Free Chrome extension
Scan the checkout page you're looking at, right now.
Every Stripe checker out there — including our own StripeCheckup — reads your source code. This reads the opposite side: what actually renders in a customer's browser. One click on the live page, free, nothing leaves your machine.
Install it (30 seconds, no Web Store yet)
- Download checkout-scan.zip and unzip it.
- Open
chrome://extensionsin Chrome. - Turn on Developer mode (top right).
- Click Load unpacked and select the unzipped folder.
- Open any checkout page, click the CheckoutScan icon in your toolbar, then Scan this page.
Frequently asked
What does this actually check?
Six checks against the live rendered DOM of the page you're on: a card-number input that isn't inside a Stripe Elements/Payment Element iframe (real PCI-DSS scope exposure), the page served over plain HTTP, mixed HTTP/HTTPS content, a Stripe test-mode key (pk_test_) on what looks like a production checkout, autocomplete left on for card fields, and a handful of other DOM-visible red flags.
How is this different from StripeCheckup?
StripeCheckup (our $49 audit) reads your source code and live API/webhook behavior. CheckoutScan reads the opposite side: what a customer's browser actually renders. It's a one-click sanity check, not a replacement for the full audit — use it to decide whether the full audit is worth running.
Does it send my data anywhere?
No. The scan runs entirely inside your own browser tab via Chrome's `scripting` API and never makes a network request. Nothing about the page you scan is stored or transmitted, by us or anyone else.
Why isn't this on the Chrome Web Store yet?
It's brand new. Until it's listed there, install it manually in under a minute — see the steps below. It'll move to the Web Store without any change to what it does.
Is it safe to install manually like this?
The extension only requests `activeTab` and `scripting` permissions — it can't read any tab until you click the toolbar button on that specific page, and it has no background or passive scanning. The full source is in the zip; open any of the .js files in a text editor before installing if you want to check for yourself.