Web Timer ads: what it is and how to remove it

Chrome and Edge can keep a small part running in the background so that sites can deliver notifications, and Windows shows them in its notification area. That is why messages from cheapito.com keep arriving with no browser window open.

The permission to send them was granted when someone clicked Allow on a prompt from that site, often disguised as a robot check or a video player. Closing the browser does not remove it; only the notification settings do.

Remove cheapito.com from the allowed sites and the background messages stop. You can also stop the browser from running in the background in its system settings, but the permission is the real fix.

A notification cannot infect a PC. It is a short text with a link that the browser displays. Clicking it opens a page, and a page cannot install anything unless you agree to a download and run the file.

So the answer depends on what you did after clicking. Looked and closed: you are fine. Downloaded but did not open: delete the file.

Opened a downloaded file: uninstall what it added and scan the PC. Typed card or login details: contact the bank and change the password. In every case, remove cheapito.com from the browser's allowed notifications so the messages stop.

Because that is its whole purpose. Web Timer ads is a push-notification spam site, and its operators are paid for every ad it displays and every click it gets. In this case the ads take the form of desktop notifications.

They are chosen by ad networks that accept almost any advertiser, which is why so many look like warnings or prizes. The ads are not a sign that your PC is broken or infected with something worse; they are a sign that something on it, or in the browser, has permission to advertise. Removing that permission or program stops them.

No. The site cheapito.com exists to push visitors towards ads, and the pages it leads to include fake virus warnings, fake updates, prize scams and notification prompts. Visiting it once does not infect an up-to-date PC, but anything you click or download there is a gamble.

Do not enter personal details, do not allow notifications and do not call phone numbers it shows. If it opens by itself, close the tab and check the browser's extensions and notification permissions. Blocking the single domain helps little, because the operators register new names regularly.

Each notification shows the name of the browser and the site in its small print. In the cases we saw, the messages from cheapito.com came through Chrome, Edge and Firefox. Permissions are stored per browser and per profile, so removing the site in one browser does not affect another.

If you use several Chrome or Edge profiles, check each one. If you sync the browser with an account, remove the permission while signed in, otherwise another computer may still hold it and keep receiving the same messages.

Look for notifications from cheapito.com. That is the trace Web Timer ads leaves, and it shows up as desktop notifications. Ads that appear on every site, including ones that never carried ads before, point to something on your PC or in the browser rather than to the sites themselves.

A quick test is a private window, where extensions are off by default: if the ads disappear there, an extension is responsible. If they appear even with the browser closed, the source is a notification permission or a program in Windows.

Many security products do not block adware or notification sites by default, because users often agreed to them, even through a misleading prompt. Notification spam installs nothing at all, so there is no file to detect.

In Windows 11 you can make Microsoft Defender block potentially unwanted apps: open Windows Security > App & browser control > Reputation-based protection settings and turn on Potentially unwanted app blocking. If notifications caused the pop-ups, no scanner will report them; the fix is in the browser's site settings.

No. Allowing notifications stores a permission in the browser and nothing else. No file is downloaded and no program is added to Windows, which is also why antivirus scans find nothing. The risk comes later, from the notifications themselves: they lead to scam pages, fake updates and phishing forms.

Remove the permission in each browser where you allowed it. If you clicked a notification and downloaded something afterwards, delete that file and run a Microsoft Defender full scan and offline scan.

Probably not. Clicking an ad usually only opens a page, and a page cannot install programs on an up-to-date Windows PC without your help.

You are at risk only if you then downloaded and ran a file, allowed notifications, entered card or login details, or called a phone number shown on the page. Delete any download and run a full and offline scan.

Change passwords you typed, from a clean device. Call your bank if you gave card details. If you called a number or allowed remote access, see the next question.

No program removes Web Timer ads itself, because there is nothing on the PC to remove: the notifications come through a permission saved in the browser, and only the browser's settings take it away, as the steps above show.

What Fortect can do is check the rest of Windows. Its free scan looks for malware, unwanted programs and damaged system files, which is useful if you clicked the ads, downloaded something from the pages they opened, or are not sure what else changed on the PC.

If the scan finds nothing and the notifications stopped after you removed the permission, this problem is solved. Use Microsoft Defender as a second opinion whenever you have downloaded files from pages like these.