Is NoScript breaking a site?

NoScript blocks JavaScript and other active content unless you trust the site. That’s its whole point, so many sites will look broken until you allow the right domains. The trick is allowing only the ones the page actually needs.

Updated November 2026. Menus move around between versions: if a label is a little different, look for the closest match.

Quick test

Click the NoScript icon.
Use Disable restrictions for this tab, or Temporarily set top-level sites to TRUSTED.
Reload. If the page works, NoScript was the cause. Revoke temporary permissions undoes it.

Find the domains the page needs

The NoScript popup lists the site and every other domain trying to run scripts, each with a trust level: Default, Trusted, Temporarily trusted, Untrusted or Custom.

Start with the site’s own domain: set it to Temporarily trusted and reload.
Still broken? Look for its content delivery network or framework host (often something like cdn.example.com, examplecdn.net or a well-known library host) and trust that next.
Add one domain at a time and reload after each. Leave ad and analytics domains at Default.

Make it stick (or not)

Temporarily trusted lasts until you close the browser: good for one-off visits.
Trusted is permanent: use it for sites you use often.
Custom lets you allow scripts but keep, say, media, fonts or frames blocked.

Good to know

NoScript sometimes blocks by adding its own security policy to the page rather than cancelling requests, so the browser’s network tools may show nothing blocked.
Its separate cross-site scripting (XSS) filter may ask before letting one site send you to another with unusual data in the address. Allow it only if you started that sign-in or payment yourself.
If NoScript is allowing everything and the site still breaks, check your other blockers.

Let Why Block find it for you

The browser only says “blocked by an extension”, not which one. Why Block weighs up the evidence for every blocker you have installed, names the most likely culprit for each blocked domain, and shows how to let it through. With NoScript installed:

NoScript’s script blocking shows up as a security-policy violation, which Why Block reads directly. It can tell NoScript’s policy apart from the site’s own, so these verdicts are high-confidence.
The impact rating at the top says what the blocking actually broke (sign-in, video, comments, payments, images, the whole page) and what was blocked as intended (ads, analytics, tracking pixels).
Brave and other Chromium browsers: the automatic test (after you confirm) switches your blocking extensions off one at a time, reloads the page and compares, so it can say for certain which one is responsible. Anything still blocked with every extension off is the browser’s own blocker.
Firefox: Firefox doesn’t let one add-on switch others off, so the automatic test isn’t available there. Use Manual compare in the report: switch one blocker off yourself, reload, and Why Block shows exactly what changed.

Add to Firefox Brave & other Chromium browsers

Is NoScript breaking a site?

Quick test

Find the domains the page needs

Make it stick (or not)

Good to know

Related guides