Subscribers to web feeds are protected from malware attacks. User web feed activity is monitored, attempts by the user to subscribe to web feeds are detected, and identifiers of web feeds to which the user attempts to subscribe are captured. Links in these web feeds are identified, and it is determined whether identified links in web feeds are safe to access. Web feeds are displayed to the user only in response to determining that all links identified therein are safe. User attempts to obtain new content from displayed web feeds are detected, and links in the new content are identified. It is determined whether identified links in new content are safe. New content that contains only safe links is displayed to the user, whereas new content containing at least one suspicious link is blocked.