Frequently Asked Questions
- Limitations - What RequestPolicy Continued cannot help with
- Which kinds of requests are blocked?
- How are sites classified as "third-party sites"?
- What changes to my browser are left behind after uninstalling RequestPolicy?
- Can websites detect that you are using RequestPolicy?
- Other browser addons
- The flag icon is red! What is wrong?
- How to deal with ajax.googleapis.com?
- How to find relevant information about a bug
- What are the default keyboard shortcuts and how do I change them?
- What are RequestPolicy's configuration settings on
Limitations - What RequestPolicy Continued cannot help with
It's important to understand that RequestPolicy can only stop requests that the browser knows about. It is possible for browser plugins such as Flash, Java, and Silverlight to bypass the web browser in making requests. Even though some requests made by these plugins are controlled by RequestPolicy, it's good to be aware that third-party plugins such as these may bypass the browser and, therefore, also bypass RequestPolicy.
HTTP Referer headers
When you follow a link from one page or site to another, your browser sends a Referer HTTP header to the server to tell the tagret site where you came from. Some sites abuse this information to violate visitors’ privacy and track them across the Web. In Firefox, you can disable the sending of the Referer header, or alter the information that is sent, using addons such as Smart Referer or RefControl.
You can also manually alter what information is sent through the HTTP Referer header by going to
about:config and tweaking the
Which kinds of requests are blocked?
By default, any request the browser makes from the current site a user is on to a third-party site is blocked. Users can then whitelist specific sites (with various levels of granularity) to allow requests they approve of. Request that are blocked include:
- Prefetching: There are various types of prefetching, all of which aim at speeding up page loads. RequestPolicy by default disables those prefetching techniques completely. Read about prefetching techniques.
Note that OCSP queries and CRL updates are not blocked. This means that RequestPolicy will not interfere with your browser's attempts to determine whether SSL certificates have been revoked.
How are sites classified as "third-party sites"?
A site is considered a third-party site if its registered domain name is different than the registered domain of the page that initiated the request. For example, the domains:
example.com, www.example.com, a.b.c.example.com All have the same registered domain name (
example.com) and so are considered the same site.
There is some risk posed by this default, but this level of granularity is the one with the optimal tradeoff of usability for privacy and security according to the needs of most users. Read Risk of trusting subdomains and untick
Allow requests to the same domain if you want protection against attacks that use subdomains.
What changes to my browser are left behind after uninstalling RequestPolicy?
By default, when you uninstall or disable RequestPolicy, all changes RequestPolicy made to your browser's settings will be undone. Primarily this means that your default prefetching settings are restored to the browser's default settings. That is, DNS and link prefetching will be re-enabled when you uninstall RequestPolicy.
However, if you have gone to RequestPolicy's preference window and under the Advanced preferences you have disabled the options to Restore default when RequestPolicy is uninstalled, then your browser's default prefetch settings will not be restored when you disable or uninstall RequestPolicy.
Privacy note: RequestPolicy will leave various RequestPolicy-specific settings and configuration files in your browser profile even after it has been uninstalled. For example, your whitelist will still be available to other people who have access to your computer. This is a known bug (see ticket #227). A future version of RequestPolicy will attempt to delete all RequestPolicy whitelist data, etc., when RequestPolicy is uninstalled. In the mean time, if you are looking to remove all RequestPolicy-related files and configurations, you should go to the page about:config in your browser and "reset" every preference that starts with "extensions.requestpolicy". Starting with RequestPolicy version 0.6, you also should delete the "requestpolicy" directory which was created in your browser's profile directory (if you used multiple browser profiles, you will need to locate the one where you had installed RequestPolicy). If you have questions about verifying that you have correctly removed RequestPolicy data, please don't hesitate to contact us.
Can websites detect that you are using RequestPolicy?
Yes. It may be possible for a website to detect that a user has RequestPolicy installed. The website can look at which cross-site requests are blocked and make an educated guess that RequestPolicy is doing the blocking.
More generally, a browser fingerprinting risk exists for users of any extension that modifies the behavior of the web browser on a web page or the content of the web page itself. Check Panopticlick from the Electronic Frontier Foundation to see what browser fingerprinting can reveal about you
Other browser addons
Is there a RequestPolicy for Chrome?
Using uBlock like RequestPolicy
If you want to use uBlock in the way RequestPolicy works, you should block anything third-party and then set a
noop (gray) rule on any domain you want to allow. Use
noop instead of
allow so that uBlock's static rules/lists still apply. Click the padlock to make the rules permanent.
See issue #692.
RequestPolicy and NoScript
Is RequestPolicy an alternative or competitor to NoScript?
RequestPolicy is a tool that gives you a default deny policy for cross-site requests. RequestPolicy allows you to whitelist cross-site requests you trust.
RequestPolicy will protect you from various attacks that NoScript will not (such as CSRF attacks, though there some special cases that NoScript protects against) and will give you greater privacy while browsing.
Having two separate tools that each do their specific jobs well is the best approach. NoScript is an amazing extension and is absolutely essential (like RequestPolicy) to using Firefox securely. It is best to use both RequestPolicy and NoScript.
Other browser addons you may be interested in
Some addons for Firefox can enhance your privacy and security when browsing the Web. For a list of quality addons, check PRISM Break's list of browser addons.
The flag icon is red! What is wrong?
Nothing (on your side) is wrong. RequestPolicy is actually doing it's job by blocking requests to other sites you didn't explicitely request. The website you're visiting is actually trying to force you to request data from other sites, which may be wrong for privacy and security reasons. You will need to allow automatically or manually these requests if the blocking breaks viewing the site. Learn how to use RequestPolicy now...
How to deal with ajax.googleapis.com?
Many sites depend on jQuery served by Google
- Clear cookies regularly with addons like Self-Destructing Cookies
- Spoof your referer with SmartReferer to prevent ajax.googleapis.com from knowing what page you visit when the request is done
- Use your hosts file to redirect requests to jquery.js to a local file or a domain you control.
- Ask the site administrator to host their js libs themselves (eg. reddit.com has an option for this)
- Contribute to subscriptions to add a rule for sites that absolutely require calls to ajax.googleapis.com
- Take the time to allow the request if necessary, or live with the broken site. RequestPolicy is about user control on cross-site requests.
How to find relevant information about a bug
Sometimes a bug is not easily reproducible. You need to make the bug is caused by RequestPolicy Continued itself, not by another addon or incorrect configuration setting. Please do the following:
- Create a new, blank profile in Firefox, with no addons installed.
- Install the latest RequestPolicy Continued from https://addons.mozilla.org/en-US/firefox/addon/requestpolicy-continued/versions/beta
- Navigate to your test page and try to reproduce the bug.
If the problem still occurs with this setup, it is likely a RequestPolicy bug. If the addon works as expected with a blank Firefox profile, then something in your "regular" Firefox profile is causing this bug (another addon or preference). If so, please try the following:
- Start your normal Firefox profile.
- Disable all addons, except RequestPolicy Continued. (you may need to restart Firefox)
- Go to your test page, confirm that RequestPolicy works normally.
- Re-enable another addon (just one), restart Firefox if needed, reload the test page.
- If the bug stll not shows up, the addon you just enabled is not causing it.
- Redo step 4 (enable another addon, restart Firefox if needed, reload the test page.) until you find the addon that is causing the bug to occur, and please report the addon name here.
If disabling all addons didn't help, you can do the following:
- Check firefox' browser console
- Enable RPC's logging and start Fx from the terminal
What are the default keyboard shortcuts and how do I change them?
By default, the RequestPolicy menu can be opened with
alt shift R, and the Request Log keyboard shortcut is disabled. The
Options buttons in the redirect notification bar can be activated with
ctrl-o access keys repspectively.
All of RequestPolicy's keyboard shortcuts can be disabled, or changed (the button access keys cannot however). Go to
about:config from you address bar, and search for the following preferences:
extensions.requestpolicy.keyboardShortcuts.openMenu.enabled extensions.requestpolicy.keyboardShortcuts.openMenu.combo extensions.requestpolicy.keyboardShortcuts.openRequestLog.enabled extensions.requestpolicy.keyboardShortcuts.openRequestLog.combo
To change the keyboard combination, set the
combo pref. If the pref's value is
"default", the default combination is used. Otherwise the format is
"[modifiers] [key]". Modifiers must be separated by spaces. The
[key] must be a single letter. There may be modifiers of any number, even zero. Available modifiers:
- shift: The Shift key.
- alt: The Alt key. On the Macintosh, this is the Option key. On Macintosh this can only be used in conjunction with another modifier, since Alt-Letter combinations are reserved for entering special characters in text.
- meta: The Meta key. On the Macintosh, this is the Command key.
- control: The Control key.
- accel: The key used for keyboard shortcuts on the user's platform, which is Control on Windows and Linux, and Command on Mac. Usually, this would be the value you would use.
If any problems should occur, you should see them in the Browser Console.
What are RequestPolicy's configuration settings on
Here is a list of RequestPolicy's settings that can be edited by going to
about:config in the address bar, along with their descriptions and possible values (TODO):
- Boolean; if RequestPolicy should put an entry in the content-area context menu
- The keyboard combination for a keyboard shortcut, e.g. the "open menu" shortcut. See the FAQ for details.
- Set to
falseto disable the corresponding keyboard shortcut.
- Set to