TrustScore

The Problem People browse the web and hand over passwords, personal data, or payment details every day without any quick way to judge whether a site follows basic security practices. Phishing pages, outdated JavaScript libraries with known vulnerabilities, missing security headers, and forms without CSRF protection are all invisible to the average user — until something goes wrong. The Solution Site Trust Score is a Chrome extension I built that automatically analyzes every website a user visits and assigns a live trust score from 0 to 100, shown directly on the extension's badge with a color code: green for Safe, orange for Caution, red for Risky. The extension works in two levels. Level 1 runs automatically on every page load: it checks whether the connection uses HTTPS, queries the Google Safe Browsing API for known malware or phishing, reads security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options), and inspects cookies for Secure and HttpOnly flags. The badge updates instantly, and a browser notification fires if a site scores as Risky. Level 2 is an on-demand deep scan the user triggers from the popup. It scans the live page for outdated, vulnerable JavaScript libraries (old jQuery, Angular 1.x, Bootstrap versions), detects mixed content (HTTP resources loaded on an HTTPS page), flags forms missing CSRF tokens, searches for exposed API keys or secrets left in the page source, and looks for internal file paths leaked in HTML comments. Results are merged with Level 1 findings and the score is recalculated. The extension also includes a Pre-Scan feature: users can type in any URL from the popup and get a preliminary safety check before ever navigating there. Target Users Everyday internet users who want an at-a-glance security signal without technical knowledge, as well as developers who want a quick sanity check on their own sites during testing. What Makes It Unique Unlike the simple HTTPS-only padlock icon built into browsers, Site Trust Score combines multiple independent signals — network-level headers, malware databases, and live static analysis of the page's own code — into a single, transparent score with a full breakdown of exactly why points were deducted. The two-tier design balances speed and depth: the automatic Level 1 check is instant, while the optional Level 2 deep scan is available whenever the user wants a more thorough look, without forcing a slow scan on every single page load. Impact By surfacing concrete security red flags directly in the browser toolbar — in real time, with no setup — users can make more informed decisions before entering sensitive information, reducing exposure to phishing sites, outdated vulnerable code, and insecure forms, all without needing any security expertise themselves.