How does built-in Phishing and Malware Protection work?

Revision Information
  • Revision id: 64352
  • Created:
  • Creator: Abhimanyu
  • Comment: Condensed, rephrased, and increased the overall readability.
  • Reviewed: Yes
  • Reviewed:
  • Reviewed by: jsavage
  • Is approved? No
  • Is current revision? No
  • Ready for localization: No
Revision Source
Revision Content

Firefox contains built-in phishing and malware protection to help keep you safe online. These features will warn you when a page you visit has been reported as a Web Forgery of a legitimate site (also called “phishing” pages) or as an attack site designed to harm your computer (also called malware).

What is Web Forgery and Phishing?

Web forgery (also known as phishing) is a kind of "identity theft" when a fraud and/or illegal website impersonates a legitimate one to trick you into giving up sensitive information (such as your password(s), account details, or credit card numbers).

Phishing attacks usually come from email messages that attempt to lure the recipient into updating their personal information on fake, but very real-looking, websites. More information on phishing can be found at the Anti-Phishing Working Group, and there are a number of examples and resources available at the Wikipedia Phishing page.

What is Malware and an Attack Site?

Malware is a kind of software designed to infect your computer without your knowledge. Malware is most often used to steal personal information, send junk e-mail (spam), or spread more malware.

Attack sites are websites that try to infect your computer with malware when you visit them. These attacks can be very difficult to detect; even a site that looks safe may be secretly trying to attack you. Sometimes the website’s owner won’t even know that the site has been turned into an attack site. Such websites are essentially used for stealing sensitive information by hackers.

You can learn more about malware and attack sites from StopBadware, a non-profit organization that works with partners like Mozilla to protect users from malware and other dangerous software.

How do Phishing and Malware Protection work in Firefox?

Phishing and malware protection work automatically by monitoring your website visiting. Firefox automatically checks for the lists of websites that are reported (by volunteers, users, and even professionals) to be phishing or malware websites. The list is updated and downloaded every 30 minutes or so.

When you visit a website, and if that particular website resides in the lists, it will issue a warning or terminate your connection (however, you can force continue visiting the website if you want to, though that is highly not recommended).

The technical details of the safe-browsing protocol are also publicly available.

What information is sent to Mozilla or its partners when Phishing and Malware Protection are enabled?

There are two times when Firefox will communicate with Mozilla’s partners while using phishing and malware protection. The first is during the regular updates to the lists of reporting phishing and malware sites. No information about you or the sites you visit is communicated during list updates.

The second is in the event that you encounter a reported phishing or malware site. Before blocking the site, Firefox will request a double-check to ensure that the reported site has not been removed from the list since your last update. In both cases, existing cookies you have from, our list provider, may also be sent.

The Mozilla Privacy Policy expressly forbids the collection of this data by Mozilla or its partners for any purpose other than improvement of the phishing and malware protection feature. The Google Privacy Policy explains how Google handles user cookies.

How do I use the Phishing and Malware Protection features?

These features are turned on by default, so unless your security settings have been changed, you are likely to be already using them. Phishing and malware protection optionspreferences can be found on the Security panel: Click the menu button New Fx Menu Fx57Menu and choose Options.Preferences. by clicking on Security.

You can test to see if phishing protection is active by trying to visit our phishing test site. Likewise, you can try to visit our malware test site to confirm that Firefox is blocking attack sites as well. With the protection turned on, both sites should be blocked from loading.

I’ve confirmed that my site is safe, how do I get it removed from the lists?

If you own a site that was attacked and you have since repaired it, or if you feel that your site was reported in error, you can request that it be removed from the lists. We encourage site owners to investigate any such report thoroughly, though; a site can often be turned into an attack site without any visible change.