Stop Websites Sending Notifications in Chrome

You are reading an article and a grey box slides into the corner of your screen. It carries a red shield, the word McAfee or Windows Defender, and a line like “Your device is infected with 5 viruses. Act now.” It appears again twenty minutes later. It appears when Chrome is minimised. It appears on your phone.

Nothing on your device is infected. What you are seeing is a Chrome web notification, sent by a website you clicked Allow on at some point — possibly months ago, possibly by accident while trying to dismiss a prompt. The fix takes about ninety seconds and involves no software at all.

Why these pop-ups are not what they claim

A web page running in your browser is sandboxed. It cannot read your file system, cannot enumerate running processes, and cannot perform a virus scan. The claim that it has detected five infections is not a mistaken reading — it is simply untrue, written in advance and shown to everyone.

These alerts arrive through the Web Push API, a legitimate feature meant for things like webmail and calendar reminders. Scam networks abuse it because a notification renders in the operating system’s own notification style, which borrows the credibility of a real system message.

Two details give it away every time:

• The notification names its source. Chrome always shows the originating domain in small text, usually underneath or beside the message. A real Windows or macOS alert never says secure-scan-alerts.xyz.
• Real security software does not ask you to phone anyone. Microsoft, Apple, Norton and McAfee have never put a support number in a virus warning.

The rules that keep you safe

If you have already called a number and someone asked to connect remotely, treat that as a serious incident. Disconnect the device from the internet, change your important passwords from a different device, and check your bank statement.

Remove the sites sending them — desktop

This is the actual fix. Everything else in this guide is prevention.

1. Open Chrome and go to Settings from the ⋮ menu, or paste chrome://settings/content/notifications into the address bar.
2. The full path through the menus is Privacy and security → Site settings → Notifications.
3. Scroll to Allowed to send notifications. This is the list that matters.
4. Work down it. For anything you do not actively use, click the ⋮ beside it and choose Remove (or Block if you want to be certain it cannot ask again).

Scam domains are usually obvious once you look — strings of hyphens, unfamiliar top-level domains like .xyz or .top, or names imitating a brand with an extra word attached. When in doubt, remove it. Nothing breaks permanently; a site you genuinely want can ask again next time you visit.

The notifications stop immediately. There is no restart, no scan, and no cleanup afterwards.

Turn off the prompt entirely

At the top of the same Notifications page is the setting that prevents this recurring. Choose Don’t allow sites to send notifications.

With that selected, no website can ask again — the prompt never appears, so there is nothing to click by mistake. You lose desktop alerts from sites you do want, but you can re-add those individually under Allowed to send notifications by clicking Add.

Or use quieter messaging

If blocking everything feels too blunt, select Use quieter messaging instead (older Chrome versions label this “Use quieter messaging (blocks notification prompts from interrupting you)”).

Permission requests then collapse into a small bell icon in the address bar rather than a dialog in the middle of the page. You can still grant permission deliberately by clicking the icon, but you can no longer be tricked into granting it while trying to close an overlay — which is how most people acquire these in the first place.

Remove them on Android

Chrome on Android is a common source because the prompts are easier to mis-tap on a small screen, and the resulting notifications land in the same tray as your real messages.

1. Open Chrome, tap the ⋮ menu, then Settings.
2. Tap Notifications, then Site settings (on some versions the path is Settings → Site settings → Notifications).
3. Review the allowed list and tap any unwanted site, then Block.

There is a second layer worth checking. In Android’s own Settings → Notifications → App notifications → Chrome, you will find per-category channels. Turning off the Sites channel stops all web push notifications from Chrome at the system level, regardless of per-site permissions — useful if you want one switch rather than a list.

If a notification is already in your tray, long-pressing it usually offers a direct route to turn off that source, which is faster than hunting through settings.

Myths worth discarding

“I must have a virus.” No. Notification spam is a permission stored in your Chrome profile, not a program on your device. Nothing was installed and there is nothing for an anti-malware tool to find.

“I need to buy a removal tool.” Also no. The companies advertising “pop-up removers” are frequently part of the same ecosystem as the pop-ups. The fix is a free setting you have already been shown.

“Clearing cookies will fix it.” It can, but incidentally and unreliably. Notification permissions are stored separately from cookies in Chrome, so clearing browsing data may or may not clear them depending on which options you tick. Removing the permission directly is the reliable route.

“Resetting Chrome is the only way.” Resetting works but is heavy-handed, and it also removes your startup pages, pinned tabs and search settings. Use it only if the notifications list is somehow unmanageable.

“It followed me from another device.” If you are signed into Chrome with sync enabled, site settings sync across your devices — so the permission you granted on your laptop can produce notifications on your phone. Removing it on one synced device removes it everywhere, which is why the same fix works on both.

If something actually was installed

Revoking the permission ends the notifications. If you also downloaded and ran a “cleaner” the pop-up advertised, that is a separate problem and does need attention:

• On Windows, check Settings → Apps → Installed apps, sort by install date, and uninstall anything you do not recognise from around that time.
• Check chrome://extensions as well. Some of these campaigns install a browser extension that reinstates the notifications or redirects searches. Remove anything you did not add deliberately.
• Run a scan with Microsoft Defender, which is built into Windows and sufficient for this class of adware.

An extension doing work on every page you open also costs real memory, which is one reason an unexplained extension is worth removing even after the pop-ups stop — our guide on Chrome using too much RAM covers how to measure what each one is costing you. If Chrome also feels sluggish with only a handful of tabs open, the same culprits often appear in Chrome slow even with few tabs.

On Android, delayed or missing alerts from apps you do want are a separate issue with its own causes — see Android notifications delayed or not showing.

What to expect afterwards

Once you remove the offending sites and set notifications to Don’t allow, the alerts stop that moment and do not come back. There is no residual cleanup, no reboot, and no reason to pay anyone.

The habit worth keeping is simple. When a site asks to send notifications, the default answer is no. Grant it only for services where you specifically want desktop alerts — and never from a page you arrived at by accident.