NoScript for Firefox is a free, open-source extension that controls which websites may run JavaScript and use other active browser capabilities. It works in desktop Firefox and Firefox for Android. Its permissions distinguish the page you visit from the other sites supplying its scripts, embedded pages and media, so granting access to one source does not have to grant it to every source on the page.
NoScript trust levels and modes
NoScript’s Strict mode leaves unclassified sites at the DEFAULT trust level, with scripts and other potentially harmful capabilities disabled. The popup lists the current page’s sources and lets you change their trust levels individually. A page that depends on blocked scripts may need permissions before its interactive functions work.
Temporarily TRUSTED enables active capabilities until the browser closes or you revoke temporary permissions. TRUSTED keeps the permission across browser restarts, while UNTRUSTED blocks all capabilities, including ordinary HTML frames and alternative content intended for browsers with scripting disabled. In private browsing, per-site choices remain temporary and are discarded when the browser closes.
NoScript also offers two more automatic classification behaviors. Easier mode temporarily trusts an unclassified top-level site while leaving third-party sources for you to classify. Easiest mode extends that site’s permitted capabilities to its unclassified third-party resources. Existing CUSTOM and UNTRUSTED assignments remain in force, and the cross-site protections continue to operate.
The per-site preferences editor can change saved assignments or configure a site without visiting it. Changing a site’s assignment back to DEFAULT removes its individual configuration.
Custom and contextual permissions
CUSTOM permissions divide a site’s access into individual capabilities. You can control scripts, media, frames, fonts, WebGL and network fetches separately, among other categories. The interface highlights capabilities a source has attempted to use but NoScript has blocked, helping identify which permission an inactive page element may need. Custom rules can have either a temporary or permanent lifetime.
Contextual policies add the top-level page to that decision. An embedded feed’s source, for example, can receive permission to run scripts and load frames when it appears on one specified website, while retaining different permissions elsewhere.
Allowing one script can reveal further sources when that script loads additional resources. The command that temporarily trusts all sources currently listed in the popup does not automatically include these newly discovered origins. For a workflow spanning several sites, NoScript can also relax restrictions for the current tab until that tab closes.
LAN access
The LAN capability controls whether a document from the public Internet can link or send requests to hosts on your local network. NoScript disables this capability in the factory DEFAULT and UNTRUSTED presets. A site that needs access to a local device can receive a specific exception through its capability settings.
XSS filtering
NoScript’s XSS filter checks for suspicious requests from one site that could inject and execute code in another. It operates independently of the main script-blocking permissions. When it detects a suspicious request, a warning lets you block or allow it temporarily or permanently. The advanced XSS settings provide a separate place to manage exceptions.
TabGuard
TabGuard is NoScript’s experimental protection against identity leaks through related browser tabs. On relevant cross-site requests, it removes authentication headers and displays a red TG badge. This can leave a destination page looking logged out; manually reloading it or following a link restores authorization.
For cross-tab, cross-site POST requests, TabGuard can pause the load and offer anonymous or normal loading instead. Anonymous loading omits the authentication information, while normal loading may be needed for a legitimate payment or sign-in process. TabGuard is enabled by default in private browsing windows, and its advanced setting can change whether it operates globally.
