The Chrome Extension: Check a Page Before You Click

The Chrome Extension: Check a Page Before You Click

You're three clicks into checkout on a store you found through a Facebook ad twenty minutes ago. The prices are good — a little too good, maybe — and you're about to type in a card number on a site you'd never heard of before that ad. Chrome hasn't said a word. No red banner, no "dangerous site ahead," nothing. That silence is the part people misread as a clean bill of health.

It isn't one. It just means nobody's reported this particular site yet.

What your browser's warning is actually checking

Chrome's built-in "dangerous site" warning is real and it does catch things — it's checking the domain in front of you against lists of sites already confirmed as malicious or reported as phishing. That's a genuinely useful backstop, and it's why the obviously-recycled scam domains from six months ago tend to get flagged.

Here's the gap: a domain has to get reported, confirmed, and added to that list before the warning works. A store thrown up yesterday to ride a Facebook ad campaign for two weeks hasn't been anywhere long enough to earn that flag. Neither has a phishing page cloned overnight to catch people searching for a brand they trust. Chrome's silence on a new page isn't a verdict. It's just a page nobody's gotten to yet.

That's the specific gap the Cautellus Chrome extension is built to close — not replacing the browser's warning, but checking the thing in front of you against a record that updates more often than "eventually."

What it actually does

Install it and a shield icon shows up in your toolbar. From there you've got a few ways to check something, and none of them involve leaving the page:

Scan Page reads whatever tab is currently open and runs it through a full check — no copying the URL, no pasting anywhere.

Right-click any link and select "Check this link for scams." Works on a link inside an email open in Gmail, a link in a Reddit comment, a link in a DM you opened in a new tab — anywhere a link exists on a page, whether or not you're planning to click it yet.

The keyboard shortcut (Cmd+Shift+S on Mac, Ctrl+Shift+S on Windows) scans the current page without even opening the popup, if you'd rather not touch the mouse.

The popup itself has separate tabs for URL, phone number, text, and email, if what you're checking isn't the page you're currently on — a number that just texted you, an email forwarded from your mom, a listing you're eyeing on a different device.

Every one of those runs the same check: the page, link, or number gets matched against Cautellus's threat database — over 10,000 confirmed scam entities pulled from FBI IC3, FTC alerts, six Reddit scam-tracking communities, and global phishing databases tracking more than 770,000 malicious domains, refreshed every six hours. It also runs typosquat detection against major brand domains, which is the check that catches the version of Amazon or Chase's domain with one letter swapped — the kind of thing that's easy to miss reading fast on a phone and exactly the kind of thing a static blocklist won't flag until it's already burned somebody.

It doesn't run in the background the rest of the time. It only activates when you click it, right-click a link, or hit the shortcut — it's not watching your tabs while you shop.

The moments it actually earns the install

Not every page needs a check. Nobody's scanning their own bank's homepage. It's worth reaching for on the pages where something's already nagging at you:

A marketplace listing from a seller you've never dealt with. Especially if the price is good enough that you're already halfway to talking yourself into it.

A checkout page you landed on through an ad, not a search. Ad platforms don't vet storefronts the way you'd hope, and a domain that launched two weeks ago to run one campaign isn't going to be on anyone's blocklist yet.

A link from a DM or a comment, sent by someone you don't fully recognize, or by an account of someone you do recognize acting slightly off. Right-click it before you open it in the first place.

A search result that resolves to something almost-but-not-quite right — the layout looks correct, the logo's there, but the URL has an extra word in it or a domain extension that doesn't match what you expected.

That last one is the pattern behind most of what domain impersonation actually looks like — a page built to be indistinguishable at a glance, which is exactly why "glance" isn't a good enough check anymore. If you want the manual version of what the extension is automating — reading URLs character by character, checking domain age, spotting the extensions scammers lean on — this rundown of fake websites walks through it by hand, and this one does the same for storefronts specifically.

The FTC's own guidance on this is the same instinct in one line: verify through a source you already trust, not the one the message or the ad handed you. The extension is that instinct built into a right-click instead of a second tab.

What comes back

Every scan returns a verdict in three bands — safe, suspicious, or scam detected — along with a 0-100 score and the specific reasons behind it: a flagged domain, a typosquat match, an FBI alert tied to that pattern. It's not a black-box "trust me." You get the actual flags, so you can see what tripped the score instead of taking a color's word for it.

There are two buttons after every result: Full Report, which opens the complete breakdown on Cautellus.com, and Report Scam, which points you to exactly who to contact — FBI IC3, FTC, your bank — if the thing you just scanned turns out to be exactly what you suspected.

What it costs, honestly

The extension isn't a free product — it comes with one free scan to try it, and after that it's part of Cautellus Plus at $9.99 a month. Plus also gets you unlimited scans everywhere else on the site, not just in the browser. Most people get there through the 7-day free trial, which requires a card up front: you're not charged during the 7 days, and on day 7 the card is billed $9.99 and the subscription continues monthly unless you've cancelled first. Cancelling is self-serve through your account's billing portal — no call, no email you have to wait on.

If you check one weird link a year, honestly, the single free scan probably covers you. The extension starts paying for itself once checking-before-you-click turns into an actual habit — which, if you've ever caught yourself halfway through typing a card number on a site you can't quite place, it's worth admitting it already has.

Getting it running

Search "Cautellus" in the Chrome Web Store, click Add to Chrome, and pin the shield icon so it's visible in your toolbar. First scan is free and doesn't ask for a card. After that, sign in with your Cautellus account to unlock unlimited scanning — the full walkthrough with screenshots covers every step if you want the visual version, and the scanner itself works the same way if you'd rather check something from a phone or a computer without the extension installed.

Nothing you scan gets stored on Cautellus's servers — it's checked in real time and discarded. Recent scans stay local to your own browser, not on a company database somewhere.

FAQ

Does the extension work on any website? Yes. Scan Page works on whatever tab is open, and the right-click check works on any link on any page, not just ones on a preset list.

Does it monitor my browsing in the background? No. It only runs when you click the icon, right-click a link, or use the keyboard shortcut. It's not watching your tabs the rest of the time.

Is the extension free? It comes with a one-time free scan to try it, then it's part of Cautellus Plus at $9.99/month, which includes a 7-day free trial. The trial requires a card and renews at $9.99/mo unless you cancel before day 7 — cancellation is self-serve, no call required.

How is this different from Chrome's own "dangerous site" warning? Chrome's built-in warning is checking your destination against lists of sites already confirmed and reported as malicious. That's genuinely useful, but it means a brand-new cloned page can be live and collecting logins for a while before it ever earns a spot on that list. The extension checks the specific page, link, or number in front of you against a threat database that updates every six hours, plus typosquat detection that Chrome's built-in warning isn't running.

What happens to what I scan? It's analyzed in real time and discarded. Cautellus doesn't store your scan history on its servers — recent scans stay local to your browser only.

Do I have to copy and paste the URL myself? No. Scan Page reads the current tab automatically, and right-clicking a link scans it without you touching the address bar at all.

The good scam sites aren't sloppy anymore. Chrome's warning will catch the ones that have already burned someone else. The extension is for the one that hasn't, yet — which is the one you're actually looking at right now.