How to Remove a Suspicious Site from Phantom Wallet
If you connected Phantom Wallet to a site that now looks unsafe, you need to disconnect it quickly and check for any approvals it may still hold.
This guide explains how to remove a suspicious site from Phantom Wallet, reduce risk, and verify that your Solana wallet is still secure.
What makes a site suspicious?
In Web3, a “site connection” can mean more than a simple browser login.
A malicious or compromised dApp can request wallet access, signing permissions, token approvals, or transaction confirmations that expose your assets.
Common warning signs include:
- Unexpected pop-ups asking you to sign messages you do not understand
- Requests to connect from unfamiliar domains or misspelled URLs
- Promises of airdrops, mints, or rewards that feel urgent
- Repeated prompts to approve transactions with unclear details
- A website that suddenly changes branding, domain, or behavior
How to remove a suspicious site from Phantom Wallet
Phantom Wallet is a non-custodial wallet, so you control the connection history and any permissions you granted.
Removing the site is usually a matter of disconnecting the dApp, clearing browser-side session data, and checking for token approvals on-chain.
1. Disconnect the site in Phantom
Open Phantom Wallet and go to the settings or connected apps area.
Look for the site name, review the connection, and disconnect it immediately.
- Open Phantom Wallet extension or mobile app
- Navigate to Settings or Connected Apps
- Find the suspicious domain
- Select Disconnect or Remove
If you connected through a browser, also close the tab and clear any session tied to that dApp.
2. Clear browser data for the site
Disconnecting the wallet does not always remove cookies, local storage, or cached session data.
Clearing site data helps prevent the same domain from restoring a stale connection.
- Open your browser privacy or site settings
- Find the suspicious domain in stored site data
- Remove cookies, cached files, and local storage for that site
This step is especially useful if the site keeps reopening prompts or auto-loading wallet requests.
3. Revoke token approvals and permissions
Some dApps request more than a connection.
They may also receive token approvals or authority to interact with assets on your behalf.
On Solana, review your approvals carefully and revoke anything you do not recognize.
Check for:
- Token account authorities
- NFT delegation permissions
- Program interactions you no longer trust
- Any active staking, lending, or liquidity permissions
Use reputable on-chain tools and official ecosystem explorers to inspect permissions.
Always verify the domain of the revocation tool before connecting your wallet.
4. Review recent transactions
Open your wallet activity and scan recent transactions for anything unexpected.
A suspicious site may have triggered a signature request, a token transfer, or an approval you did not intend to make.
Look for:
- Unknown outgoing transfers
- New SPL token accounts you did not create
- NFT transfers or listings you do not recognize
- Repeated failed transactions that may indicate probing behavior
If you see unauthorized activity, move quickly to protect remaining funds.
What to do if you already signed something
If you signed a message, approved a transaction, or granted permissions to a malicious site, disconnecting alone may not be enough.
The safest response depends on what was signed and whether assets are at risk.
If you signed a message only
Message signatures can be used for session authentication, but they can also be abused by phishing sites.
While a signed message does not always move funds, it can still confirm wallet ownership to an attacker.
- Disconnect the site
- Clear browser data
- Watch for suspicious follow-up emails, DMs, or wallet prompts
If you approved a token or transaction
Revocation is more urgent.
If the approval granted spending rights or authority to a contract, revoke it as soon as possible and move assets to a safer wallet if needed.
- Revoke permissions through trusted Solana tools
- Transfer valuable assets to a fresh wallet if compromise is possible
- Use a hardware wallet for added protection where available
How to check whether your Phantom Wallet is still safe?
After removing the suspicious site, validate the wallet state instead of assuming the threat is gone.
Security in crypto is layered, and a clean disconnect does not guarantee that no permission remains.
- Confirm the suspicious domain no longer appears in connected apps
- Verify token balances and NFT holdings
- Check authorities for any active delegations
- Review your browser for unknown extensions or injected scripts
If you use multiple devices, repeat this review on each device where Phantom is installed.
How to prevent suspicious Phantom Wallet connections?
Prevention is easier than recovery.
Most wallet compromises begin with a fake airdrop, counterfeit mint page, malicious clone, or hurried signature request.
- Bookmark official project domains and avoid search-engine lookalikes
- Double-check URLs, especially character swaps and extra hyphens
- Never sign transactions you do not fully understand
- Limit use of the same wallet for trading, minting, and long-term storage
- Keep Phantom, your browser, and your OS updated
- Use a separate “burner” wallet for experimenting with new dApps
Use a wallet separation strategy
A practical security habit is to separate wallets by purpose.
One wallet can be used for routine trading and dApps, while another can store higher-value Solana assets offline or with a hardware wallet.
This reduces the damage if a suspicious site is connected to the wrong wallet.
When should you create a new wallet?
If you suspect key compromise, repeated unauthorized signatures, or active malicious permissions, creating a new wallet may be safer than trying to clean the old one completely.
This is especially important if seed phrases, private keys, or recovery data may have been exposed.
Create a new wallet if:
- You entered your seed phrase on a suspicious site
- You approved an unknown contract with significant authority
- You see repeated unauthorized activity after disconnecting
- Your browser or device may be infected
Move funds only after confirming the new wallet is secure and the old one is fully isolated from risky sites.
Key Phantom Wallet security habits to keep
Once you know how to remove a suspicious site from Phantom Wallet, build habits that lower the chance of future incidents.
Good wallet hygiene matters as much as fast response.
- Inspect every connection request before approving it
- Reject unclear signature prompts
- Check permissions before using any Solana dApp
- Audit active connections regularly
- Use official sources for wallet and revocation tools
Phantom Wallet gives you control, but that control works best when every connection is treated as a security decision rather than a routine click.