Just like the physical world, the internet has its dark and seedy alleys. Web of Trust is a tool built to warn you before you walk down one — and, like any tool that watches where you go, it is worth understanding properly before you install it.
If you imagine the internet as a physical place, the shady no-good-nicks have to hang out somewhere. In the real world, a good samaritan on the street may warn you: “that path leads to a dangerous part of town, I wouldn’t go there if I were you.” Web of Trust (WOT) is an attempt to build that samaritan into your browser. Once enough people mark a domain as hazardous, everyone else sees a warning before they click.
That is a genuinely useful idea. But a browser extension that can tell you about every link you are about to click is, necessarily, an extension that can see every link you click. This guide covers both halves: how to use WOT, and how to decide whether you want it — including the 2016 incident that got it pulled from two browser stores, and what its own privacy policy says today.
What Web of Trust actually is
WOT is a website-reputation service, operated by WOT Services LP. It combines three things: ratings submitted by its user community, machine-learning scoring, and third-party blacklists of known phishing and malware domains.
When you enable the extension, a colour-coded safety mark appears next to links — in search results, on social media, and in webmail. The marks are traffic-light simple:
- Green — reputable
- Yellow — proceed with caution
- Red — dangerous destination
- Blank — not enough information
Checked on 2026-09-25, WOT offers extensions for Chrome, Firefox, Edge, Opera and Safari. The colour mark is the whole product in one glance, and for a non-technical reader it is a real improvement over clicking blind.
Reading the colours
A red mark is the one you care about. Hover the coloured circle next to any link and WOT shows a summary; click through and you get the full scorecard for that domain.
Red does not mean “this will definitely infect you.” It means the community and the blacklists, combined, rated this domain badly. Sometimes that is malware. Sometimes it is a shop with terrible customer service. The reason matters more than the colour, and the reason is one click away.
Yellow is the harder signal to act on, because it covers everything from aggressive advertising to privacy concerns to “several people disliked this.” In practice yellow means slow down and look at why, not turn back.
Green is worth reading sceptically too. A domain can be perfectly safe to visit and still be selling something you shouldn’t buy. Reputation scoring answers “will this hurt my computer,” not “is this a good idea.”
The confidence indicator — the part most people miss
This is the most useful mechanic in WOT and the least noticed. Each rating carries a confidence level, drawn as five small person icons, and the colour is tinted to match: a brighter green means lower confidence, a darker green means the rating is well supported.
So a pale green mark sourced from one rating is not the same claim as a deep green mark sourced from thousands, even though both look “safe” at a glance. WOT deliberately does not show a raw rating count, on the grounds that a count alone is misleading — the confidence indicator is meant to replace it.
There are two separate scores behind every mark, trustworthiness and child safety, each with its own confidence level. The single colour you see on a link is a blend of the two. If you only take one habit from this article, make it this one: hover before you trust the colour.
What happened in 2016 — and why it still shapes the advice
On 1 November 2016, the German public broadcaster NDR (Norddeutscher Rundfunk) reported that Web of Trust was collecting its users’ browsing histories and selling that data to third parties.
The selling was not the worst part. WOT described the data as anonymised; NDR found the anonymisation was weak enough to undo. Reporters took a sample of the data and personally identified more than fifty people — in part because email addresses were sitting inside some of the URLs being passed on. At the time, the extension had roughly 140 million users.
The response was fast. Mozilla removed WOT from the Firefox add-on catalogue, and WOT withdrew it from Chrome and Opera. In February 2017, Mozilla reinstated it after WOT made code changes and added a setting letting users decline data sharing.
Two things follow from this, and they pull in opposite directions. The first is that WOT was caught doing precisely the thing a safety extension must never do, and it took an outside investigation rather than an internal disclosure to surface it. The second is that the company remained in business, changed the product, and was allowed back — so “it was removed in 2016” is not, on its own, a verdict on the software you would install today.
To get to a verdict, you have to read what it says about itself now.
What the extension can see today
The Firefox listing declares three permissions: access to your browser tabs, access to your browser activity during navigation, and access to your data for all websites. That last one is the broad one. It is also unavoidable for this kind of tool — an extension cannot warn you about a link it is not allowed to see.
WOT’s privacy policy, last updated 8 January 2026, defines what the extension collects. Alongside your IP address, device and browser type, it names search data and:
“browsing data that includes the web pages visited, browser type and time stamp of the visit”
That is your browsing history, with timestamps. The policy also states that WOT “goes to great lengths, and invests substantial resources, to avoid disclosing Personal Information,” using “various state-of-the-art anonymization, data cleaning and aggregation techniques.”
What the policy says it may do with it
Here is where a careful reader should slow down. The same policy, in its section written for California privacy law, says:
“We may ‘sell’ the following categories of Personal Information: Identifiers, commercial information, internet and electronic network activity information, profiles and inferences”
“Internet and electronic network activity information” is the legal category that covers browsing activity. The quotation marks around “sell” are not sarcasm: under California’s privacy statutes, “sell” has a specific statutory meaning — disclosing personal information for valuable consideration — and the policy defines it explicitly, alongside “sharing” for cross-context behavioural advertising. So this clause is a reserved right stated in legal terms, not an admission of a particular current transaction.
The policy also describes disclosure to affiliates “for market intelligence purposes” — and, importantly, says that access requires you to “explicitly enable them through an in-app permission,” with the ability to “opt-out at any time through ‘Your Privacy Choices’ within the settings menu.” That opt-in gate is a real, material improvement on 2016, and it deserves saying plainly.
Now compare all of that with the reassurance on the extension’s own store listing:
“We do not license or share this data with any third parties for the purposes of direct marketing or identifying or targeting of individual users.”
Read it twice. It rules out direct marketing and identifying or targeting individuals. It does not say the company will not sell, in the statutory sense, the category of data that describes where you browse. Both statements can be true simultaneously.
This gap — between what a store blurb denies and what a privacy policy reserves — is the single most useful thing in this article. It is not unique to WOT, and spotting it is a skill that transfers to every extension you will ever install.
How to judge any safety extension
Use WOT as the worked example and apply this to the next tool someone recommends to you.
1. What does it need to see? If the answer is “every page you visit,” the extension’s trustworthiness matters as much as the threats it protects you from. That is not a reason to refuse — it is a reason to look harder.
2. How does it make money? A free extension with a large engineering team is being paid by someone. If the funding model is not obvious from the site, assume the data is part of it until the policy tells you otherwise.
3. Read what the policy reserves, not what the marketing denies. Denials are written narrowly. Permissions are written broadly. When the two disagree, the policy is the binding document.
4. Is it actually maintained? Checked on 2026-09-25, the Firefox listing showed 40,569 users and a last update of 13 June 2023. A security tool that has not shipped an update in roughly three years is a weaker proposition than its marketing suggests — and note how far that number sits from the 140 million of a decade ago.
5. What happens if it changes hands? Your browsing history is only as private as the current owner’s intentions. An extension is a standing permission, not a one-time decision, so revisit it occasionally.
Two things not to do
Don’t treat a green mark as permission to stop thinking. WOT is crowd-sourced, so it inherits the flaws of crowds: a safe-marked site can go bad, ratings can be gamed, and a site can be taken over by an attacker long after its reputation was earned. Colour marks are a prompt to pay attention, never a guarantee.
Don’t add a third-party reputation widget to your own website. WOT offers a script that puts its rating marks beside links on your own pages, and it is tempting for exactly the reason this article exists. Don’t. Loading a third-party script into your pages hands another company the ability to run code for every one of your visitors, and you inherit every change they make to it. The safer pattern is to check your outbound links yourself and moderate user-submitted ones.
So should you use it?
If you want a plain-language recommendation: WOT is reasonable for someone who clicks a lot of unfamiliar links — in email, in social media, in search results — and who wants a visible warning before they land somewhere bad. The confidence indicator makes it genuinely more informative than a simple safe/unsafe badge.
But install it with your eyes open. It sees your full browsing history by design, its own current policy reserves the right to sell the category of data that describes your browsing, and it has been caught mishandling exactly that data before. If that trade is not one you want to make, your browser already ships phishing and malware protection that runs without a third-party extension, and turning that on costs you nothing.
The broader point outlives any single tool. A security product asks for more trust than an ordinary one, because you are handing it the very thing you are trying to protect. Read what it says about itself, in the boring documents rather than the landing page, before you let it watch.
More on protecting yourself online is collected under securing your use of the digital world. You may also want to read about what your browser stores about you, search engines that don’t profile you, and why biometrics are a password you can’t change.