Techniques are provided for a security policy for browser extensions. A first pattern is determined that is present in requests from client computing devices when a first browser extension is operating on the client computing devices. The first pattern is identified in a first request from a first client computing device to a first web server system. It is determined, based on identifying the first pattern in the first request, that the first browser extension is associated with the first request. It is determined that the first browser extension associated with the first request is whitelisted with respect to the first web server system based on a security policy. In response to determining that the first browser extension is whitelisted with respect to the first web server system, a first automated response is performed that causes the first web server system to process the first request.