Phishing websites imitate trusted online services to obtain passwords, financial information, and other sensitive data. Rapid detection is difficult because an attacker can change a URL, alter webpage content after loading, or delay suspicious behaviour until a user interacts with the page. Existing detectors often analyse only one source of evidence or report a classification without explaining which observable features influenced it. This paper proposes an explainable deep-learning framework that combines URL, webpage-content, and bounded behavioural features through a staged decision process. A character-level URL encoder first estimates risk before navigation. Once the page becomes available, a content encoder examines visible text, document structure, forms, and resource relationships. A temporal encoder then examines permitted browser events, including redirects and delayed form insertion, without collecting passwords, keystrokes, or submitted values. An availability-aware gated fusion layer combines the evidence present at each stage and updates the risk estimate when new observations arrive. Integrated Gradients and structured-feature attribution are proposed to generate local explanations; explanation faithfulness and stability are included in the evaluation rather than assumed from visual plausibility. The experimental protocol specifies time-ordered and registered-domain-disjoint data splits, verified phishing and legitimate examples, realistic login-page controls, URL-only and multimodal baselines, and ablation studies. Evaluation measures include precision, recall, F1 score, area under the precision–recall curve, false positives per 1,000 legitimate visits, calibration, missing-modality performance, and time to warning. The framework is intended to test whether combining page evidence with an immediate URL assessment improves detection of previously unseen phishing websites within a practical warning-time budget. Its effectiveness remains an empirical question: performance figures and deployment claims should be reported only after implementation, independent testing, and reproducibility checks. The resulting study would provide a transparent basis for judging both detection quality and operational usefulness.