How to Configure uBlock Origin: Beyond the Defaults

uBlock Origin (uBO) blocks ads, known trackers and malicious sites using its default filter lists, including EasyPrivacy. You do not need advanced mode to get tracker blocking. This guide explains how to keep that baseline, choose optional filter lists and use medium mode when you want more control over third-party scripts and frames.

Medium mode blocks third-party scripts and frames by default instead of relying only on lists of known unwanted requests. It also breaks some websites. Use it if you are willing to troubleshoot; the default configuration remains a reasonable choice if you are not.

One prerequisite before anything else: you need the right extension.

Note for Chrome (Chromium) Users

Chrome no longer supports the Manifest V2 extension platform used by full uBlock Origin. The developer documents the change in the Chrome support notice. The configuration steps below are for full uBlock Origin on Firefox, not uBlock Origin Lite.

uBlock Origin Lite (uBOL) is a separate Manifest V3 extension maintained by Raymond Hill. It does not offer the same dynamic-filtering workflow as full uBO. It does support cosmetic filtering and scriptlet injection: Optimal and Complete modes enable additional filtering with site access. That permission can be granted per site, or across all sites when changing the default mode. See the uBOL FAQ for the differences and limitations.

Use Firefox with full uBlock Origin to follow this guide. Browser support changes over time; do not assume that every Chromium-based browser supports the same extension features.

If you stay on Chrome, consider uBlock Origin Lite, but do not try to paste the dynamic rules below into it as though it were the same extension.

uBlock vs. uBlock Origin — They're Not the Same Extension

uBlock and uBlock Origin are different products. Check the extension name and publisher before installing.

For this guide, install uBlock Origin by Raymond Hill from Mozilla Add-ons. Filter matches, exceptions and any rules you create determine what it blocks.

Filter Lists: Keep the Defaults, Add Two More

uBO ships with a solid default set: uBO's own filter lists (and their sub-suites), EasyList, EasyPrivacy, Peter Lowe's list, and the Online Malicious URL Blocklist. Don't disable any of these.

Privacy Guides recommends two additions that cover ground the defaults don't:

AdGuard URL Tracking Protection (under the Privacy category) — strips tracking parameters from URLs. The ?utm_source=newsletter&fbclid=... strings you see appended to links? Those are tracking tokens. This list removes them before the request goes out.

Actually Legitimate URL Shortener Tool — removes unnecessary ? and & values from URLs, so what you copy out of the address bar is clean. It is a parameter-stripping list, not a link resolver: it can't unshorten a bit.ly-style link or defuse a tracker redirect that runs through a third-party domain.

Two more lists are commonly used, though Privacy Guides does not list them:

uBlock Annoyances — cookie consent banners and other annoyances. Hiding a banner is not the same as recording a rejection of consent. Treat these lists as optional and check for site breakage.

Block Outsider Intrusion into LAN — blocks matching requests from public web pages to local-network addresses; it is not a replacement for a network firewall. It blocks requests from external sites to RFC 1918 addresses (192.168.x.x, 10.x.x.x, 172.16–31.x.x) and link-local ranges. A narrow but real attack vector. It ships disabled by default, so you have to enable it.

A note worth taking seriously: more lists mean more attack surface. A malformed or malicious filter rule can be exploited, and more rules mean more breakage. The two additions above are the ones Privacy Guides considers worth making. Resist the urge to load twenty lists.

Medium Mode: Where It Gets Interesting

Medium mode is optional. It trades more control over third-party requests for more troubleshooting.

First, go to uBO Settings and check "I am an advanced user." This unlocks the dynamic filtering panel — without it, medium mode doesn't exist as a UI concept.

Then open the "My Rules" tab and add these two lines:

* * 3p-script block
* * 3p-frame block

Save and apply.

These rules block third-party scripts and frames unless a more specific dynamic rule overrides them. They do not block third-party images and CSS as entire categories; static lists still apply. First-party scripts can still run, so medium mode does not eliminate analytics or fingerprinting.

The uBO wiki page on medium mode describes it as functionally similar to NoScript for third-party scripts. That's accurate. It's aggressive.

Sites will break. This is not a bug. It's the trade-off you're accepting.

The workflow: when something breaks, open the dynamic filtering panel (the More button in the uBO popup), find the specific third-party domain you need, and set a local noop rule in that domain's row. That relaxes dynamic filtering for that one domain on the current site — not for third-party scripts as a whole. Reload and test the page before clicking the padlock to save the exception. If it still fails, inspect the remaining blocked requests instead of assuming one exception is enough. Over a few weeks, you build a personal whitelist of domains where you've chosen to relax the rules — and everywhere else stays locked down by default. If instead a site needs all its third-party scripts back, set a noop on the 3p-script row itself.

The Dynamic Filtering Panel: Color Coding and the Noop/Allow Distinction

The panel opens via the More button in the uBO popup (only visible in advanced user mode). Three columns: resource type or domain name, global rules, local (per-site) rules.

Do not confuse request activity with rule settings. The domain-name column uses red, green and yellow to show blocked, allowed or mixed requests. In the rule cells, red means block, green means allow, dark grey means noop, and light grey means no explicit rule in that cell; inherited rules may still apply.

The rule types are where people make mistakes.

Noop (dark grey) bypasses only broader dynamic filtering rules — your static filtering, including scriptlet injection, is left completely intact. This is the correct choice when you're fixing breakage. It says "don't block this via dynamic rules," not "allow everything from this domain."

Allow (green) overrides both dynamic and static block rules, so it can re-enable a tracker the static lists were blocking. Set on the first-party (top-level) domain, it also disables scriptlet injection and HTML filtering outright. If you click Allow on a domain to fix a broken page, you may have just re-enabled the tracker you were trying to block. The dynamic filtering guide is clear about this distinction; most users discover it the hard way.

Use noop first when relaxing your own dynamic rules. Allow overrides matching static blocks and should be exceptional. The point-and-click Allow control is hidden by default to discourage accidental bypasses.

Rules are session-temporary by default. Click the padlock to persist the current set. Ctrl+click an individual rule to persist just that one.

CNAME Uncloaking (Firefox Only)

One Firefox-specific feature worth knowing about: CNAME uncloaking. Some tracking services hide behind first-party subdomains using DNS CNAME records — the request looks like it's going to metrics.yoursite.com but actually resolves to a tracker's infrastructure. uBO uses Firefox's browser.dns.resolve() API to detect and block these. This API doesn't exist in Chrome.

CNAME uncloaking is a practical Firefox-specific advantage. The Firefox hardening guide covers browser settings that complement content blocking.

Where This Fits

Medium mode gives you control over third-party scripts and frames. It complements, rather than replaces, other browser protections. Blocking some scripts can reduce exposure to browser fingerprinting, but it does not make your browser anonymous or prevent every fingerprinting technique.

Extensions also add privileged code to your browser. Keep only those you need, and use the guide to auditing browser extensions to review the rest of your installed extensions.

Expect to maintain exceptions as websites change. Keep them local where possible, test before saving, and return to default blocking if the troubleshooting cost outweighs the benefit for you.