Trusted-sites allowlist (false-positive escape hatch). When a warning or the hard-block interstitial appears, you can click Trust this site to silence FixClick on that hostname. Trusted hosts produce no finding, no badge, and no overlay. The list is managed from the popup — a new Trusted sites section lists every trusted host with a per-host remove button, a Trust this site shortcut for the current tab, and Clear all.
The allowlist is stored in local browser storage, so it is sticky across sessions and restarts but is cleared if you reset the browser's extension / site data. It never leaves your device.

Fewer false positives on informational pages. The passive on-page ClickFix heuristic now requires all three signals together — fake "human verification" framing and a Run-dialog/terminal/paste instruction and actual command-shaped text — instead of accepting the framing or the command alone. Security articles, vendor blogs, and news write-ups that merely describe ClickFix (without carrying a live command payload) are no longer flagged. The behavioral clipboard-interception path — which fires when a page actually copies a command to your clipboard — is unchanged.