Dangerous pages and certificates
Acira warns you before it opens a page on a public phishing or malware list, flags scam tricks it can recognize, and stops when a site cannot prove who it is. This page explains each warning, what the buttons do and what Acira cannot catch.
Phishing and malware warnings
Acira downloads three public lists once a day and checks addresses on your computer. Nothing about the pages you visit is sent anywhere to do this. The optional Google Safe Browsing key, described below, is the one exception.
- The Phishing URL Blocklist (OpenPhish, PhishTank and IPThreat data) from malware-filter.
- The Online Malicious URL Blocklist (abuse.ch URLhaus data) from malware-filter.
- Phishing.Database's active phishing domains.
When you go to a listed address, Acira stops and shows Acira blocked a dangerous page. It tells you whether the address is on a list of phishing pages or on a list of pages that spread malware, and what that means. The page names the list and says the lists refresh daily. If you think a page was listed by mistake, report it to the list's maintainers.
What you can do
- Choose Go back. This is the safe choice.
- Open More information to read the details.
- Choose Continue anyway (unsafe) if you are sure the page is safe. Acira then stops warning about that listed address (a listed site, or one listed page on a shared site) in this profile until you quit Acira. Other listed addresses stay blocked, including inside pages.
A page that loads a listed address as an image, script or frame loses that piece. Private windows get the same protection, and a Continue choice there lasts as long as the window's profile does.
Turn it off
Open Settings › Privacy and switch Phishing and malware protection (default on). The row shows how many addresses the lists hold. When it is off, pages on these lists open without any warning. Two other states show in the row: the lists are still downloading, or they are more than a week old and could not be refreshed. In both cases pages may not be checked.
You can add Google Safe Browsing with your own key under Google Safe Browsing (optional). See Privacy settings.
Scam page warnings
Under Settings › Privacy › Phishing and malware, Warn about scam pages is on by default. It uses fixed rules on your computer. It does not use AI or a learned model. It looks for these tricks:
| Warning | What triggered it |
|---|---|
| This page tried to copy a command | A page copied a command to your clipboard while telling you to press Win+R and paste it (called ClickFix). Acira stopped the copy. Do not run commands a website gives you. |
| Looks like a sign-in for a known brand, but it is not | A page asks for a password and presents itself as a known brand, but its address is not one the brand uses. |
| This address mixes alphabets | The address uses letters from different alphabets, a common way to imitate a real site. |
| This address imitates a brand | The address spells a known domain with look-alike characters. |
| This address is one letter from a brand | The address is a one-letter typo of a well-known site. |
| A brand name is part of this address, in front of another domain | A well-known name sits in front of a different domain. |
The warning names the real domain so you can type it yourself. These checks cover a list of well-known brands. They do not cover other sites.
Certificate errors
When a site cannot prove who it is, Acira stops before loading it. The page title is Your connection is not private or This site can't provide a secure connection, with technical details and a Copy button.
- For a public website there is no way past the warning. The warning says it cannot be bypassed and that exceptions are offered for devices on your own network.
- For a device on your own network, the warning offers Continue without verification and Continue to site (unsafe). This is meant for a router, a printer or a server you run yourself.
An exception is narrow. It works in these cases:
localhost, any.localhostname, and addresses on your own network (such as192.168.x.x,10.x.x.x,172.16.x.xto172.31.x.xand127.x.x.x).- These certificate problems: an authority that is not trusted, a name that does not match, or a date that is not valid.
- This tab, this certificate and 5 minutes. The warning shows the time. Opening another tab or a different certificate asks again.
While an exception is active the address bar shows Not verified, and the Page information panel says Identity not verified · temporary exception with a Remove exception button. Others on your network could read or change what you send. For local development, see Localhost and certificates.
Check a secure site
Choose the button at the start of the address field. The panel says Connection is secure or Connection is not secure. Open Certificate details to see Encrypted. The site proved who it is., who vouched for it and when the certificate is valid until. A page loaded over plain HTTP shows Not secure in the address field.
Plain HTTP
With Always use HTTPS on (default off) Acira tries HTTPS before HTTP. If a site does not support it, you see Allow an HTTP connection?. Choosing Allow HTTP in this tab lets that tab load the site over HTTP until you leave it or close the tab. A form that failed is not sent again; go back and send it yourself. Local addresses are left alone. See Privacy settings.
Downloads
Acira never opens a download for you. Program and script files, such as .exe, .msi, .bat and .dmg, ask before opening: This file can run software on your computer. The dialog adds that Acira has not scanned it for malware. See Downloads.
What these warnings do not do
Related pages
- Site permissions and data for what a site may ask to use.
- Passwords and passkeys, which fill a sign-in on the site you saved it for.
- Troubleshooting if a trusted site shows a certificate error.
Last updated October 31, 2026