What AdFender installs, and why
To block ads inside secure pages, AdFender installs a private root certificate, unique to your PC, so that your browsers trust the pages it has filtered. AdFender generates the certificate and its private key on your PC; the key stays there, and we never receive either. Installing it needs administrator rights: setup takes care of that when you choose Enable HTTPS filtering (recommended), and if you install it later from the dashboard, AdFender asks for administrator approval.
Banks, payment services and other sensitive sites are on AdFender’s exclusion list from the start, so they pass through without being decrypted — sites AdFender leaves alone explains how to see and change it.
Everywhere else, AdFender decrypts a page, removes the ads and trackers your lists match, and hands the page to your browser. All of that happens on your PC, and what is read is not sent to us — our privacy policy sets out exactly what AdFender does and does not send.
The certificate is unique to your installation, and we never hold its key. Who on your PC can use it depends on how AdFender was installed: with Install for me only it is locked to your Windows account; with Install for all users of this computer, every account on the PC can use it, so choose that only on a PC whose users you trust. The two install choices explains more.
You decide when it goes. Turning HTTPS filtering off offers to remove it (below), and when you uninstall AdFender, the uninstaller asks whether to Also remove your AdFender settings, custom rules and certificate? Answer Yes to take the certificate out of Windows along with everything else. No, which is the default, keeps them for a future reinstall. Installing and uninstalling has the details.
Checking that it is working
On the dashboard, open HTTPS filtering. The healthy state reads Trusted in the Windows certificate store, with who issued it, when it expires, and a SHA-256 fingerprint you can compare against what your browser shows.
The dashboard’s Advanced panel says the same thing in one line: Full means AdFender is filtering inside secure pages, and Partial (domain name filtering only) means it is not.
If a browser shows a certificate warning
Open HTTPS filtering on the dashboard and check what the certificate panel says first.
- Root certificate not installed: use Install root certificate.
- Installed, but the certificate has expired or Windows lost it during a repair or a reinstall: click Renew root certificate, which reissues the certificate and reinstalls it.
Either way AdFender asks for administrator approval before it installs the certificate. If the warning stays after that, write to us with its exact wording.
A browser AdFender did not set up automatically can be pointed at the certificate by hand: Export root certificate saves a copy you can import into it.
Turning HTTPS filtering off
You can, and AdFender keeps working — but it will catch much less, because most ads arrive over HTTPS. What remains is domain name filtering: AdFender can still block a connection to a known ad server by its name, without decrypting anything.
When you turn it off, AdFender offers two exits:
- Turn off for now keeps the certificate installed, so turning full filtering back on is instant.
- Turn off and remove the certificate takes it out of Windows altogether. Turning filtering back on reinstalls it, which needs administrator approval again.
Sites AdFender leaves alone
Some sites do not tolerate having their connection inspected, and a few should not be inspected at all. AdFender keeps an exclusion list and steps aside on anything on it, passing the traffic through unfiltered. Banking and other sensitive-transaction sites are on it by default.
To see or change it, open HTTPS filtering and then Manage exclusion list. Add a hostname such as example.com or a wildcard such as *.example.com. If you remove a default by accident, Reset to AdFender defaults puts the shipped list back.
If a site still fails after you exempt it from blocking, it may need an HTTPS exclusion instead: fix a broken website explains the difference.