ExpressVPN’s browser extension now blocks malicious sites – even when the VPN is off

• ExpressVPN’s browser extension now blocks malicious, phishing, and scam sites without the VPN
• Full URL-checking blocks single harmful pages, unlike DNS tools that block whole domains
• The update extends ExpressVPN’s 2026 strategy of bundling security tools into all paid plans

ExpressVPN has added a new layer of security to its browser extension, and it doesn’t require you to switch the VPN on.

The feature, Web Protection, screens each page as it loads, matching it against continuously refreshed databases of sites known to host malware, scams, or phishing attempts, and stops them before they appear.

It’s available now on Chrome, Firefox, Edge, Brave, and other Chromium-based browsers, and comes at no extra cost to subscribers on the Basic, Advanced, and Pro plans, as well as ExpressVPN for Teams.

Browsers are where most people encounter online threats in practice – often via a single link to a convincing fake login page. Web Protection places the check at the point a page loads, catching the threat before the user ever sees it.

What makes it different

One of the more notable aspects of Web Protection is how precisely it blocks. Rather than judging an entire domain, it inspects the full web address.

That means a single fraudulent page – a fake login form tucked inside an otherwise legitimate site, for instance – can be shut down while the rest of the site stays accessible. Domain-level filters, which are the norm for DNS-based tools, can’t make that distinction.

Users also get more visibility than typical network-level blocking offers. When a page is stopped, the extension steps in with its own notice spelling out which site was halted, and why.

Users can maintain their own block and allow lists directly in the extension, and a weekly count on the home screen shows how many items Web Protection has flagged, with fuller statistics available in the account portal.

The feature sits alongside, rather than replaces, Advanced Protection, ExpressVPN’s device-wide system that operates inside the VPN tunnel.

The older tool covers all traffic across apps, but only while the VPN is connected and only at the domain level. Web Protection works in the browser with or without the VPN, and the two are designed to complement each other.

Part of a bigger push

Web Protection is the latest addition to the hybrid browser extension ExpressVPN rolled out earlier this year.

The first VPN-proxy hybrid of its kind, it can protect browser traffic on its own or hand control to the desktop app for full-device coverage, complete with Smart Routing rules and WebRTC leak protection.

It also fits into a broader strategy. In February 2026, ExpressVPN rebuilt its plans around a suite of security tools, including an email protection service and a personal data checker, and this week brought tracker blocking to its entry-level Basic plan.

The timing is apt. A recent TechRadar investigation found 369 fake VPN extensions on the Chrome Web Store, including impostors of ExpressVPN itself, collectively installed by more than 218,000 people.

With shady add-ons and phishing pages multiplying, it’s a logical step for ExpressVPN: meet users where the threats actually are, whether or not the VPN is switched on.