The search results safety indicator by Threat Protection Pro™

What is the search results safety indicator feature?

The search results safety indicator by NordVPN’s Threat Protection Pro™ lets you know if the links in the search results are safe for you to click on or not. It works on the Google, DuckDuckGo, and Bing search engines.

But how does the search results safety indicator help you in your daily life? It helps you avoid three digital menaces — malware, scams, and phishing — which run wild on unsafe websites. For example, it informs you if it detects a fake website, like a fake online store, so you don’t stumble onto it by accident and create an account, or worse, pay for items you’ll never receive and have scammers steal your credentials.

The search results safety indicator is also a time-saving feature because it examines each search result for you so you don’t have to. It’s among several advanced browsing protection features that include a hijacked session alert, malicious website blocker, scam and fraud alert, and website safety alert. All of these features together — and each in its own right — help you to avoid fraudulent websites that host malware, phishing attacks, and scams.

How does the search results safety indicator work?

The search results safety indicator checks if the link in the search result is safe to open or not and shows either a green or a red shield next to it — green for a safe link and red for a potentially dangerous one.

You can move your mouse pointer on the shield icon to see the message with more details on what kind of suspicions the website has raised (malware, scams, phishing, insecure protocols, etc.).

If you still want to proceed and follow the link that the search results safety indicator flagged as potentially dangerous, you can do so at your own risk. However, you’ll receive one more warning from our browsing protection feature:

You can either click “Back to safety” to go back to the search engine window or click “Trust this site” and enter the website.

Interested to know what factors reveal that a website might be dangerous? The search results safety indicator feature uses several criteria to determine if a website is safe for you to visit:

• Blocklisting. If a website is listed on blocklists of malicious websites known for phishing, malware distribution, or scams, the search results safety indicator flags it as unsafe.
• Phishing activity. If the website is trying to mimic a legitimate website (such as a bank or an e-commerce site), it’s most likely unsafe.
• Pop-ups and redirects. Excessive pop-ups, redirects, or attempts to download files without user interaction can indicate malicious intent.
• Domain reputation. Older, well-established domains are typically more trustworthy, while newly registered domains or those with a history of suspicious activity may be flagged as risky.
• Unusual URL patterns. Suspicious patterns in the website’s URL (e.g., long strings of random characters or misspellings of well-known domains) may trigger a safety warning.
• User reports and feedback. If users have reported suspicious or malicious activity on the website, it’s marked as unsafe. You should also report a malicious website if you encounter one to the Google Safe Browsing team so they can block the site and keep other users safe.

How to turn on the search results safety indicator

If the advanced browsing protection in your NordVPN app is on, then so is the search results safety indicator, by default. To turn advanced browsing protection on, just open your NordVPN app, tap on the shield icon in the left panel, and tap “Turn on” in the “Advanced browsing protection” section.

However, you can turn the search results safety indicator off separately, even if the advanced browsing protection is on. Instead of tapping “Turn on” in the “Advanced browsing protection” section, select “Manage.” Then, toggle on the “Search results safety indicator” button.

However, we advise keeping the search results safety indicator on at all times.

What are the risks of unsafe websites?

Unsafe websites are breeding grounds for malware, which can secretly install itself on your device and steal sensitive information like passwords or credit card details. Many of these sites also engage in phishing — they are fake versions of real websites, designed to trick you into entering your login credentials or personal information. Once hackers get this data, they can easily commit fraud or identity theft.

Unsafe websites often run on an insecure protocol (HTTP) that does not encrypt your traffic. Without encryption, cybercriminals may intercept and leak any personal information you submit, like passwords or payment details. Always look for HTTPS and a padlock symbol in the URL bar to ensure your connection is more secure.

However, while HTTPS and a padlock symbol in the URL bar indicate a more secure connection, you should still remain vigilant because cybercriminals can also use HTTPS for phishing and other malicious activities. For added protection, you can use tools like NordVPN’s Link Checker to find out if the URL is associated with URL phishing attacks or some other malicious activity.