Safe browsing
How to read a web address, what the padlock does and does not mean, malicious ads and fake downloads, browser extensions, and the settings that make your browser safer.
Read the address, right to left
The most useful browsing skill is reading a web address. The part that matters is the registered domain, the words just before the first single /, read from the right:
| Address | Real site |
|---|---|
https://www.paypal.com/signin | paypal.com |
https://paypal.com.secure-login.info/ | secure-login.info |
https://login-microsoftonline.co/ | login-microsoftonline.co (not Microsoft) |
https://accounts.google.com.verify-user.ru/ | verify-user.ru |
Everything to the left of the real domain can be chosen freely by whoever owns it. Attackers also use look-alike characters and typos (arnazon.com), so look carefully on important sites and use bookmarks for banking.
What the padlock means
The padlock (or "https") means the connection between you and the site is encrypted, so others on the network cannot read it. It does not mean the site is trustworthy. Most phishing sites today have a padlock, because certificates are free. Treat the padlock as a minimum requirement, not a seal of approval.
Fake downloads and malicious ads
Criminals buy search ads that look like the official download page for popular software such as browsers, video players, password managers or remote-desktop tools. The download contains malware, often an infostealer.
- Download software from the vendor's site that you navigate to directly, or from the official app store.
- Be careful with the "Sponsored" results at the top of search pages.
- Never install a "browser update" or "codec" because a website told you to. Real browser updates come from the browser's own settings.
Browser extensions: powerful and risky
Extensions can read and change everything on the pages you visit. Some are sold to new owners who push malicious updates.
- Install only extensions you really need, from well-known developers with many users and recent reviews.
- Review your extensions every few months and remove unused ones.
- A good content blocker such as uBlock Origin (or uBlock Origin Lite) also blocks many malicious ads; see browser hardening.
Settings that help
| Browser | Setting |
|---|---|
| Chrome | Settings > Privacy and security > Safe Browsing: "Enhanced protection" |
| Edge | Settings > Privacy, search, and services: Microsoft Defender SmartScreen on, "Typosquatting Checker" on |
| Firefox | Settings > Privacy & Security: "Block dangerous and deceptive content" on, HTTPS-Only Mode on |
| Safari | Settings > Security: "Warn when visiting a fraudulent website" on |
Also turn on HTTPS-only or "Always use secure connections" where available, and allow notifications only from sites you truly want to hear from. Scam sites love push notifications.
Browser notification spam
If you see fake virus alerts popping up in the corner of your screen even when the browser is closed, a site has been allowed to send notifications. Go to your browser's notification settings and remove permissions for sites you do not recognize.
Use separate browser profiles for work, personal and high-value accounts like banking. It keeps cookies and extensions apart and reduces the damage if one profile is compromised.
