ExpressVPN Adds Web Protection to Its Browser Extension

ExpressVPN’s browser extension can now block known malicious, phishing and scam websites even when the VPN is off. ExpressVPN announced the feature, called Web Protection, on 5 November 2026. Every paid plan gets it at no extra cost, Basic included.

TechRadar’s Mark Gill reported the launch on 6 November. We checked ExpressVPN’s release notes, its support articles and the Chrome and Firefox stores on 7 November. We have not tested the feature ourselves.

What happened

Version 8.2.0 of the extension, dated 5 November in the release notes, adds what ExpressVPN calls “a suite of browser-level security features that blocks known malicious, phishing, and scam websites in real time”. The notes add that “These features work with or without the VPN connection”.

Web Protection has three parts that you switch on separately: Threat Manager, an ad blocker and parental controls. ExpressVPN’s support article says that together they block trackers, ads, malicious sites and adult sites. You can also keep your own lists of sites to allow or block.

It checks the full web address of each page rather than the whole domain. When it stops a page, you can go back or click “Proceed Anyway”.

It works in Chrome, Firefox, Edge, Brave, Opera and Vivaldi. The Chrome Web Store listed the new version on 4 November, and Firefox got it on 6 November. ExpressVPN for Teams gets it too, as do plans bought in an app store.

Why it matters

Until now, ExpressVPN’s blocking lived in its apps. That blocker, Advanced Protection, works through ExpressVPN’s own DNS servers. The press release says it “needs an active VPN connection” and “can only block entire domains”. Web Protection keeps some protection in the browser when you turn the VPN off, for example on a banking site that refuses VPN connections.

It has clear limits:

• It protects the browser only. Other apps on your device get nothing from it.
• It is off by default, and it works only while you are signed in to the extension.
• It blocks known bad sites, so a scam page that is not on ExpressVPN’s lists yet will not be stopped.
• It does not hide your IP address or encrypt your traffic. Only the VPN does that.

It arrived in the same week that Basic gained tracker blocking in the apps, which we reported on 6 November. ExpressVPN’s Advanced Protection article now confirms that change: “All advanced protection features are included in the Basic, Advanced, and Express Pro plans”.

What to do

1. Update the extension to version 8.2 or later. Browsers usually do this on their own, and the version number is on the extensions page.
2. Sign in and switch it on. Open the extension, sign in to your ExpressVPN account and turn on the parts of Web Protection you want.
3. Allow sites that break. If a site you trust stops working, add it to the allow list instead of switching everything off.
4. Keep using the VPN for privacy. Web Protection blocks bad pages but leaves your IP address visible.
5. If you are new to ExpressVPN, Basic costs $2.99 a month on the 28-month plan, or $83.72 up front, and renews at $99.95 a year. First-time buyers get a 30-day money-back guarantee. Our ExpressVPN deal page lists the current offer.

What we changed

Our ExpressVPN review now explains that Advanced Protection needs the VPN while Web Protection does not. The ExpressVPN and Netflix guide now mentions the extension’s allow list in its fix for pages that fail to load. We also updated our 6 November report, which now cites ExpressVPN’s own confirmation of the Basic change and links here.

The scores do not change, because they already count ExpressVPN’s ad and tracker blocking. We will add Web Protection to our ExpressVPN data at the next data check.