which is more than most. Still the heaviest one here.
  • SEOquake (Semrush) — freshly rebuilt, and the store listing carries the strongest statement in this roundup: the developer discloses it will not collect or use your data. No account needed for the core reports.
  • Ahrefs SEO Toolbar — publishes a dedicated toolbar policy explaining exactly why it needs page HTML and what stays local. Good paperwork, genuinely useful reading.
  • Keywords Everywhere — sends your keywords (not your browsing) to fetch metrics, and says it doesn't store them. Needs an email for an API key.
  • MozBar — long-running, well-known, and its listing states Moz will not collect or use your data. Read the install warning anyway.
  • My take: pick one primary toolbar, set the rest to On click, and uninstall whatever you haven't opened in a month. The permission you leave running matters more than which brand you picked.

What SEO toolbar extensions actually do

Two separate jobs, and the privacy story lives entirely in the gap between them.

Job one: read the page in front of you. Title tag, meta description, headers, canonical, robots directives, image alt attributes, outgoing links. All of that comes from the DOM of the page you're on, which means running code inside that page.

Job two: fetch metrics about that URL from a server. Domain authority, backlink counts, traffic estimates, keyword volumes. None of that can be computed locally — the extension has to tell a server which URL you're looking at and get numbers back.

Job two is the one people forget. Every metric badge you see floating over a competitor's site is a URL that left your browser. For a competitor's site, fine, that's the point. For your bank, your CRM and your email, less fine.

The line that splits this category

Chrome's own docs draw the line for you. The activeTab permission gives an extension temporary access to the current tab only when you invoke it. That access is revoked when you navigate away or close the tab. Broad host permissions give standing access to every matching site whether you clicked anything or not.

Google's permission guidance for developers says the quiet part out loud. Prefer activeTab over host permissions where the extension only acts on user invocation, and prefer specific match patterns over the all-URLs wildcard. Limiting permissions, as Chrome puts it, also limits the blast radius if the extension is ever compromised.

I've written up what "read and change all your data on all websites" really buys an extension before, and the short version applies here without modification. That string is a standing window into every tab, not a one-time favour.

The good news is you get a veto. In chrome://extensions → Details → Site access, switching an extension to On click makes it behave as though it only had activeTab. Chrome documents this explicitly — the extension gets temporary access to a host only when you click it there.

For a toolbar you use deliberately, a few times a day, that costs exactly one extra click.

Similarweb: the extension is the product

Worth being precise here, because it's the most misunderstood tool in the category.

Similarweb sells traffic and market-intelligence estimates. Those estimates need a behavioural panel to calibrate against, and the company's own extension page is one of the ways that panel gets fed. The extension isn't a side project that happens to collect data — collecting data is structurally part of how the numbers you're reading get made.

Its Chrome Web Store privacy disclosure is the document to read before installing. Per that disclosure, the collected information includes the list of web pages a user has visited, along with associated data such as page title and time of visit. It also lists categories of personal data — identifiers, commercial information, internet and network activity, profiles and inferences — under the "may be sold" heading as defined by applicable US privacy law. Similarweb's corporate privacy policy covers the wider picture.

That is a disclosed, consented arrangement, and I want to be fair about it: the company tells you. The trade is real data for free competitive intelligence, and plenty of marketers will happily take it. Just take it knowingly, and ideally not on a work profile that also has your company's internal tools logged in.

Separately, Similarweb was among the entities named in The Register's coverage of the researcher known as "Q Continuum". The allegation: data collected by 287 unrelated Chrome extensions flowed to a set of analytics companies. That's a third-party allegation about other extensions, not about this one, and Similarweb has not publicly responded to those specific claims as of September 2026. I broke the mechanics down in how browsing-history exfiltration actually works.

SEOquake: rebuilt this month

Semrush relaunched SEOquake on September 9, 2026, and it's a real rebuild rather than a reskin. Semrush's own write-up is blunt about why. Several of the old extension's metrics depended on data sources that had shut down or become unreadable, and the UI still looked like the early 2010s. Existing users get it as a store update, no reinstall.

On privacy, the Chrome Web Store listing carries the strongest form of disclosure available: the developer states it will not collect or use your data. That's a different claim from "we don't sell it" — it says there's nothing being gathered in the first place. SEOquake's own policy page and Semrush's privacy policy cover the account side.

Connecting a Semrush account is optional and unlocks deeper backlink data. The core reports work without one, which means you can use this thing for months without handing over an email address. I like that shape a lot.

Ahrefs SEO Toolbar

Ahrefs is the one that bothered to write a plain-English document about the extension specifically. Its SEO Toolbar policy explains that the toolbar needs access to the HTML of the page you're browsing in order to report on-page data, count outgoing links and flag broken ones. It also states that HTTP status codes used to trace redirects stay inside your browser rather than going to a server. The policy notes read access to ahrefs.com cookies and use of local storage for settings.

That's the level of specificity I wish every vendor in this category shipped. Ahrefs says the toolbar is used by over 200,000 SEOs and marketers, and the core tools are free even without a subscription. The store listing is the place to check what the current build requests.

MozBar and Keywords Everywhere

MozBar is the old guard — its Chrome Web Store listing describes a V5 rebuild and a 48-hour cache to reduce redundant API calls against your Moz Pro limits, plus a user community north of a million. The listing states the developer will not collect or use your data. There's a Firefox build on AMO too, and it's worth checking that listing separately — the Firefox build's permissions are declared independently of the Chrome one.

Keywords Everywhere works differently enough to matter. It overlays search volume and CPC data onto SERPs, which means what it sends to a server is your query, not a running feed of your browsing. Its privacy policy states that keyword data is used only to return the metrics shown to you and isn't saved for other purposes. The store privacy disclosure adds that data isn't sold to third parties outside approved use cases. You do need an email address to get an API key.

The light picks

If all you actually want is "show me this page's meta tags", you don't need any of the above.

SEO META in 1 CLICK dumps title, description, canonical, robots, headers, image alt coverage, Open Graph and Twitter cards on demand. Detailed SEO Extension does the same job with a nicer panel and states it won't collect or use your data.

Both are single-purpose click-to-run tools, and single-purpose is the entire security argument. A tool with no server-side metrics has nothing to phone home about. It's the same split we drew in the text-to-speech extensions review: tools that only act when you invoke them, against the always-on ones. If you're a developer or a writer who checks meta tags occasionally rather than an SEO running competitive research all day, one of these replaces a full toolbar and its standing page access.

How to de-risk whichever one you keep

Four minutes, once:

  1. Open chrome://extensions, and actually read the SEO tools you forgot you had. The abandoned ones are the risk — an extension nobody maintains is an extension waiting to change hands.
  2. For each keeper: Details → Site access → On click. Toolbars are deliberate tools; they don't need to watch you read email.
  3. Use a separate browser profile for SEO work. Competitive research and your company's admin panels have no business sharing a cookie jar.
  4. Recheck after any major version bump. A rebuild — like SEOquake's this month — is exactly when a manifest changes, and Chrome will re-prompt only if the new permissions require it.
  5. Before you install the next one, read the store listing's privacy practices tab, not the marketing blurb. It's the only part of a listing the developer had to fill in under Chrome Web Store policy.

Final recommendation

Pick by what you actually do, not by brand loyalty.

Running daily competitive research? Ahrefs or SEOquake as your primary, on click, with the account connected only if you need the deeper metrics. Both publish specific documentation about what the extension does rather than pointing at a generic corporate policy.

Doing keyword work in SERPs? Keywords Everywhere is narrowly scoped to the job and says so.

Want Similarweb's traffic estimates? Install it knowingly, on a profile you use for research and nothing else, having read that privacy disclosure. It's an honest trade, but it is a trade.

Just checking meta tags now and then? Uninstall the toolbar entirely and use one of the click-to-run inspectors.

And if you've never counted how many of these are quietly running with full page access, that's the actual finding here — not any single vendor. Go look at what's installed.

See the security report for your SEO extensions →

Sources

This article is based on publicly available documentation published by the vendors named, their Chrome Web Store privacy disclosures, and official browser references, plus news reporting where cited. Extenshi does not independently verify all vendor claims, and store disclosures and permissions change between versions — check the listing for the build you are installing. References to specific companies or products reflect those companies' own published statements and do not constitute accusations of intentional wrongdoing. If any entity referenced in this article believes information is inaccurate, contact [email protected] and we will review and update.

Related Articles