Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Several years ago it was possible to use

a:visited {
   background: url('/log.php');

to figure out on what website user has been previously. But now it is restricted by browsers. Is there any other way to know which websites user have been recently?

share|improve this question
up vote 5 down vote accepted

It is still possible. However, it is much harder to do unobtrusively now. See the following research paper for details of how to do it:

Important: please do not use this fto spy on visitors to your web site without their consent. That is an evil and nasty thing to do. It is also a bad business move.

We've been through this before. The last time some web sites tried using CSS history sniffing, they eventually got caught. The fact that they were using history sniffing got into the news, and caught the attention of the FTC and many others. Lawsuits were filed, and investigations were opened. So I think we have solid evidence that if you history-sniff your visitors, you are asking for trouble. For more information on this, see the following sources:

share|improve this answer

It's quite possible. The trick they've used to prevent this attack involves disabling CSS on the :visited selector. However, that doesn't stop the selector from still being there!

You can use JavaScript to iterate through a set of links, checking for the :visited selector on each. It's possible to do the check using cssRules, which should tell you which rules are being applied to a DOM element. Once you've found the visited ones, you can do an Ajax post back onto the site to store the results. There's a proof of concept of this trick, though there's no guarantee of it being correct and functional across all browsers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.