I just took a look in my bug tracking software and noticed a lot of client-side errors that look like this:
SecurityError SecurityError (DOM Exception 18): Blocked a frame with origin "https://example.com" from accessing a frame with origin "https://staticxx.facebook.com". The frame being accessed set "document.domain" to "facebook.com", but the frame requesting access did not. Both must set "document.domain" to the same value to allow access. https://example.com/path:1:368 hasPasswordField_ https://example.com/path:1:499 hasPasswordField_ https://example.com/path:1:173 findPasswordForms https://example.com/path:10:27 global code
hasPasswordField_. So is a script from Facebook looking at my website’s DOM and trying to find password fields?