For everyone · 4 minutes

Turn on Background protection

With Background protection on, PhishTriage checks each site you open and warns you if it is known to be dangerous. It is off until you turn it on.

What it does

Each time you open a website, PhishTriage checks the site’s name, for example example.com. If the site is known to be dangerous, a full-page PhishTriage warning covers the page within a few seconds. Its heading says “PhishTriage detected dangerous site”.

By default it sends only the site’s name, not the full address. It does not send what is on the page either; that only happens when you press Analyze Current Page yourself.

• PhishTriage keeps these site names, with this browser’s Device ID (a random code), in its records for a year. Then it deletes those records automatically. You, or your team’s owner, can choose a shorter time, from 7 days up, for site names sent after the choice. Site names sent before 4 October 2026 are deleted after 90 days. What PhishTriage sees explains how to choose.
• Our server’s log also notes each site name, with a coded form of your internet address (your IP address). Nothing in PhishTriage deletes this log automatically. If you ask, we clear your lines by hand: write to privacy@phishtriage.com. What PhishTriage sees says what to tell us.
• If you have signed in from this browser, the PhishTriage portal (our website where you can see your checks) shows the site names sent since then, under Visited URLs.
• If your browser is part of a team, what the portal shows depends on how the team is set up. In some teams, everyone in the team can see these site names, but none from before you joined. Your name is not shown next to them. In other teams, the portal shows only totals, to everyone, you included.

Turn it on

1. In the top-right corner of your browser, click the PhishTriage icon. A small PhishTriage window opens.

   If you can’t see the icon, see Something isn’t working.

2. Below the blue Analyze button, click Settings. The settings open underneath.

3. The first switch is Background protection. Click the switch.

   phishtriageReady

   Page detectedClick Analyze to triage the current page content.

   ▶ Analyze Current Page

   ⚙ Settings

   Background protectionChecks each site you visit. Warns within a few seconds if it’s flagged as dangerous.

4. Your browser may now ask if PhishTriage can have more access. If it asks, choose to allow it.

   This message comes from your browser, not from PhishTriage, and its words depend on your browser. It may mention your browsing history and the data on the websites you visit. That sounds alarming, but it is expected. PhishTriage needs this access to see which site each tab opens. It also needs it to put the warning on a dangerous page.

   If no message appears, you allowed it before. Go on to the next step.

5. Check that the Background protection switch is blue. If the PhishTriage window closed, click the icon and open Settings again to look. If the switch isn’t blue, click it again.

When you installed PhishTriage, a Welcome page opened. On that page the same switch is called Enable threat monitoring. It is the same setting, so you only need to turn it on in one place.

If you see Managed next to the switch and can’t move it, your organisation has set it for you. Ask your IT team.

Try it safely

PhishTriage always treats one harmless page as dangerous, so you can see the warning without any real risk. Your computer recognises this page by itself; it does not depend on a real threat.

1. Make sure Background protection is on.

2. Open this page: https://phishtriage.com/dangerous-example

3. Wait a few seconds. PhishTriage’s full-page warning appears over the page.

4. Click Go back to safety. You come back here.

If no warning appears, reload the test page once. If there is still no warning, check that the switch is blue.

What the warning looks like

The warning says the site may try to steal your passwords, install harmful software, or trick you into giving away personal details. The PhishTriage icon in your toolbar also shows a red ! on that tab.

You have three choices:

• Go back to safety takes you back to the page you were on before. If there was no page before, you get an empty page. This is the right choice almost every time.
• Details (shown in capital letters) opens a short explanation and one more choice.
• I understand the risks — continue to site is under Details. It removes the warning and shows the site. Only use it when you are sure the site is fine, for example on the safe test page.

If you already typed something into a page like this, see What if I already clicked?

What it can’t do

Background protection warns only about sites PhishTriage already knows are dangerous. A brand-new scam site may not be known yet, and if PhishTriage can’t be reached, you see no warning and no error. So no warning does not prove a site is safe.

If a page asks for a password, card details or money and you are unsure, check it yourself: Check a website.

“Send full URLs” is a different switch

Under Advanced, near the bottom of Settings, there is a separate switch called Send full URLs. It is off unless you turn it on.

It sends the whole address of every page you open, not just the site’s name. A full address can show which page you read, what you searched for, and sometimes your account name. While it is on, PhishTriage checks every page you open, even if Background protection is off.

Most people should leave it off. Background protection works without it.

Turn it off

1. Click the PhishTriage icon. A small window opens.

2. Click Settings. More options appear.

3. Click the Background protection switch. It is no longer blue. From the next page you open, sites are no longer checked, unless Send full URLs is on (next step).

4. If you turned on Send full URLs, click Advanced. More options appear.

5. If the Send full URLs switch is blue, click it. It is no longer blue.