Avast Web Guard: What It Does & How HTTPS Scanning Works

Avast Web Guard (formerly Web Shield) is a real-time protection layer in Avast antivirus that filters web traffic to block malicious websites, downloads, and scripts before they reach your browser. It works by intercepting HTTP and HTTPS connections, scanning the data, and then allowing or blocking it based on Avast’s threat database and heuristics. In short, it acts as a gatekeeper between your device and the internet, inspecting every web request and response for danger.

Background: From Web Shield to Web Guard

Avast has included a web protection module for many years. In earlier versions of the antivirus, this component was called Web Shield. In a rebranding effort around 2020–2021, Avast renamed several of its modules to make their purposes clearer to users. Web Shield became Web Guard, but the underlying technology and function remained essentially the same. The name change was part of a broader UI overhaul that also saw “File Shield” become “File Guard” and “Mail Shield” become “Mail Guard.”

Web Guard is enabled by default in all paid and free versions of Avast. It runs as a background service that hooks into the network stack, which means it sees traffic from every application, not just your browser. This is important because malware often tries to download payloads from URLs that are not visited in a browser—for example, a trojan calling home or a script in a PDF reader fetching an exploit.

How Web Guard Intercepts Traffic

Web Guard works by acting as a local proxy. When an application on your PC tries to connect to a website, the request is redirected to Avast’s local proxy server (usually listening on 127.0.0.1). The proxy then makes the actual connection to the remote server, inspects the incoming data, and forwards it back to the application if it is deemed safe.

For HTTP (port 80) traffic, this is straightforward: the data is plaintext, so Avast can read the headers and body directly. It checks the URL against a blacklist of known malicious domains, and it also runs heuristic analysis on the content to detect suspicious patterns, such as obfuscated JavaScript or drive-by download attempts.

For HTTPS (port 443) traffic, the data is encrypted, so a simple proxy cannot see inside. This is where HTTPS scanning comes into play.

How HTTPS Scanning Works

HTTPS scanning is essentially a man-in-the-middle (MITM) proxy, but one that you have installed and authorized. Here’s the step-by-step process:

Certificate generation: When your browser connects to a site like https://example.com, it normally expects a certificate signed by a trusted Certificate Authority (CA). With HTTPS scanning enabled, Avast intercepts the connection and presents its own certificate for example.com, which is signed by Avast’s own root certificate.
Trust installation: During installation, Avast adds its root certificate to your operating system’s trusted certificate store. This makes your browser accept Avast’s generated certificates without warning.
Decryption and inspection: Avast establishes a secure connection to the real site (using the real certificate) and decrypts the traffic. It then inspects the plaintext data—the same way it does for HTTP—for malware, phishing, or malicious scripts.
Re-encryption to you: After inspection, Avast re-encrypts the data using its own certificate and sends it to your browser. Your browser decrypts it using the Avast root certificate, and you see the page normally.

This process is transparent to the user, but it does have implications for privacy and security, which we’ll discuss later.

What Web Guard Actually Blocks

Web Guard is not just a URL filter. It performs several distinct tasks:

URL blocking: It compares every requested URL against Avast’s constantly updated database of malicious sites. If a site is known to host malware, phishing, or scams, Web Guard blocks the connection and shows a warning page.
Download scanning: Files downloaded over HTTP or HTTPS are scanned in real time. If a download contains a virus or trojan, Web Guard quarantines it before it touches your disk.
Script injection protection: It analyzes web pages for malicious scripts, such as those used in drive-by downloads or cryptojacking. It can block individual scripts while still allowing the rest of the page to load.
Phishing protection: It checks the content of pages for signs of phishing, such as fake login forms mimicking banks or social media.

Web Guard also works with other Avast modules. For example, if it detects a malicious script, it may pass the file to the File Guard for deeper inspection. This layered approach is common among modern antivirus suites.

Common Problems and Misconceptions

One of the most frequent complaints about HTTPS scanning is that it breaks websites or apps. This happens because some applications perform certificate pinning—they only accept a specific certificate, not any certificate signed by a trusted root. When Avast presents its own certificate, the app sees a mismatch and refuses to connect. This can cause errors in banking apps, email clients, or even some websites.

Another misconception is that HTTPS scanning is unnecessary because HTTPS already protects against malware. That is false. HTTPS only encrypts data in transit; it does not guarantee that the server is trustworthy. Malware can be served over HTTPS from compromised or malicious sites, and without scanning, your browser would happily download it. HTTPS scanning closes that gap.

However, there is a legitimate privacy concern: Avast (or any antivirus doing MITM) can see the content of your encrypted traffic. This is why some privacy-conscious users disable HTTPS scanning. It is a trade-off between security and privacy. Avast does not sell your browsing data, but the technical capability exists.

How to Configure or Disable Web Guard

If you need to troubleshoot a connection issue or simply prefer not to use HTTPS scanning, you can adjust the settings:

Open the Avast user interface (usually by double-clicking the orange icon in the system tray).
Go to Menu (top-right) → Settings → Protection → Core Shields.
Click on Web Guard (or Web Shield in older versions).
Here you can toggle the entire shield on/off, or click Configure to adjust HTTPS scanning specifically. There is an option to “Enable HTTPS scanning”—uncheck it to disable only the MITM part.

If you disable HTTPS scanning, Web Guard will still block malicious URLs and scan HTTP traffic, but it will not inspect encrypted content. You will lose protection against malware hosted on HTTPS sites, so only disable it if you have a specific reason.

Comparison with Other Antivirus Web Filters

Web Guard is not unique. Most modern antivirus products include a similar web filtering component. For example, Norton has “Web Protection,” McAfee has “WebAdvisor,” and Bitdefender has “Web Protection.” All use the same principle: intercept traffic, check against a threat database, and block malicious content. The main differences are in the size of the threat database, the speed of the scanning, and the user interface.

One notable difference is that Avast’s HTTPS scanning is on by default, while some competitors require you to enable it manually. This means Avast offers better out-of-the-box protection, but it also means more users encounter the certificate-pinning issues mentioned earlier.

Cost and Availability

Web Guard is included in the free version of Avast Antivirus, as well as in the paid Avast Premium Security and Avast Ultimate. There is no extra cost for this specific feature. The free version includes Web Guard, File Guard, and Mail Guard, which is enough for basic protection. Paid versions add extra features like ransomware protection, a firewall, and a VPN, but Web Guard itself is identical.

Frequently Asked Questions

Does Avast Web Guard slow down my internet?

Yes, there is a slight performance impact because every web request is routed through the proxy and scanned. The impact is usually minimal on modern hardware, but you may notice slower page loads on older computers or when downloading large files. If you experience significant slowdowns, you can disable HTTPS scanning while keeping URL blocking enabled.

Is HTTPS scanning safe? Can Avast see my passwords?

Technically, Avast could see the content of HTTPS traffic, including passwords, because it decrypts the data. However, Avast’s privacy policy states that it does not collect or sell browsing data. The scanning is done locally on your device. Still, if you are highly privacy-conscious, you may prefer to disable HTTPS scanning.

Why does Avast show a warning for a website I trust?

This can happen if the site has been compromised recently, or if it contains content that matches a heuristic pattern. It can also be a false positive. If you are sure the site is safe, you can click “More details” and then “Add to exceptions” to allow it. Be cautious, though—only do this if you are certain.

Can Web Guard block ads?

No, Web Guard is not an ad blocker. It only blocks malicious content. If you want to block ads, you need a separate ad blocker extension or a dedicated ad-blocking tool. Some Avast paid versions include an ad-blocking feature, but it is not part of Web Guard.

How do I fix “Web Guard is disabled” error?

This error usually appears when the Web Guard service is not running. Try restarting your computer, or open Avast and go to Settings → Protection → Core Shields, then toggle Web Guard off and on. If that doesn’t work, repair the installation via Control Panel → Programs → Avast → Change → Repair.

Does Web Guard work on Firefox or Chrome?

Yes, Web Guard works across all browsers because it operates at the network level, not as a browser extension. It intercepts traffic from any application that uses the system network stack. However, some browsers like Firefox and Chrome have built-in security features that may conflict or duplicate, but this usually doesn’t cause problems.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →