Privacy & Security Check
See exactly what your browser reveals about your connection and privacy preferences, explained in plain language rather than raw flags.
Persistent storage tells the browser not to auto-clear this site's local data under storage pressure. Most sites never request it, so "Not persistent" is normal.
Quick guide: how to use the Privacy & Security Check
Takes under a minute- 1Review each check to see what your browser exposes to websites.
- 2Confirm the connection is HTTPS and running in a secure context.
- 3Note which fingerprinting signals your browser leaks.
- 4Retest in a private window or with a different browser to compare.
Overview
Privacy on the web is made up of dozens of small technical details, most of which are invisible unless you go looking for them. Whether your connection is encrypted, whether cookies are allowed, whether you've asked sites not to track you, and whether the page you're on is embedded inside someone else's frame are all things that quietly shape what a site can learn about you and what it's legally or technically obligated to respect.
This tool checks six categories that matter in practice: connection security, cookie behavior, tracking preference signals, storage persistence, frame embedding, and referrer leakage. Each result comes with a plain-language explanation instead of just a raw true or false, because a green checkmark or a red flag means very little without context.
It's worth being upfront about the limits here. This page can tell you what your browser is currently reporting, but it can't tell you what a specific website actually does with that information once you visit it. Respecting Do Not Track, for instance, is entirely up to the site, not something your browser can enforce on its own.
How to read your results
Secure connection (HTTPS)
This is the single most important check on the page. A secure context means the connection between your device and the server is encrypted using TLS, which prevents eavesdropping and tampering in transit. Every reputable modern site should show as secure. If a site you're entering sensitive information into does not, that's a serious warning sign, not a minor technicality.
Cookies enabled
This reflects your current browser setting, not a specific site's cookie policy. Cookies are the mechanism most sites use to remember you're logged in between page loads, so disabling them entirely tends to break far more than it protects, though many browsers now block third-party cookies by default while still allowing first-party ones.
Do Not Track and Global Privacy Control
These are two different attempts, roughly a decade apart, to give users a browser-level way to opt out of tracking. Do Not Track never gained legal teeth and has fallen out of favor. Global Privacy Control is newer, is supported by Firefox and several privacy-focused browsers and extensions, and carries actual legal weight in states with comprehensive privacy laws.
Iframe and referrer policy
Being loaded in an iframe isn't inherently bad, plenty of legitimate widgets and embeds work this way, but it does mean the page is running with a different set of permissions than a normal top-level tab. Referrer policy determines how much of the URL you came from gets passed along when you follow a link elsewhere; stricter values protect more of your browsing context.
Troubleshooting
- If HTTPS shows as not secure, check the address bar for a padlock icon and verify you typed the correct URL; some sites still serve an insecure version at a slightly different address.
- If cookies show as disabled but you need to log into a site, check your browser's privacy settings for a per-site exception rather than globally re-enabling cookies everywhere.
- If Global Privacy Control isn't detected and you want it, check your browser's privacy settings (Firefox has it built in) or install a reputable privacy extension that supports it.
- If you're unexpectedly seeing "loaded inside an iframe," it may mean you reached this page through an embed, a proxy, or a translation service rather than directly; try navigating to the site directly in a fresh tab.
What this doesn't cover
This check focuses on browser-level signals and connection security. It does not scan a website for malware, verify its business legitimacy, or check whether its privacy policy matches its actual behavior. It also can't detect fingerprinting scripts running on other sites or tell you what data brokers may already hold about you from sources outside your browser entirely.
For a fuller picture of what a specific site can technically observe about your device, pair this check with the Browser Info test, which shows the detailed technical fingerprint (screen size, fonts, hardware details) that sites can read without any special permission.
Frequently asked questions
What does 'secure context' actually protect me from?
HTTPS encrypts traffic between your browser and the server, so anyone on the same network, including a coffee shop Wi-Fi or a compromised router, can't read or tamper with the data in transit. It doesn't protect what the site itself does with your data once received.
Does turning on Do Not Track actually stop tracking?
It sends a signal asking sites not to track you, but it's voluntary. Most advertising networks ignore it, and major browsers including Chrome have removed or de-emphasized the setting because it had so little real-world effect.
Is Global Privacy Control more effective than Do Not Track?
In some US states with privacy laws like California's CCPA, sites are legally required to treat a GPC signal as a valid opt-out request for data sale and sharing. It has real legal weight where DNT largely doesn't.
Why does it matter if a page is loaded in an iframe?
Pages embedded in iframes have restricted access to some browser APIs, cookies can behave differently across the frame boundary, and it's a common technique used in clickjacking attacks, so browsers apply extra scrutiny to framed content.
What is a referrer policy and why should I care?
It controls how much of the current page's URL gets shared with the next site when you click a link. A strict policy prevents details like search terms or internal page paths from leaking to external sites.
Why are cookies enabled by default?
Most sites rely on cookies for basic functionality like staying logged in or remembering a shopping cart. Browsers enable them by default because disabling them breaks a large fraction of the web.
Does disabling cookies stop all tracking?
No. Sites can also track visitors using techniques that don't rely on cookies at all, including browser fingerprinting based on screen size, fonts, and feature support, or first-party server-side identifiers.
What does 'persistent storage' mean here?
It's a browser API that lets a site ask not to have its locally stored data automatically cleared when the device is low on space. Almost no ordinary sites request or need this, so seeing 'not persistent' is completely normal.
Can a website see my real IP address even with these protections in place?
Yes, unless you're using a VPN or proxy. HTTPS, cookie settings, and privacy signals don't hide your IP address, which is visible to any server you connect to at the network level.
Should I be worried if HTTPS shows as not secure?
Yes, treat it seriously. On a non-secure page, avoid entering passwords, payment details, or personal information, since the data could be intercepted or altered in transit.
Does this tool change any of my browser's privacy settings?
No. It only reads your current settings and displays them. Any changes to Do Not Track, cookies, or Global Privacy Control need to be made in your browser's own settings menu.