Possible threats are identified by a default rule set and additional custom rules that can be downloaded from the Internet or created by the user. If a threat or vulnerability has been identified the user is alerted about it before it is executed. The alert displays the url and type of threat and a list of references that explain the current alert in detail.

The user is prompted for action. This can mean to blacklist or whitelist the url permanently or to block or allow it once for the session. Instead of alerting the user Firekeeper can also block specific threats automatically without prompting for action. This behavior can be defined in the rules of the add-on.

Additional rules can be added by the user which unfortunately requires some knowledge of programming languages like Javascript. A blocklist can be downloaded from the Internet so that it can be used in Firekeeper.

One interesting aspect of Firekeeper is that it does not query a server on the Internet, everything is handled locally.