A website asks to connect your wallet. A moment later, another window asks for a signature. Treat those as separate decisions. Agreeing to show an account to a site is not a reason to approve every request that follows.
For the technical distinction, MetaMask’s message-signing documentation describes different signing methods. A method name alone is not a verdict on whether a particular request is safe.
Read the connection request
MetaMask’s permission guidance explains that connection requests can specify accounts and networks. Review the exact permissions in your own wallet, since interfaces and capabilities differ. Check the site’s address through a trusted route rather than a link in an unsolicited message.
Connecting can reveal public account information and associate it with your activity on the site. Consider that privacy consequence even if the request does not move assets.
Read the next request from the beginning
A message signature, token permission and transaction are not interchangeable. Some signatures support a login; others can authorise meaningful actions under a protocol. The absence of a network fee does not by itself prove that a signature is harmless.
Ask what the request does, which account is involved and why the action is necessary for the task you intended. If the wallet displays unfamiliar or unreadable data, stop and consult the verified service and wallet documentation. Do not let a countdown or a claimed reward replace understanding.
Never enter a recovery phrase into a website to complete a connection or prove ownership. A legitimate support conversation does not need that secret.
Disconnecting is a different cleanup step
Review connected sites through the wallet’s own settings when a session is finished. Do not assume that disconnecting reverses a transaction, revokes every separate permission or invalidates every signature already given. Investigate the specific authorisation through the appropriate official guidance if you are concerned.
A useful habit is to state the intended action before opening the wallet: “I want to view this account” or “I intend to make this particular transfer.” Then compare every prompt with that intention. Each new request needs its own explanation.