RN
Ask what an ad blocker protects you from and most people will answer something close to "viruses." It is a reasonable guess and it is the wrong shape.
A content blocker removes requests to known advertising and tracking hosts. That reduces the number of chances something has to be shown to you, which is genuinely worth having. But the way people actually come to grief on adult sites is not a silent infection arriving through a banner. It is a page that asks them to do something, and they do it.
That distinction determines everything about how to defend yourself, so it is worth being precise about what goes wrong.
What actually goes wrong, roughly in order of frequency
The fake update. A video will not play, and a helpful overlay explains that you need a codec, a player update, a Flash equivalent, or a "browser extension required for HD." Installing it is the entire attack. Nothing was exploited; you were asked, and you agreed.
The rule that defeats this permanently: no legitimate website has needed you to install anything to play video for many years. Browsers play video. Any page telling you otherwise is telling you the only thing you need to know about it.
The fake warning. A full-screen page announcing that your device is infected, that your subscription has expired, or that a scan found problems, usually with a countdown and a phone number. It is a static web page. It knows nothing about your device. The countdown is decoration. Closing the tab ends it, and if it has done something awkward with the window, closing the browser entirely does.
Never call the number. The phone version of this — where somebody talks you into installing remote access software — is considerably more damaging than anything the web page could have done alone.
The billing trap. A "free" offer requiring card details for age verification, a trial that converts to an expensive recurring charge, a subscription with a cancellation path that does not work. Not malware at all, and it costs people more money in aggregate than malware does.
Credential phishing. A convincing login page for a platform you use, reached through an ad or a link. This one matters more than it used to, because accounts now hold payment methods, purchase history and private messages.
Genuine malicious advertising. Real, does happen, and is worth blocking against — advertising networks are resold through enough intermediaries that a bad buyer can get inventory almost anywhere. It is also the rarest item on this list, and the only one on it that a content blocker directly addresses.
Look at the ordering. Blocking covers the last item well, the fourth partially, and does very little about the first three, which are the common ones. That is not an argument against blocking. It is an argument against thinking that blocking is the defence.
The sextortion email is a bluff
This deserves its own section, because it works on people who are otherwise careful.
The message says the sender installed malware on your device, recorded you through the webcam while you were watching pornography, has your contacts, and will send the video unless you pay in cryptocurrency within a short deadline. Sometimes it includes a password of yours, or your phone number, to prove access.
It is a bulk mailing. It is sent to enormous numbers of addresses with no knowledge of any recipient, and the psychology does the work: nearly everyone the message reaches has watched pornography, so the "proof" feels personal when it is a safe statistical bet.
The password, when there is one, comes from a public breach dump rather than from your device — which is genuinely useful information, because it means that password is compromised and should be changed anywhere it is still in use. Some variants spoof your own address as the sender, which is trivial and proves nothing about access to your account.
Do not pay. Do not reply, because a reply marks the address as live. Change any password the message quotes, and check your addresses against a reputable breach-notification service. Then delete it.
The tiny number of cases where such a threat is real look nothing like this — they come from someone who knows you, referencing specifics no bulk mailer could have.
What is actually worth doing
Ordered by how much protection each buys relative to the effort:
Keep the browser and operating system updated. Dull, unpopular, and the single largest factor. Most drive-by techniques target flaws that were patched some time ago and rely on people who have not applied the update.
Install nothing a website asks you to install. One rule, covering the most common failure completely.
Use a password manager, unique passwords, and two-factor authentication. This is what makes the phishing and breach categories survivable. A password reused between an adult platform and your email is the single most consequential mistake in this whole area, because the breach that matters may be one you never hear about.
Use a virtual card or a payment method with a hard limit for anything adult. It caps billing traps at the amount you allowed, and it keeps a recurring charge from attaching to your main account. Read what you are agreeing to before entering card details — the trap is usually disclosed, in the place designed for you not to read it.
Run a content blocker. Fewer opportunities to be socially engineered, less tracking, meaningfully faster pages on ad-heavy sites. Real value; just not the value it is usually credited with.
Consider DNS-level filtering across the network, which covers devices and apps you cannot install anything on.
Use a separate browser profile. Cheap, and it does more for practical privacy than most people expect — separate history, separate cookies, separate autofill, separate saved logins. It is also the honest answer to the most likely privacy problem you have, which is a person with access to your device, not a hacker.
On the anti-adblock wall
Sites detect blockers and ask you to turn them off. There is an actual argument underneath this: free content is paid for by advertising, and blocking it while consuming the content is taking one without the other.
The counter-argument is also real: advertising on much of this internet is not a banner but a tracking apparatus with an occasionally hostile payload, and the sites choosing that inventory have not held up their side either.
Whichever way you land, decide it as a policy rather than reflexively. If a site is worth the trade, allowlist that one site rather than disabling the blocker globally and forgetting. If it is not, close the tab — that is the actual functioning market signal, and there is more free video on the internet than anyone will finish.
Privacy and security are different problems
Worth separating, because the same tools get recommended for both and they do not solve both.
Security is about your device and accounts being compromised. Privacy splits again: local privacy, meaning what someone with access to your computer or phone could find, and network privacy, meaning who can observe or record what you visit. Private browsing windows address the first and are widely misunderstood to address the second. A VPN moves the second problem from your internet provider to the VPN provider, which is an improvement only insofar as you trust the provider more.
Naming which of the three you actually care about will save you from installing three things to solve one problem, and from believing you have solved a problem you have not touched.
The VPN section covers the providers if network privacy is the one you are after.
The summary
Run a blocker; it is worth running. Then put the security effort where the risk actually is — updates, installing nothing a page asks for, unique passwords with two-factor, and a payment method that limits what a billing trap can take.
The threat model on adult sites is overwhelmingly social rather than technical. What protects you is a small number of firm rules about what you will not do, applied consistently, regardless of how convincing the page is.