HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
gorhill
uMatrix
JavaScript2014–2025
gorhill / uMatrix · Archived

uMatrix

uMatrix: Point and click matrix to filter net requests according to source, destination and type

Explore on GitHubRead Hacker News discussions
102Distinct people
123Mentions
4Explicit recommenders
4.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

uMatrix: Point and click matrix to filter net requests according to source, destination and type

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

I love uMatrix, but all evidence is that they stopped developing it in 2021. https://github.com/gorhill/uMatrix I don't know the implications of that, it's the only tool I've…

neltnerb used a recommendation phrase. 4 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 4:01:40 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year123 dated mentions

Observed mentions: 2014-12-27 13:39:25 UTC to 2025-12-17 19:45:41 UTC.

01020302014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20142015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 15 mentions; 0 submissions, 15 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 18 mentions; 0 submissions, 18 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 16 mentions; 0 submissions, 16 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 27 mentions; 1 submissions, 26 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 12 mentions; 0 submissions, 12 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 9 mentions; 1 submissions, 8 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 11 mentions; 3 submissions, 8 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC202
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC15015
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC18018
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC16016
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC27126
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC12012
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC918
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC1138
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC808
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC303
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
uMatrix Definitely for advanced users. Keep Github issues for actual bugs. User support is /r/uMatrix. Forked and refactored from HTTP Switchboard. Install manually the latest release, or install from: Firefox AMO To help find issues with ongoing development: uMatrix dev build in Releases (click the latest uMatrix.webext.signed.xpi link of the last pre-resease.) Chrome store To help find issues with ongoing development: uMatrix dev build in Chrome store Opera store You may contribute with translation work: For in-app strings, on Crowdin: uMatrix on Crowdin. For description (to be used in AMO, Chrome store, etc.), submit a pull request. Reference description is here (feel free to improve as you wish, I am not a writer). HTTP Switchboard's documentation is still relevant, except for uMatrix's differences with HTTP Switchboard. You may contribute with documentation: uMatrix's wiki. Warnings Regarding broken sites uMatrix does not guarantee that sites will work fine: it is for advanced users who can figure how to un-break sites, because essentially uMatrix is a firewall which works in relaxed block-all/allow-exceptionally mode out of the box: it is not unexpected that sites will break. So this means do not file issues to report broken sites when the sites are broken because uMatrix does its job as expected. I will close any such issue without further comment. Using uMatrix logger is key to un-break sites: the logger will show you all that uMatrix does internally. I expect there will be community driven efforts for users to help each others. If uMatrix had a home, I would probably set up a forum, but I do not plan for such thing, I really just want to code, not manage web sites. If you need help to un-break a site when using uMatrix, you can try Wilders Security, where you are likely to receive help if needed, whether by me or other users. uMatrix can be set to work in allow-all/block-exceptionally mode with a single click on the all cell in the global scope *, if you prefer to work this way. This will of course break less sites, but you would then lose all the benefits which comes with block-all/allow-exceptionally mode -- though you will still benefit from the 62,000+ blacklisted hostnames by default. License GPLv3.
Read the full README on GitHub

What Hacker News says

18 sources
the8472·Oct 12, 2016
The firefox and tor devs are cooperating to upstream a tor browser feature that isolates cookie stores and similar things based on the domain shown in the URL bar[0]. Available in nightly by enabling privacy.firstparty.isolate = true in about:config. Additionally they're also also working on a more customizable version of that called contextual identities[1], which eventually will also be manageable by extensions[2] And of course addons that block cookies in cross-origin requests or cross origin requests in general such as µmatrix[3] also plug this hole. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1260931 [1] https://blog.mozilla.org/tanvi/2016/06/16/contextual-identit... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1302697 [3] https://github.com/gorhill/uMatrix
In Show HN: Your Social Media Fingerprint (maybe NSFW)
AdmiralAsshat·Oct 2, 2016
Alternative: uMatrix https://github.com/gorhill/uMatrix Made by the same developer of uBlock Origin, allows blocking of Javascript and other aspects of the site. I switched awhile back and found it somewhat more usable than NoScript, insofar as it usually allows Javascript on the local site by default, while automatically blocking JS on third-party domains. There are some growing pains associated with it, as there are with NS. Some of the drawbacks I've noticed: - It will take about three or four refreshes before you can whitelist everything necessary to get Youtube working. First youtube, then s.ytimg.com, then googlevideo.com, THEN you might finally get a video. - Any page with a Google Captcha on it will take several refreshes to completely let them through. This is particularly irritating if there's a captcha on a form. - Anything whi
Read the rest
ch needs to reach out to jquery, ajax, etc. will fail. But you should be able to whitelist those once then add them to your permanent whitelist. - I have yet to find a good tutorial for uMatrix yet on how to make some pre-defined rules for common sites. That would greatly reduce the learning curve.
In NoScript is harmful and promotes malware
the8472·Sep 1, 2016
> - Completely unrealistic thought experiment: block ALL cross-domain requests in a browser. Only allow <a> tags. Everything else has to be hosted on the same domain and proxied over. The incentives re-align; all the responsibility and blame will fall squarely on website operators to get their sites right. You can use µMatrix[0] to browse like that and whitelist things as needed. It's surprising how many sites break under same-origin-only rules. And by break I mean they don't even display any text despite the text being present in the markup. [0] https://github.com/gorhill/uMatrix
In On the Insecurity of Whitelists and the Future of Content Security Policy
ymse·May 27, 2016
I prefer uMatrix[0] (by the uBlock author) which gives absolute control over third (and first) party requests. I don't even subscribe to the built-in Adblock filter because of my default-deny rule. It also negates the need for Privacy Badger and similar. See the screenshots for how it works (similar to, but more granular than, uBlock advanced mode). https://github.com/gorhill/uMatrix/wiki/Very-bare-walkthroug... https://github.com/gorhill/uMatrix/wiki/Examples-of-useful-r... 0: https://github.com/gorhill/uMatrix
In Facebook will show ads to non-Facebook users on other websites
lucideer·Apr 18, 2016
If you're using NoScript in the fine-grained manner you describe, and for privacy reasons (not just security), I wonder have you ever looked at uMatrix[0]. Same deal but a bit more performant, and also covers the whitelisting of other privacy-leaking aspects such as cookies, CSS, tracking pixels, iframes, etc. [0] https://github.com/gorhill/uMatrix/wiki/FAQ
In Browserball
ryuuchin·Apr 2, 2016
I see NoScript being recommended but if you're not using Firefox this isn't an option. Lukily both uBlock[1] and uMatrix[2] are cross platform and will work on most (any?) Chromium based browsers as well as Firefox. All instances of uBlock in this post are referring to uBlock Origin[1]. In addition to NoScript both uBlock[1] and uMatrix[2] can be configured to block javascript (you can block both 3rd and 1st party javascript with either). In fact even on Firefox I would recommend trying uMatrix instead of NoScript because of the interface but my opinion is probably biased since I've been using it for some time now. You can keep NoScript enabled in this situation just make sure to whitelist TLD's and allow scripts globally (also remove the built in whitelist while you're at it). If you want a simpler solution which offers the best bang
Read the rest
for your buck then using uBlock in medium mode[3] is what I would recommend. This will block 3rd-party scripts and iframes (globally). Any page breakage that occurs as a result can be very easily handled by setting a noop for scripts and/or iframes for that pages scope. You can also block 1st party scripts if you really want to but it will likely cause a lot more stuff to break. uBlock can also enable browser settings that will prevent WebRTC leakage under certain circumstances. On a side note if you're using even just uBlock then that will likely remove the need for running additional privacy extensions (save ones that deal with cookies) like Disconnect which also block network requests (you can use the Disconnect lists from within uBlock). uMatrix does give you the control over cookies. [1] https://github.com/gorhill/uBlock [2] https://github.com/gorhill/uMatrix [3] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...
In Show HN: What every browser knows about you
pmlnr·Mar 16, 2016
I don't like the no JS approach, it kills an important part of the potential in the web, including polyfills for things like srcset. Instead, I'm using Policeman ( https://addons.mozilla.org/en-US/firefox/addon/policeman/; similar to uMatrix https://github.com/gorhill/uMatrix/releases, but the first is easier to use for me ) which blocks 3rd party anything by default. If they serve their own JS from their own servers, let it be. Others (Facebook connect, GAnalytics an Twitter seems to be _everywhere_): walk away. This obviously renders most of the sites to bare HTML due to the excessive and unneeded use of CDNs, and is a massive pain to use for the first weeks, but after a while the whitelist gets you to a friendly web level. uBlock also runs in the background, just in case things leak through, or I quickly want to check something and I n
Read the rest
eed to turn Policeman off.
In Major sites including New York Times and BBC hit by 'ransomware' malvertising

Showing the 15 most recent of 18 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.