show msg to user, add url protection feature