NoScript
NoScript is a browser extension that blocks active web content such as JavaScript, Java, Flash, and plugins by default, allowing only trusted sites of your choice. It provides the strongest protection available against cross-site scripting (XSS), clickjacking, drive-by downloads, and other client-side attacks while giving you granular per-site control over scripting permissions.
Key Features
- Default-denial scripting — All scripts blocked by default, only enabled for explicitly trusted sites
- Per-site permissions — Allow or block scripts, frames, and plugins on individual domains
- XSS protection — Built-in cross-site scripting filter against script injection attacks
- Anti-clickjacking — Prevents malicious sites from embedding trusted sites in hidden iframes
- Application Boundaries Enforcer — Prevents data leakage between web applications
- Container-based isolation — Tab-specific permission profiles for multi-site workflows
- Surrogate scripts — Replacement scripts that provide basic functionality without full scripting
Why Use It
NoScript provides the most granular script control of any browser extension. Combined with uBlock Origin for ad blocking and Privacy Badger for tracker blocking, NoScript completes the privacy trifecta. It is particularly effective against zero-day JavaScript exploits since it blocks all scripts by default.
Use Cases
- Maximum security browsing — Block all scripts by default for untrusted sites
- XSS protection — Prevent script injection attacks on web forms and comment sections
- Web development — Test how sites behave with and without JavaScript enabled
Platform
Firefox, Firefox-based browsers (Tor Browser, LibreWolf, Pale Moon)
Licence
GNU General Public License v2.0