How to audit the extensions you already have installed

Open your browser’s extensions page. If you are like most people, there are more entries than you expected and at least one you cannot account for. That matters because of what NCSC says an extension can do: they "typically have permissions to read or change the data on any websites a user visits". An add-on you have forgotten about still holds that access. This is a walk-through of clearing the list down to what you actually use.

What the audit is looking for

Three things, in order of how often they turn up. Extensions you no longer use but never removed. Extensions you never knowingly installed, which arrived bundled with something else or were added on a device someone else set up. And extensions you do use that have stopped being maintained.

All three are the same problem in different clothes: standing permission to read and modify your browsing, held by code nobody is watching.

Two things to sort out first

• Do this on each browser separately, and on each device. An extension list is per browser profile — clearing your laptop does nothing for your desktop or a second profile.
• Have a way back into anything an extension is currently holding. If a password manager extension is your only route to a credential, sort that out before removing anything.
• Expect to sign back into some sites afterwards. Removing an extension that managed sessions or cookies will log you out.
• Allow twenty minutes. It is not long, and rushing it is how you leave the one you could not identify.

The audit, extension by extension

1. Open the extensions or add-ons page from the browser menu. Do not use a search-engine result to get there — go through the menu.
2. For each entry, answer one question: what does this do for me that the browser does not already do? Tracking protection, pop-up blocking and password storage are built in now. A duplicate is permissions without benefit.
3. Open its details and read the permissions. "Read and change all your data on all websites" is the phrase to notice. Ask whether the stated function needs that.
4. Check the last-updated date and the publisher. An unmaintained extension with broad permissions is the clearest removal case in the list.
5. Remove rather than disable anything that fails. Disabled extensions get re-enabled by accident and by sync.
6. For the survivors, narrow site access where the browser offers it — "on click" or a named site list instead of all sites — and confirm the extension still works.
7. Finally, confirm automatic updates are on for the extensions that remain, as NCSC requires, and restart the browser.

The three findings that come up most often

• The one you cannot identify. It arrived with something else, or on a device someone set up for you. Remove it. An extension you did not choose has permissions you did not weigh up.
• The abandoned useful one. Still works, last updated years ago. NCSC’s point that extensions may contain security vulnerabilities applies here in full: no maintainer means no fixes, and the permissions remain.
• The duplicate. A tracker blocker sitting on top of the browser’s own tracking protection, or a password tool duplicating the built-in one. Two things doing one job is one extra set of permissions for no additional protection.
• The one that changed hands. Harder to spot, but a sudden change in behaviour, new permissions requested at an update, or unexpected advertising injected into pages are all reasons to remove rather than investigate.

Checking that it took

Reopen the extensions page after the restart and confirm the list matches what you intended. Then check your browser’s synchronisation settings: if extensions sync between your devices, a removal on one machine may or may not have propagated, and a stale copy on another device will happily sync back.

Also check whether your browser is genuinely up to date. CISA’s advice to close the browser out frequently exists because an update that has been downloaded is not applied until the browser restarts, and a browser that has been open for a month is running last month’s code.

What a clean extension list is not

It is not a defence against being sent somewhere fraudulent. That is addressed by reading the address bar — the FBI’s rule about misspellings and wrong domains, such as an address that should end in .gov ending in .com instead — and by the FTC’s habit of typing addresses directly rather than following links from messages.

It is also not the end of extension management. New devices, new profiles and helpful colleagues will refill the list. Put a reminder in for six months’ time and treat this as a recurring bit of housekeeping rather than a project you finish.

Sources: NCSC UK — Managing web browser security · CISA — Best practices against tracking technologies and spyware · FBI IC3 — PSA I-061019 on the lock icon and HTTPS · FTC — How to recognize, remove and avoid malware

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from NCSC UK, CISA, the FTC and the FBI. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.