A browser hijacker is unwanted software or a browser change that alters settings such as your homepage, search provider, or new-tab page, often to redirect searches or show advertising. To remove one, undo suspicious browser changes, uninstall unfamiliar software or extensions, check for unwanted system settings, and run a reputable security scan if the problem persists.
What a browser hijacker does
Browsers let users choose settings for opening pages, searching the web, and managing extensions. A hijacker changes one or more of these settings without clear, informed permission, or makes them difficult to change back. The result might be a different homepage, an unfamiliar search page, unexpected redirects, or new advertisements.
For example, you might open a new tab and find a page you did not select. A search entered in the address bar may go through an unfamiliar service before results appear. A browser may also reopen a page after you have restored your preferred settings. These symptoms can point to a hijacker, but they can also have other causes, including a changed setting, a sync issue, or another unwanted program.
How browser hijackers get installed
Some hijackers arrive bundled with free software. During installation, an optional component may be presented in a way that makes it easy to overlook. Others are installed through browser extensions, deceptive download buttons, misleading alerts, or software from sources that are not trustworthy. In some cases, a user accepts a setting change without realizing how it will affect browsing.
An extension can be legitimate in purpose but still request broad permissions. Permissions may let it read or change data on websites, manage tabs, or alter browser settings. Review what an extension can access before installing it, and avoid add-ons whose purpose or publisher is unclear. A permission request alone does not prove an extension is malicious, but unexpected access is a reason to pause.
Hijackers do not always exploit a technical vulnerability. Often, the route in is a confusing installer or a misleading prompt. That distinction matters: removing the visible browser change may not remove the software that keeps applying it.
Signs and common look-alikes
Consider checking your browser and recently installed software if you notice repeated redirects, settings that revert, unfamiliar extensions, or search results that look different from what you expect. Sudden pop-ups can also be a warning sign, especially when they appear outside the browser or claim that urgent action is required.
Not every unwanted page is evidence of a hijacker. A website can send notifications after permission was granted, and an ordinary ad can open a new tab. A browser’s search engine may also change because settings were edited or synchronized from another device. Check the permissions and settings before concluding that your device is infected.
- Possible hijacker: the homepage or search setting changes back after you restore it.
- Possible notification issue: alerts appear even when the related website is not open.
- Possible ad or redirect: the behavior occurs on one site but not across ordinary browsing.
- Possible sync issue: an unwanted setting returns after signing into a browser profile.
How to remove a browser hijacker
Menu names differ across browsers and operating systems, so use the browser’s own help pages when a setting is hard to locate. The general approach is to remove the source of the change, restore settings, and check whether the problem returns.
- Close suspicious pages. Do not follow prompts that claim your device is infected, demand payment, or ask you to install a cleanup tool. Avoid entering passwords or payment details on pages reached through unexpected redirects.
- Review browser extensions. Remove add-ons you do not recognize or no longer need. If you are unsure about one, search for its purpose using a trusted source before deciding. A browser may need to be restarted for the change to take effect.
- Restore browser settings. Set the homepage, startup behavior, and default search provider to your preferred choices. If the browser offers a reset option, read its description first: a reset can disable extensions and clear some settings, but may not remove every program on the device.
- Uninstall unfamiliar software. Review recently installed applications in the operating system’s settings. Remove software you identify as unwanted, following the system’s normal uninstall process. Avoid deleting unfamiliar system files by hand.
- Check notification permissions. Remove permission for sites you do not recognize or do not want sending alerts. This can stop unwanted notifications, though it will not remove a separate hijacker.
- Run a security scan. Use security software from a source you trust and follow its instructions. Keep the operating system, browser, and security tools updated through their normal update features.
- Restart and test. Reopen the browser and check whether the homepage, search, and new-tab behavior remain as expected. If the changes return, look for a remaining application, policy, or synchronized setting that is reapplying them.
When settings keep changing
A setting that reappears after removal usually means something is still controlling it. A remaining application or extension may be restoring the change. Browser synchronization can also bring settings or extensions from another signed-in device. Temporarily reviewing sync settings can help distinguish a local problem from one that follows your profile; consult the browser’s documentation before changing sync behavior.
On a work or school device, an administrator may manage browser settings. If a setting says it is controlled by an organization, do not try to bypass that control. Ask the relevant IT support team whether the setting is intentional. On a personal device, persistent changes after uninstalling suspicious software and scanning may merit help from a qualified technician.
Resetting a browser is not the same as reinstalling an operating system, and it does not guarantee that every unwanted program has been removed. Before resetting, check what the browser says will be affected. You may need to restore preferred settings or sign in again afterward.
Protecting your accounts and privacy
A hijacker may chiefly aim to redirect traffic or display advertisements, but an unexpected page can still create a risk if you enter sensitive information there. If you typed a password into a page you now distrust, change it using the service’s normal sign-in process from a trusted device or session. If the same password is used elsewhere, replace those reused passwords too. Turn on additional account protections when available.
Be cautious with messages and pop-ups that claim to be security warnings. A webpage cannot reliably diagnose the state of your whole device just by displaying an alert. Close the page rather than calling a number or installing a tool it recommends. Use security software already installed or obtain it from a source you can independently verify.
How to reduce the chance of another hijack
Prevention is mostly about limiting opportunities for unwanted software and noticing changes early. No single measure guarantees protection, but a few habits can make deceptive installs less likely:
- Download software from its official source or a trusted distribution channel.
- Read installation screens carefully and decline optional components you do not want.
- Install only browser extensions you need, and check their permissions and purpose.
- Keep the browser and operating system updated through their built-in update tools.
- Do not trust unexpected alerts that pressure you to install software or disclose information.
- Review homepage, search, extension, and notification settings when browser behavior changes.
Common misconceptions
“A changed search engine always means malware.” Not necessarily. A user, an extension, a software installer, or browser sync can change the setting. Investigate what changed and whether the behavior returns after you correct it.
“Deleting browsing history removes the hijacker.” Clearing history may remove stored browsing records, but it usually does not uninstall an extension or application that is changing settings. Remove the source as well.
“Every unfamiliar extension is malicious.” Unfamiliarity alone is not proof. Check its stated purpose, permissions, and source. If you cannot establish a reason to keep it, removing it is a sensible way to reduce unnecessary access.
“A browser reset fixes the whole device.” A reset can restore browser settings, but a separate application or management policy may keep changing them. If the problem returns, investigate beyond the browser.
Frequently Asked Questions
Is a browser hijacker a virus?
A browser hijacker is a type of unwanted software or unwanted browser behavior. People sometimes use “virus” loosely for many kinds of harmful software, but a hijacker is more specifically associated with altering browser settings or redirecting browsing. The label alone does not identify exactly what is installed.
Can a browser hijacker steal passwords?
Some unwanted software may expose users to privacy or security risks, but a changed homepage by itself does not prove that passwords were stolen. Avoid entering credentials on unfamiliar pages. If you entered a password after an unexpected redirect, change it through the account’s normal, trusted sign-in route.
Why does my homepage keep changing back?
An extension, installed application, browser sync, or administrator-managed policy may be restoring the setting. Check extensions and recently installed software, then review sync and management information. On a managed device, ask its administrator rather than trying to override a policy.
Can I remove a browser hijacker without reinstalling my browser?
Often, yes. Removing the unwanted extension or application and restoring settings may be enough. A browser reset can help when settings remain altered, but check what it changes and remember that it may not remove software outside the browser.
Are pop-ups proof that my browser is hijacked?
No. Pop-ups can come from website advertising, notification permissions, or other causes. Check whether they persist across sites, review notification permissions, and look for other signs such as repeated redirects or settings that revert.
Key takeaway
A browser hijacker changes browsing behavior, commonly by altering search, homepage, or tab settings. Remove suspicious extensions and software, restore browser preferences, check notification and sync settings, and scan the device if needed. If the change persists or the device is managed, seek help from its administrator or a qualified technician.