Can Websites Detect Which Browser Extensions You Use?

What a site cannot do

Can the sites you visit see what you have installed?

Not directly. A page cannot enumerate your extensions, and no browser exposes that list. The old chrome.extension methods that once allowed limited probing from a page were removed years ago, and modern browsers do not offer a replacement. An extension that keeps to itself — running only when clicked, touching no page content — is genuinely invisible.

But the comfortable answer stops there, and it should not, because a page can often work out a surprising amount from the side effects your extensions leave behind. It is detection by footprint rather than by name: it does not read your list, it looks for evidence that something is modifying the page.

Detection by side effect

The techniques in use all follow the same logic: an extension that does its job must interact with the page somehow, and each interaction is a place where a page can look.

Files the extension exposes

1. An extension that wants a page to load a file it ships — an image, a stylesheet, a script — must declare that file in web_accessible_resources.
2. The file then sits at a predictable URL, built from the extension’s fixed identifier. A page can request that URL and check whether the response is a real file or an error; a hit means the extension is present.

Changes to the page itself

1. Extensions inject nodes, add classes, set attributes and insert stylesheets. A page that takes a snapshot of its own markup can notice elements it never created, or attributes with telltale names.
2. Extensions that block trackers frequently override built-in JavaScript objects — fetch, XMLHttpRequest, methods on Object.prototype or Array.prototype. A page can check whether a function’s source text has changed, or whether a property is still native.

Probes and timing

1. The simplest test of all: a page loads a decoy element whose URL resembles an advertisement, or requests a known tracker domain, and waits. If the request never completes, an ad blocker or content blocker is likely present; that is how an adblock detector generally works.
2. Content scripts run before or alongside page scripts, so their presence can shift how quickly things happen; differences of a few milliseconds can hint at interference.

None of these is perfectly reliable. Each produces both false positives and false negatives, and browsers have closed several of the easier routes. But run together, they are more than good enough to sort visitors into rough categories.

Why a short list still tells a story

Even when detection succeeds only partly, the result is informative: a typical person runs a handful of extensions, not dozens, and the particular handful is telling.

Someone whose browser responds to every ad-blocking probe, whose built-in objects show signs of being wrapped, and which also reveals a container extension is not saying “I am one of millions”. They are saying something closer to “I am a privacy-conscious user of this particular browser”. The extension set behaves like a small fingerprint, one of the more stable and personal signals available.

That matters most when it is combined with everything else. On its own, an extension profile is coarse; stacked on top of your screen and window metrics and your browser’s rendering values, it narrows the field considerably. Extensions also reflect deliberate choices rather than hardware, and deliberate choices are what distinguishes you from the crowd.

There is an uncomfortable irony here: tools installed to reduce tracking can add distinctiveness. A browser with three privacy extensions is not blending in; it stands apart from the default configuration, and the more precisely a site can characterise those extensions, the more sharply it can describe you. We discuss the rule at more length in how to reduce your browser fingerprint: being unusual is not the same as being private.

A short verification checklist

The realistic options are modest, and honesty is better than false comfort. Work through this list and you will know where your browser stands.

1. Keep the list short, and prefer extensions that act only on demand: fewer extensions leave far less behind.
2. Use your browser’s built-in protections where they exist; native tracking protection does much of what a privacy extension would, without adding another detectable layer.
3. Do not assume you are invisible. Most people are not, and the tools that claim otherwise tend to add their own signals.
4. Open the extension detection test and see whether your browser responds to the common probes.
5. Check the adblock detector for the simplest test of all.
6. Run the fingerprint test afterwards to see how much of your uniqueness comes from what you installed rather than what you own.