Link Destination Check

Why it stays quiet

A warning that fires on normal links trains you to dismiss it, and a dismissed warning protects nobody. So there is one strict rule: it only speaks when the link's own text claims a destination and the real destination is a different site.

"Click here", "Read more", a person's name, a button label: none of those claim anything, so none of them are ever checked. That is what keeps false positives at effectively zero during normal browsing.

What it does flag

Mismatches. The text says one domain, the link goes to another. Navigation pauses and shows you both addresses side by side.

Disguised addresses. Hostnames using punycode, which is how a web address can render as a familiar brand while being a different domain entirely.

Numeric destinations. The text names a site but the link points at a raw IP address.

What it leaves alone

Command clicks, middle clicks, new tab clicks and downloads are never interrupted, because those are deliberate and getting in the way of them breaks muscle memory. Links where the text and destination are the same site, including different subdomains, are fine. Ordinary marketing redirects are detected but treated as low severity and never block you. Once you continue past a warning, that destination is not questioned again on that page.

Permissions

Reads links on pages. It makes no network requests and stores nothing. It cannot follow a link to check where it lands; it compares what the text claims against the address itself.