What are the security risks of StayFocusd – Website Blocker & Focus Timer & Shorts Blocker?

Based on our automated security analysis, StayFocusd – Website Blocker & Focus Timer & Shorts Blocker presents minimal risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Chrome Web Store Verified

StayFocusd – Website Blocker & Focus Timer & Shorts Blocker

by [email protected] · 700.0K users · 4.4 rating

ff75ec22-b33f-5114-814d-40191ad78b0d | v4.6.18

MINIMAL risk

-68 since v4.6.13

68 → 0 · false positives removed

Analyst verdict

No high-risk signal observed

Based on the RiskyPlugins AI security review of the observed evidence.

Analysis record

Analysed: 2 days ago
Version: v4.6.18
Artifact: SHA256 CE0…E75
Source: Findings (non-IoC)

Is StayFocusd – Website Blocker & Focus Timer & Shorts Blocker safe?

StayFocusd is a site blocker and focus timer for Chrome, published by the team at stayfreeapps.com and used by roughly 700,000 people. It works by running small scripts inside the pages you visit, which is why the scan found network calls in files like content-scripts/overlay.js and content-scripts/setting-up.js. The manifest record captured for this scan lists no permissions or host permissions, which cannot be right for an extension whose entire job is blocking sites. Treat that part of the record as missing rather than empty.

The most eye-catching item is a cluster of OBFUSCATION-UNICODE_HEAVY hits in content-scripts/usage-monitoring.js, content-scripts/blocked-statistics.js and chunks/settings-qqO8YvQZ.js. If those were a decoder hiding a payload, it would matter a lot. What the rule actually measures is how much non-English text sits in a file, and an extension shipping translated interface strings and emoji will trip it every time. Nothing in those files unpacks a string at runtime.

The other hits are simple call markers. NET-FETCH-content-scripts/ad-finder.js-1, NET-SOCKET_IO-content-scripts/setting-up.js-27 and NET-JQUERY_AJAX-content-scripts/overlay.js-35 record that code can open a connection. They do not record where it connects to, and no domain list came back with them. No malware signature and no stolen-credential pattern matched anywhere in the extension. A productivity tracker that never phoned home would not be tracking anything.

One thing a scanner cannot check is the store listing: the title borrows the name of an older, well-known blocker. That is worth knowing, though it is a marketing question rather than something the code does.

No Findings

All security checks passed

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

Noisy-finding weight

x1.00

Publisher domain

stayfreeapps.com

Observed

Store verification signal

Limited signal

Limited

Extension portfolio

Portfolio

13 evidence rows available.

No Threats Detected

This extension passed all security checks

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality moderate.

StayFocusd – Website Blocker & Focus Timer & Shorts Blocker is a Chrome site blocker published by [email protected], with about 700,000 users on version 4.6.17. The scan returned two kinds of finding: network call markers inside the content scripts, and UNICODE_HEAVY obfuscation hits across nine content scripts and two bundled chunks. No IoC, no malware signature, no secret, and no dependency finding came back.

The network findings are call-site markers. NET-SOCKET_IO-content-scripts/setting-up.js-27 and -31, NET-FETCH-content-scripts/overlay.js-20 and -21, NET-JQUERY_AJAX-content-scripts/overlay.js-35, NET-FETCH-content-scripts/smart-bomb.js-13, NET-SOCKET_IO-content-scripts/gen-ai-collector.js-13, NET-FETCH-content-scripts/ai-link-modifier.js-1, NET-SOCKET_IO-content-scripts/ad-finder.js-1 and NET-JQUERY_AJAX-content-scripts/in-app-blocking.js-576 each record that a script can open a connection through socket.io, fetch or jQuery. None of them names a destination. No domain list, no IP and no host entry shows up anywhere in this extension's findings. For a tool whose job is counting your minutes per site and enforcing limits, a socket client and periodic fetch calls are the mechanism. No endpoint was recorded, which leaves a gap in what was captured.

The obfuscation hits are one rule repeated: OBFUSCATION-UNICODE_HEAVY in usage-monitoring.js:380, smart-bomb.js:397, setting-up.js:303, overlay.js:20, in-app-blocking.js:303, gen-ai-collector.js:403, blocked-statistics.js:408, ai-link-modifier.js:397, ad-finder.js:397, chunks/settings-qqO8YvQZ.js:1 and chunks/_virtual_wxt-plugins-CbggpU_J.js:313. That rule counts non-ASCII character density. Translated interface strings, emoji in overlay copy and typographic punctuation all push the count up. A real encoder would come with a decoder call in the same file, and there isn't one here. Look at _virtual_wxt-plugins-CbggpU_J.js:313: that file name is a bundler virtual module, which is exactly where locale bundles land.

What did not fire matters as much. There are no credential-harvesting patterns, no embedded keys, no cryptominer code, no proxyware relay logic, no list of login domains, and no malware family match. The extension's category, a blocker that has to see every URL you load, fits the code that was found.

A skeptic would push back on two things. The title borrows StayFocusd, a well known older blocker, and a borrowed name is how lookalikes pull installs. Also, the manifest record for this scan carries no permissions and no host permissions at all, while a site blocker cannot run without host access, so the manifest portion of this scan is incomplete. Both points are fair. Neither one points at code doing harm: the naming is a store-listing question, and the missing manifest is a collection gap a re-run would close. The files themselves show bundled translations and ordinary backend calls from a published productivity app.

If the destination check needs finishing, content-scripts/setting-up.js is the file to read, since its socket connection string would name the backend.

Key Reasons

All network findings are call-site markers (NET-SOCKET_IO, NET-FETCH, NET-JQUERY_AJAX) in content scripts that a screen-time tracker needs in order to sync, with no destination recorded
Every obfuscation hit is the single OBFUSCATION-UNICODE_HEAVY rule on bundled content scripts and chunks, consistent with i18n strings and emoji rather than a payload encoder
Zero IoC, malware-signature, secret, dependency, or code-smell findings across the extension
Publisher is an identifiable company ([email protected]) and the feature set matches the stated category

False Positive Considerations

UNICODE_HEAVY rule firing on bundled locale and UI strings
Framework call-site detection (socket.io, fetch, jQuery ajax) with no endpoint extraction
Minified/bundled chunk files (chunks/settings-qqO8YvQZ.js) counted as separate obfuscation hits
Manifest arrays empty, so permission and endpoint context is missing from the scan

Reviewed 2026-10-18; recommended action: monitor; model confidence 72%.

Chrome version history

Risk trend by version

3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Latest

Change since first

+41

Change from previous

+41

Versions:

First analyzed version

4.4.1

Jan 21, 2026

Risk range

28 to 68

Across analyzed versions

Latest analyzed version

4.6.13

Sep 8, 2026

Selected version

minimal

Version

v4.6.18

2 days ago

Risk score

Findings

Change vs previous

-68

Pick any point on the chart to explore that version's code below.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

About This Extension

You sit down at the computer, and you swear you'll be productive. Next thing you know, it's twelve hours later. You've checked your email, updated your Facebook status, blown through 200 pages of Reddit, read every article in your Twitter feed, looked up your favorite band on Wikipedia, vanity googled yourself, cyber-stalked your ex, browsed through all your high-school crushes' Instagram feeds, and lost a week's pay playing online poker. What you haven't done is WORK. ✦ What is StayFocusd? StayFocusd, by Sensor Tower, is a productivity extension for Google Chrome that helps you stay focused on work by restricting the amount of time you can spend on time-wasting websites. It provides analytics to help you understand and control your internet usage, ensuring you remain productive throughout the day. ⭐ Our Features ⭐ 📊 Website usage history: Get statistics of your daily website usage history. 🚫 Configurable blocking: Block entire sites, specific subdomains, specific paths, specific pages, or even in-page content (videos, images, forms, etc). ☢️ The Nuclear Option: This powerful feature allows you to block access to websites for the number of hours you specify on the days you choose. Once activated, it cannot be canceled, ensuring you remain focused and productive. 📱Require Challenge: To change any settings, you must complete a challenging task. This reduces the temptation to alter settings, helping you stick to your productivity goals. 🗓️ Active Days/Hours: Customize the days and hours during which StayFocusd will restrict your access to distracting websites. This ensures that your productivity is maintained during critical work periods. ▶️ In App Blocking: Block all distracting components on YouTube and other major social media platforms. Hide shorts, comments, recommended videos, and more. 🤖 Gen AI Analytics: Track and analyze your usage of AI chat platforms directly from the StayFocusd. 🔒 Privacy protection: StayFocusd does not collect personal data from the web pages you visit. 🔗 Sync Usage Limits across devices: Connect Android devices and other browsers to view website and mobile app usage and limits in one place. ✦ YOU ARE IMPORTANT We value your feedback! Please rate us 5 stars on the Chrome Web Store to help us grow. Problems? Questions? Suggestions? Effusive praise? Email [email protected] PRIVACY NOTICE: When you install StayFocusd, it will ask you to grant a number of permissions, including “Read and change all your data on the websites you visit.” This permission is required in order for StayFocusd to run on any site which you may visit—without this permission, StayFocusd would not be able to block websites. While this permission technically grants StayFocusd the ability to read and change data, we will never collect personal data from the web page content that you are browsing.