Browser Extensions and Your WordPress Login: What They Can See

In June 2026, Microsoft's Edge security team published an analysis of 119 browser extensions that had reached roughly 2.6 million users over about two years ^[1]. They looked like ordinary tools. Ad blockers, VPNs, translators, video downloaders. Most of them did exactly what they promised, which is how they collected their installs and their reviews.

Underneath, the code was watching for something specific on the pages its users opened: a WordPress login screen. When it found one, it recorded what was typed into the form and sent it away, together with a link that let the operators rank each stolen website by how much traffic it gets ^[1].

That detail matters to anyone who runs their own site. You can choose a long password, turn on two-step login, keep every plugin updated, and still hand over the keys. The leak is not on the server. It is in the browser you log in from.

This guide covers what an extension can actually see, the three routes by which a helpful one turns hostile, why the usual login protections miss it, and a short audit you can run on your own laptop today.

What a Browser Extension Can Actually See

Every extension asks for permissions when you install it. Most people click through that prompt in the same breath as the install button.

Google's own Chrome Web Store help sets out what those prompts mean ^[3]. At the top end, an extension with access to all data on your computer and the websites you visit "can access almost anything". One level down sits the permission most popular tools ask for: your data on all the websites you visit, which Google says covers every page you visit, your bank account included. An ad blocker needs that permission to do its job. So does a grammar checker, a coupon finder, a translator and a screenshot tool.

In practice, that means the free PDF converter you installed for one form last spring sits on the same page as your WordPress dashboard, your customer orders and your online banking. It can read what is on the screen and what you type into it. Approving that prompt is less like installing an app and more like giving a stranger a chair beside your desk, permanently.

Why This Applies to Almost Every Business Laptop

StatCounter's figures for Ireland show Chrome and Edge between them accounting for close to four in five desktop page views in September 2026, with Chrome on its own at somewhere under 60% ^[5]. Both browsers are built on the same engine and use the same style of extensions. The StegoAd campaign Microsoft analysed ran through the Edge store ^[1], and the ShadyPanda campaign covered later in this guide reached users of both ^[4].

So it does not matter much which of the two you prefer. If you log into your website from a desktop browser, this applies to you.

The Prompt Only Appears Once

The permission screen is a single decision taken on the day you install. After that, extensions update themselves quietly in the background, the same way your phone apps do. You agreed to the permissions once. You did not agree to whatever code arrives in next month's update, and you will not be asked again if that code stays within what you already approved.

Three Routes From Helpful to Hostile

Not every risky extension starts out as a trap. Researchers have documented three distinct routes, and they call for slightly different habits.

Route	How it happens	Documented example
Built to deceive	Works as advertised to earn installs, steals on the side	StegoAd: 119 extensions, 2024 to 2026 [1]
Trusted, then turned	Clean for years, then a routine update adds malicious code	ShadyPanda: about 4.3 million Chrome and Edge users [4]
Instructions fetched later	The reviewed code looks harmless; the real payload arrives from a remote server afterwards	StegoAd's remote code backdoor [1]

Built to Deceive

The StegoAd extensions were designed from day one to look useful. Microsoft's report describes them impersonating ad blockers, VPNs, translators and video downloaders, with the malicious code hidden inside the extensions' own image and font files and kept dormant for a period after install ^[1]. That delay matters. Anyone checking a new extension for odd behaviour on the first day would see nothing.

Once active, Microsoft documents capabilities "far beyond ad fraud": a backdoor that could run any code the operators sent, theft of Google account passwords and two-step codes, bulk copying of cookies, and harvesting of WordPress admin logins ^[1]. Microsoft has removed every identified extension from the Edge store and suspended the developer accounts behind them. Removal from the store, though, does not reach back into the logins already taken.

Trusted, Then Turned

The second route is harder to guard against, because the extension has a genuine track record. In December 2025, The Register reported research by Koi Security into an operation it named ShadyPanda, which it estimated had reached around 4.3 million Chrome and Edge users ^[4]. Some of the extensions involved had been uploaded in 2018 and 2019 and had earned Featured and Verified badges. After years of normal behaviour, updates turned them into a backdoor that checked in with a server every hour for instructions and could inject content into any website the user visited.

Treat the user count as one research firm's estimate rather than a census. The pattern is the useful part. A badge and five years of good reviews tell you about an extension's past. They tell you nothing about the update it will install on Tuesday.

Instructions Fetched Later

The third route explains why store checks alone cannot settle the question. Part of what made StegoAd effective was a backdoor that collected fresh code from the operators' servers and ran it inside the browser ^[1]. The code a store reviewer approved was not the code doing the damage. Microsoft's report also traces how the operators adapted each time detection improved, switching file formats and domains to stay ahead ^[1].

For a business owner, the consequence is simple. A clean bill of health on the day you install tells you very little about next quarter.

Why a Strong Password and Two-Step Login Miss This

Most website security advice concentrates on the login page itself: strong passwords, limits on repeated attempts, a second factor. All of that is worth doing. None of it was designed for an attacker who is already sitting inside your browser.

It Reads the Form as You Type

Microsoft published the relevant code in its report. It checks whether the page address contains the standard WordPress login or admin paths, then gathers every visible field on the form, password included, and labels each capture with the site's address and the user's country ^[1]. The operators then use a traffic-ranking link to sort the stolen sites by value.

Password strength is irrelevant to that process. A 30-character random password is captured exactly as easily as a weak one, because the extension is reading it as you enter it. That is the core reason a strong WordPress password is not the same thing as a safe one: the password only protects you while nobody else can see it.

It Copies the Session After You Log In

The second mechanism skips the password altogether. When you log in to almost any website, your browser keeps a small file called a cookie that tells the site you are already signed in. Google's Chrome team put the problem plainly in 2024: cookie theft "happens after login, so it bypasses two-factor authentication", and stolen cookies "continue to work even after the malware is detected and removed" ^[2]. Google was describing malware on the computer itself, but extensions with broad access can collect cookies too, and StegoAd carried a module that sent them off in bulk once an hour ^[1].

For you, that means an attacker can arrive at your dashboard already signed in as you. There are no failed login attempts and no unfamiliar password. Nothing on the login page looks wrong, because the login page was never used.

One honest caveat on the fix. Google has been building a way to bind a login session to the physical device, so a copied cookie is useless anywhere else ^[2]. It needs support from both the browser and each website, so treat it as a future improvement rather than something protecting your dashboard today.

What Happens After a Small Business Login Is Taken

Microsoft's report is blunt about why WordPress logins are worth stealing. It describes them as a class of login with direct cash value to the attacker, naming web shell access, SEO spam and hosting abuse ^[1]. Translated: a hidden back door into your site, pages of spam stuffed in among your own, and your hosting used to run someone else's operation.

The traffic ranking cuts both ways. A busy national retailer is a bigger prize than a local service business, and the operators sort accordingly. That does not make a small site safe. It means a small site gets used for the quieter work: spam pages that ride on your good name in Google, or a back door held in reserve.

Consider how this typically plays out, using a composite rather than a real case. A dog groomer in Laois installs a free video downloader to save a customer's clip of a freshly trimmed spaniel for Instagram. It works perfectly. A few weeks later, someone searching for the business by name finds results under the groomer's own web address selling cut-price designer handbags. A new administrator account the owner never created sits in the users list. The owner had two-step login switched on and every plugin updated.

Nothing on the website side failed. The leak was a free tool installed for one video clip, and the cost lands in the place that hurts a booking-led business most: the first thing a new customer sees when they search your name. That is why a complete WordPress security and backup routine has to include the devices you log in from, not only the server your site runs on.

How to Audit Your Browser Extensions in Five Steps

This takes about ten minutes on each computer you use to manage your website. Do it on the office desktop, the laptop at home and any shared machine that has ever been used to log in.

1. Inventory. Type chrome://extensions or edge://extensions into the address bar, or open Manage extensions from the browser menu ^[6]. Every extension installed on that browser profile is listed there.
2. Remove. Delete anything you do not actively use or do not recognise, which is Microsoft's own advice to end users ^[1]. In Chrome, select Remove on the extension's card ^[6]. Chrome's Safety Check, under Privacy and security in Settings, will also flag extensions that have since been taken down from the store.
3. Restrict. For what remains, open Details and change Site access from On all sites to On select, so it only runs when you choose it, or to On specific sites, listing only the sites it genuinely needs ^[6]. A grammar checker that only wakes when you ask it to cannot read the dashboard sitting in another tab.
4. Isolate. Create a separate browser profile with no extensions at all, and use it only for your website dashboard, your hosting account, your business email and your bank. Both Chrome and Edge support multiple profiles, each with its own extensions and logins.
5. Verify. Log in to your website from that clean profile. Open Users and confirm every administrator account is one you recognise. Then open your own profile page and select Log Out Everywhere Else, which ends every other active session on your account, including any copied ones.

The fourth step does the most work. Extensions are useful, and nobody is suggesting you run a business without a spell checker. The clean profile simply means the tools you browse with never share a room with the keys to your website.

If You Find Something You Should Not Have Installed

Finding a suspect extension is not proof your site was compromised. Treat it as a reason to rotate credentials anyway, because the cost of being wrong in the other direction is far higher.

Work from a device you trust, ideally not the one with the extension, and go in this order:

• Email first. Change the password on the email account your website and hosting send resets to. Whoever controls that inbox can reset everything else.
• Website and hosting account next. New passwords for both, followed by Log Out Everywhere Else on your WordPress profile.
• Your Google account after that. Microsoft specifically recommends reviewing recent sign-in activity at myaccount.google.com/security, given the two-step bypass it documented ^[1].
• The site itself last. Look for unfamiliar users, new plugins and pages you did not create, and ask your host to run a malware scan.

If the site has been altered, roll back to a backup taken before the extension went bad, not just the most recent one. And if an intruder could have reached customer enquiries or order details, that may be a personal data breach, which generally has to be reported to the Data Protection Commission within 72 hours where people are likely to be put at risk. Take advice from your solicitor or data protection adviser early rather than late.

What Your Hosting Can and Cannot Do

This is the limitation every host should be upfront about, ours included. No hosting platform can see inside your browser. A login using the right password, or a session copied from your own laptop, looks to the server exactly like you. Tools that block repeated guessing at the login page are valuable, but a correct password is not a guess.

So the measure of a host on this specific risk is what happens next. A platform that takes it seriously should do four things:

• Notice what an intruder leaves behind, through automatic malware scanning of the site's files, rather than waiting for a customer to report spam in your search results.
• Keep restore points that go back far enough, so you can roll back to before the compromise, not just to last night.
• Protect the state of the site before any restore, so rolling back does not destroy the evidence of what changed.
• Put a person on the other end of the phone, who will look at the production environment with you the same day.

Web60 is built to that standard. Sites run on hardened Irish infrastructure with automatic malware scanning and fail2ban intrusion prevention, with nightly backups, one-click restore and a safety snapshot taken automatically before every restore. When something looks wrong, you speak to our Irish support team, real people rather than an outsourced queue. All of it is included in the €60 a year, alongside the hosting, SSL and the AI builder that gets a new site live in under a minute.

Owning the site matters more than it sounds. WordPress runs roughly four in ten websites worldwide, according to W3Techs, and much of its appeal is that owners can run their own sites without a developer in the loop. Building and running your own site means you hold the keys. It also means the laptop you log in from is part of your security, and a short habit on your side does as much as anything the platform can do on ours.

When a Bigger Setup Makes Sense

If you run a firm where an IT provider manages every staff laptop, browser policy can control exactly which extensions staff are allowed to install, and Microsoft's own advice to enterprise security teams starts with browser policies that block the extensions it identified ^[1]. Pair that with an enterprise managed host offering hardware security keys and a dedicated security team, and you have a stronger arrangement for a business with dozens of people logging in. For an owner-operator with one laptop, the five-step audit above covers most of that ground for nothing.

The Short Version

The tools that make a browser pleasant to use are the same tools that can read everything you do in it. That is not a reason to give them up. It is a reason to keep them out of the one place they have no business being.

Open your extensions list today, remove what you do not use, and set up a clean profile for the website, the email and the bank. After that, an extension can turn hostile next spring and still find nothing worth taking.

Frequently Asked Questions

Can a browser extension steal my WordPress password?

Yes, if it has permission to read the pages you visit. Microsoft's analysis of the StegoAd campaign found extensions that checked whether the page was a WordPress login screen, captured every visible field on the form including the password, and sent it to the operators. Password strength makes no difference, because the extension reads the password as you type it.

Does two-step login stop a malicious extension?

Not reliably. Google's Chrome team has explained that cookie theft happens after you log in, so it bypasses two-factor authentication, and the stolen session keeps working even after the malware is removed. Two-step login still blocks plenty of other attacks and is worth keeping, but it does not protect a session copied from your own browser.

Are extensions from the Chrome Web Store or Edge Add-ons store safe?

Most are fine, but a store listing is not a guarantee. Researchers have documented extensions with Featured and Verified badges that behaved normally for years before an update turned them malicious, and others that fetched harmful code from a remote server after passing review. Install as few as you need and restrict their site access.

How do I see which extensions can access my website dashboard?

Type chrome://extensions or edge://extensions into the address bar. Open Details on each extension and look at Site access. Anything set to On all sites can read your dashboard whenever it is open, so change it to On select or On specific sites, and remove any you do not use.

What should I do if I installed one of the malicious extensions?

Remove it, then from a trusted device change your email password first, followed by your website and hosting passwords. Use Log Out Everywhere Else on your WordPress profile, review your Google account sign-in activity, check for unfamiliar administrator accounts and pages, and ask your host to scan the site. If customer data could have been reached, take advice on whether a breach report is required.

Sources