Features
Everything it checks, and everything you can change.
Phishing Protect does one job: compare the address of the page you're on against the addresses you said you trust. This page describes how that comparison works and where you get to adjust it.
Detection
The comparison rules
Every rule runs against the registrable domain — the part that actually determines who owns the site. An address either matches one of your domains exactly, resembles one, or is unrelated. Only the middle case produces a warning.
The address is one of your domains, or a subdomain of it. Nothing happens — no banner, no badge change, no delay.
Domains within one or two edits of yours: a letter added, removed, doubled or transposed. Catches yourbaord.com, youboard.com, yourboardd.com.
Substitutions that come from a slipped finger rather than a random letter, weighted by physical key distance — tourboard.com, yoirboard.com.
Glyphs that render alike are normalised before comparison: 0/o, 1/l/I, rn/m, vv/w, 5/s.
Internationalised domains are decoded from their xn-- form and checked for scripts mixed into a Latin name — the Cyrillic а, е, о, р, с and Greek equivalents that carry most homoglyph attacks.
Hyphens, dots and underscores inserted into or removed from your name: your-board.com, yourboard-login.com, your.board.com.
Your name wrapped in the vocabulary phishing pages reach for: login, secure, verify, account, support, official, app, help.
Your domain appearing anywhere other than at the registrable position — as a subdomain (yourboard.verify-now.net), a path (secure-cdn.net/yourboard/login) or a query value.
The same name under a top-level domain you haven't listed, including the near-misses .co, .cm, .om and .con that catch a mistyped .com.
Optional and off by default: flag any address containing a short string you specify, such as a brand stem, even when the rest of the domain is unrelated.
The warning
What you see when something is off
It covers the page
The warning is drawn over the content, not tucked into a corner. A page you were about to sign in to should not stay reachable behind a notification you can miss.
It names both domains
The address you're on and the one it's imitating, side by side, with the differing characters highlighted — so the answer isn't "trust us", it's "look".
It offers the real site
One button goes to the domain on your list. If you arrived by a mistyped address or a bad link, that's the whole fix.
It can be dismissed
Close it for this visit, or allow the domain permanently if you know it's legitimate. Allowed domains are listed in settings and can be revoked.
Settings
Your list, your rules
Any number of domains
Add as many as you like. Each one can carry its own alternates — the other top-level domains and spellings you legitimately own, so they never trigger a warning.
Three sensitivity levels
Strict flags distant resemblances. Balanced is the default. Relaxed warns only on close imitations. Set globally or per domain.
An allowlist
Domains you've marked safe are skipped entirely. Useful for staging sites, partner domains and anything a rule reads wrong.
Import and export
Settings move as a small JSON file. Copy a configuration between machines, or hand a prepared one to the people you support.
Sync, if you want it
Your list can ride your browser's own sync so it follows your profile, or stay on one device. The choice is a toggle, and local is the default.
A quiet toolbar icon
Green when the current page is a protected domain, grey when it's unrelated, yellow when something was flagged. Click it to add the current site.
Permissions
Why it asks for what it asks for
The comparison needs the URL of the page you're on. This is the permission your browser describes as reading your browsing history or site data; the extension uses it for the address only and never records it.
Holds your domain list, allowlist and settings inside the browser profile. Nothing else is written.
Required to draw the banner over a flagged page. It is only injected when a page is flagged.
The extension does not request permission to contact any server, because it doesn't contact one. There is no telemetry, no analytics and no update ping beyond the one your browser's add-on store performs on its own.
For site operators
If people are cloning your site
Clone sites target communities, not individuals — one convincing copy harvests hundreds of logins before a takedown lands. If you run the site being imitated, you can hand your members a configuration file with your domains and alternates already filled in, so installing takes one import and no decisions.
A branded build carrying your own name, icon and preloaded domain list is also available. Get in touch and describe the setup you need.
Compatibility
Where it runs
Firefox on Windows, macOS and Linux, and Firefox for Android. Chrome, Edge, Brave, Vivaldi and Opera on desktop through the Chrome Web Store listing. Both builds are Manifest V3.