 <p><a href="https://developer.mozilla.org/en-US/docs/DOM/window.status" rel="nofollow"><code>window.status</code></a> would be disabled by default in most recent browsers. Consider the scenario where a malicious website could effectively impersonate a trusted entity:</p> <pre><code>&lt;script&gt; $('#bad-link').mouseover(function() { window.status = 'www.microsoft.com'; }); &lt;/script&gt; &lt;a href="http://www.example.com/something-bad" id="bad-link"&gt;Click me&lt;/a&gt; </code></pre> <p>Also remember that <em>a lot</em> of browsers by default don't even display the status bar anymore!</p>