Note · 11 November 2026
Red warnings and lost visitors
Some blocks are not in the network at all. They are in the browser: a full-page red warning that says your site is dangerous. Most people do not click past it.
What the research says
Devdatta Akhawe and Adrienne Porter Felt measured how users react to browser security warnings, using telemetry from over 25 million warning impressions in Firefox and Chrome. Users continued past:
| Warning | Firefox | Chrome |
|---|---|---|
| Malware and phishing | about 1 in 10 | about 1 in 4 |
| TLS certificate | about 1 in 3 | 70.2% |
Source: D. Akhawe, A. P. Felt, "Alice in Warningland", USENIX Security 2013.
Read the other way: a malware or phishing warning in front of your page loses roughly three quarters to nine tenths of the visitors who reach it. For a checkout page or a campaign landing page that is the whole day.
How sites end up flagged
Warnings come from reputation lists such as Google Safe Browsing, Microsoft SmartScreen, operator filters and CDN-level checks. They are built to catch fraud fast, and false positives happen to legitimate sites: a compromised plugin, a login form that resembles a known brand, a new path that a classifier did not like. Reputation is often per URL, not per domain, so the homepage can be clean while one path is flagged. Site owners on Cloudflare's community forum describe "Suspected phishing" interstitials on a single checkout URL or right after deploying an OAuth login. (example)
Network filters behave similarly. In Poland, operators block domains on the CERT Polska warning list in DNS. Orange's own filter, CyberTarcza, blocked 345,000 phishing domains in 2025 (Orange Polska). A legitimate domain listed by mistake is blocked the same way as a real phishing site.
What linkspect checks today
- Google Web Risk lists (the commercial counterpart of Safe Browsing) for the full URL and for the domain.
- Chrome's lookalike-domain rules, which produce the "Did you mean…?" warning.
- Google's Ad Experience Report for desktop and mobile.
- Public filtering resolvers: DNS4EU, CleanBrowsing, Cloudflare for Families, Quad9, AdGuard, OpenDNS.
- Optional operator filters, measured through subscribers who have them on: Telenor Nettvern+, reported as a separate group and marked "likely" at most. Vodafone's and O2's optional security filters are not measured yet: we have not found test connections with them switched on, so that part of the answer says "not measured".
- Operator DNS blocks from lists like CERT Polska's, as part of the normal per-provider verdict.
Not yet: a real Chrome and Edge rendering your page, which is the only way to see SmartScreen and Chrome's on-device phishing model, and Cloudflare's interstitial. Both are being built.