Introduction
Browser wallet extensions like MetaMask, Phantom, and others are convenient, but they’re also prime targets for attackers. A single click on the wrong website can drain your entire wallet. Here’s how to lock down your extension and protect your funds.
The Problem: Extensions Work Everywhere by Default
Most wallet extensions are configured to work on “all sites” by default. This means every website you visit can potentially interact with your wallet, making you vulnerable to:
- Phishing attacks - Fake websites that look legitimate
- Malicious dApps - Applications that steal funds through approvals
- Compromised websites - Legitimate sites that get hacked
The Solution: Whitelist-Only Security
Safety should be your number one priority! Configure your wallet to only work on sites you explicitly trust.
Step-by-Step Setup Guide
1. Access Extension Settings
Right-click on your wallet extension icon and select “Manage Extension”:
![Extension menu showing manage extension option]
2. Find Site Access Settings
Look for the “Site access” section in your extension settings. By default, it’s usually set to “On all sites” - this is dangerous!
3. Change to Restricted Mode
Change the setting from “On all sites” to either:
- “On click” - Extension only activates when you click it
- “On specific sites” - Only works on sites you approve
![Site access settings showing dropdown menu with options]
4. Add Trusted Sites
If you choose “On specific sites,” add only the websites you actively trade on:
Commonly trusted sites:
https://app.uniswap.org/*https://pump.fun/*https://raydium.io/*https://dexscreener.com/*https://solscan.io/*
![Site whitelist showing approved domains]
5. Test Your Setup
Navigate to a trading site - your wallet should now work normally on whitelisted sites only.
![Working wallet connection on approved site]
Important Security Reminders
⚠️ This Isn’t a Complete Solution
Wallet restrictions help prevent accidental connections to malicious sites, but they don’t protect against:
- Compromised frontends - When legitimate sites get hacked
- Malware on your computer - Keyloggers and screen captures
- Social engineering - Tricks to get you to approve malicious transactions
- Smart contract vulnerabilities - Bugs in the code you’re interacting with
🔒 Additional Security Measures
Use a Burner Wallet
- Keep only trading funds in your browser wallet
- Use a separate wallet for long-term storage
- Never risk more than you can afford to lose completely
Stay Vigilant
- Always verify transaction details before signing
- Double-check website URLs (look for typos)
- Be suspicious of urgent “opportunities”
- Never enter seed phrases on websites
Cold Storage is King
- Hardware wallets for serious amounts (see our hot vs cold wallets guide)
- Paper wallets for long-term holding
- Multi-signature setups for large portfolios
- Advanced security with Shamir Secret Sharing for seed phrase protection
Remember: Not your keys, not your tokens - always maintain control of your private keys regardless of the storage method you choose.
Advanced Tips
Mobile Wallet Security
Mobile wallets should also offer website whitelisting features. Look for similar settings in your mobile wallet’s security section.
Browser Isolation
Consider using a separate browser profile or entirely different browser for crypto activities:
- Trading Browser: Chrome with wallet extensions
- Daily Browsing: Firefox without crypto extensions
- Banking: Separate profile with no extensions
Regular Security Audits
- Review your whitelisted sites monthly
- Remove sites you no longer use
- Check for suspicious transaction history
- Monitor wallet activity for unauthorized transactions
Red Flags to Watch For
🚨 Never connect your wallet if you see:
- Pressure to “act now” or limited time offers
- Requests for your seed phrase or private keys
- Unknown dApps asking for token approvals
- Websites with suspicious URLs or typos
- “Free” airdrops requiring transactions
Summary: Defense in Depth
Wallet extension security is just one layer of protection. Combine it with:
- Site whitelisting (this guide)
- Separate wallets for different purposes
- Cold storage for long-term holdings
- Regular security audits
- Healthy skepticism about everything
Remember: In crypto, there’s no customer support to call when things go wrong. Your security is entirely in your hands.
Stay safe out there! 🛡️
This guide was inspired by community member @LiamRumpyPumpy’s security thread. Always verify security advice from multiple sources and stay updated on the latest threats.