By Damilola Emmanuel, who makes Tabmoat. Updated .
Turn off pop-ups and redirects in Chrome’s site settings first, then add a blocker that checks where a page is trying to send you. Chrome’s setting stops some redirects, but not the ones an ad script starts while you click, or the ones that swap out the tab you were on. Tabmoat looks for the tracking tags ad landing pages have in their web address, so it can catch those too.
What is a redirect ad?
It’s when a site sends you to a page you never asked for. Common ones:
- A fake “your browser is out of date, update now” page.
- A “you’ve won” or “your phone has a virus” page.
- A random shopping, betting or dating site.
Sometimes it happens with no click at all. On a streaming site I tested in Chrome with no blocker, the page sent me to a fake “update to Opera” page without me clicking anything. Other times it happens when you click: the site opens the page you wanted in a new tab and turns your current tab into the ad, so you only notice when you go back.
Can Chrome’s own settings stop it?
Some of it. In Chrome go to Settings, then Privacy and security, then Site settings, then Pop-ups and redirects, and choose not to allow sites to send pop-ups or use redirects. Chrome then blocks redirects that a page starts on its own with no click.
The setting only looks at whether there was a click. If an ad script runs during your click, its redirect looks like one you started.
How does Tabmoat tell an ad redirect from a normal one?
Ad networks stamp the pages they send traffic to with tracking tags in the web address, things like a campaign ID, a placement ID and a publisher ID. I collected the tag names from real ad redirects on the sites I tested. Normal links sometimes have one of them, but ad landing pages usually have several at once.
Tabmoat’s rule is that a script on the page may not send you, or open a tab, to another site whose address has two or more of these tags, whether or not you clicked at that moment. It also watches for the tab-swap trick: if a script tries to turn your current tab into another site while you click, Tabmoat keeps you where you are.
Tabmoat leaves alone the places you go yourself: a link you click, the address bar and the back button.
| Redirect type | Chrome setting alone | With Tabmoat |
|---|---|---|
| Page jumps to an ad with no click | Usually blocked | Blocked |
| Ad script redirects during your click | Gets through | Usually blocked |
| Your tab is swapped for an ad while the site opens in a new tab | Gets through | Usually blocked |
| You click a real link to another site | Allowed | Allowed |
What should I do if I’m already on one?
Don’t click anything on the page, don’t download the “update”, and don’t allow notifications if it asks. Close the tab. If a site keeps sending you notifications after an old visit, go back to Site settings in Chrome, open Notifications, and remove it there.
Questions people ask
Is the fake update a virus? It’s a way to get you to install something you shouldn’t. Chrome updates itself, and you can check from Chrome’s own menu under Help, then About Google Chrome. Close any web page that asks you to update your browser.
Why does it only happen on some sites? Mostly because of the ad networks a site uses. Free streaming, download and link-shortener sites are where I saw them most.
Will Tabmoat stop me going to sites I click on? No. A link you click goes where it says. Tabmoat steps in when a script on the page tries to move you somewhere else.