Check the code before it goes on your site.

Not a security badge someone sold us — a list of claims you can test yourself. The file you receive is plain, unminified JavaScript: hash it, read it, paste it into any AI you trust and ask what it does. Put it on your site only after that. If it is not what this page says it is, tell us — the refund policy is there for exactly that.

1. What you are about to check

One file of plain JavaScript. No build step, no minifier, no dependencies, no package manager. The hash below is the hash of that file — the same bytes ship as js/yearalert.js inside the zip, inside the WordPress plugin, and behind the Copy full script button of the install guide once your purchase unlocks it.

File

yearalert.js · yearalert/js/yearalert.js in the zip

Size

13,372 bytes

SHA-256

eca78f60c77a73b0c2eab560a2abc0ac0c2459e5598cab9bec9203af36986e61

Unzip what you downloaded and check that the file is the one we published:

macOS / Linux   shasum -a 256 yearalert/js/yearalert.js
Windows         certutil -hashfile yearalert\js\yearalert.js SHA256

Two honest footnotes. The hash is of the script, not of the zip: zip archives record build timestamps, so their digest changes without a single byte of code changing — the script is what runs on your site, so the script is what we pin. And if you take the snippet by copying it off the install guide rather than by unzipping the file, you get the same code but not necessarily the same hash: a pasted block carries whatever trailing whitespace your editor decides to add. Hash the file, not the paste.

2. What it does — and what it cannot do

Every line below is in the source you receive; nothing here is a promise made outside the code.

Those absences are greppable. On the file you downloaded, this prints nothing:

grep -nE "fetch|XMLHttpRequest|sendBeacon|localStorage|sessionStorage|document\.cookie|innerHTML|eval\(|new Function|createElement" yearalert.js

3. The limits, stated by us first

• It runs in the visitor's browser. The year on screen is always current; the HTML stored on your server still contains the old one. Anyone who views source, or browses with JavaScript off, sees the old year. That is the trade for not needing your passwords.
• A year followed immediately by another group of digits is left alone. © 2019 100 Main St will not be updated. This is deliberate. A phone number like 33 3613 2018 looks exactly like a year to any rule simple enough to be safe, and rewriting a customer's phone number on their live site is far worse than leaving a year stale: a stale year is visible and fixable, a broken phone number is neither. So when the two readings are ambiguous, the script does nothing.
• It only sees its own page. A year drawn inside an image, a PDF, a <canvas> or another site's embedded widget is out of reach.
• A year with no copyright marker in the middle of a page stays put — a project called CROC 2020 is not a copyright line, and it would be wrong to touch it.
• A founding year is never touched, even in the footer and even beside a ©. Est. 1998, Founded in 2009, Family owned since 2012, desde 2011, seit 1995, depuis 2007, с 2015 года are facts about your business, not a stale copyright. The flip side: a copyright written as © since 2015 is left alone too.

4. Don't take our word for it — ask a machine that has no stake

Open yearalert.js from your download, paste it into ChatGPT, Claude, Gemini or whatever you already use, and paste this after it:

This JavaScript is about to go into the footer of my website. Read it and tell me plainly: does it send any data anywhere, does it load anything from another server, does it store anything in my visitors' browsers, can it break my page, and is there anything in it that is not needed for the job it claims to do? Quote the lines that back each answer.

Copy the question

An AI reading this file has no reason to be kind to us, and the file is short enough to read in full — that is the point of shipping it unminified. If an answer contradicts anything on this page, we would genuinely like to hear about it: support@yearalert.com.

Prefer tools over opinions? Upload the file to VirusTotal for 70+ engines, or paste it into JSHint — it is ordinary, standards-compliant code with no syntax anyone has to be clever about.

5. Where the code is

In your download, and nowhere else: we do not publish the source on this site. It reaches you with the purchase, unminified and with its comments — they explain the awkward decisions, which is where a script like this would hide something if it wanted to. Read it before it touches your site.