DocsPrivacy and security
Dangerous sites and secure connections
How Luma warns you about phishing and malware, blocks dangerous downloads and keeps your connections encrypted.
Luma stops known phishing and malware sites before they load, and prefers encrypted connections everywhere. All the checks happen on your computer.
Phishing and malware sites
Warn me about dangerous sites is on by default, in Settings › Privacy & security. Luma keeps lists of sites reported for phishing (OpenPhish and PhishTank) and for spreading malware (URLhaus), from the malware-filter project. It downloads them about every 12 hours and checks each address on your computer: the sites you visit are never sent anywhere.
When you open a listed site, the page doesn’t load. Luma shows Deceptive site ahead or Dangerous site ahead instead, with Go back. If you know the site and are sure it’s safe, Open … anyway (not recommended) lets you in; Luma won’t warn you about that site again until you restart it.
Dangerous downloads
A download coming from a site on the same lists is stopped, and Luma tells you Download blocked. Every file you download also carries Windows’ “downloaded from the internet” mark, so Windows SmartScreen checks programs before they run.
HTTPS-first
With HTTPS-first on (the default), Luma tries the secure version of every address, even when a link starts with http://. If the site doesn’t answer securely, Luma shows This site doesn’t support a secure connection. Continue to the insecure site opens it anyway, for that site, until you quit Luma.
Local addresses and single-word network names, such as a router at http://router/, open as you typed them. On a page without a secure connection, the shield in the address bar turns into a warning sign and the privacy panel says Connection not secure.
Certificate errors
When a site’s certificate isn’t valid, someone could be pretending to be that site. Luma stops loading and shows This connection isn’t private. If you’re sure, Continue to … (unsafe) opens it until you quit Luma, and the privacy panel shows Certificate error ignored while you’re there.
Secure DNS
Before connecting to a site, your PC looks up its address. Secure DNS encrypts those lookups. Choose Automatic (the default: encrypted when the provider can be reached), Always (DNS over HTTPS) or Off, and the Provider: Quad9 (the default), Cloudflare, Mullvad or Google.
Other signals
- Global Privacy Control (on) tells sites not to sell or share your data. In some regions this is legally binding.
- Send “Do Not Track” (off) is an older signal most sites ignore, and it can make you slightly easier to recognise.
- Limit fingerprinting (on) removes detailed device information from requests. It is not full fingerprinting protection.