HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
gorhill
uMatrix
JavaScript2014–2025
gorhill / uMatrix · Archived

uMatrix

uMatrix: Point and click matrix to filter net requests according to source, destination and type

Explore on GitHubRead Hacker News discussions
102Distinct people
123Mentions
4Explicit recommenders
4.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

uMatrix: Point and click matrix to filter net requests according to source, destination and type

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

I love uMatrix, but all evidence is that they stopped developing it in 2021. https://github.com/gorhill/uMatrix I don't know the implications of that, it's the only tool I've…

neltnerb used a recommendation phrase. 4 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 5:05:26 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year123 dated mentions

Observed mentions: 2014-12-27 13:39:25 UTC to 2025-12-17 19:45:41 UTC.

01020302014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20142015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 15 mentions; 0 submissions, 15 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 18 mentions; 0 submissions, 18 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 16 mentions; 0 submissions, 16 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 27 mentions; 1 submissions, 26 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 12 mentions; 0 submissions, 12 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 9 mentions; 1 submissions, 8 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 11 mentions; 3 submissions, 8 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC202
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC15015
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC18018
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC16016
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC27126
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC12012
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC918
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC1138
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC808
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC303
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
uMatrix Definitely for advanced users. Keep Github issues for actual bugs. User support is /r/uMatrix. Forked and refactored from HTTP Switchboard. Install manually the latest release, or install from: Firefox AMO To help find issues with ongoing development: uMatrix dev build in Releases (click the latest uMatrix.webext.signed.xpi link of the last pre-resease.) Chrome store To help find issues with ongoing development: uMatrix dev build in Chrome store Opera store You may contribute with translation work: For in-app strings, on Crowdin: uMatrix on Crowdin. For description (to be used in AMO, Chrome store, etc.), submit a pull request. Reference description is here (feel free to improve as you wish, I am not a writer). HTTP Switchboard's documentation is still relevant, except for uMatrix's differences with HTTP Switchboard. You may contribute with documentation: uMatrix's wiki. Warnings Regarding broken sites uMatrix does not guarantee that sites will work fine: it is for advanced users who can figure how to un-break sites, because essentially uMatrix is a firewall which works in relaxed block-all/allow-exceptionally mode out of the box: it is not unexpected that sites will break. So this means do not file issues to report broken sites when the sites are broken because uMatrix does its job as expected. I will close any such issue without further comment. Using uMatrix logger is key to un-break sites: the logger will show you all that uMatrix does internally. I expect there will be community driven efforts for users to help each others. If uMatrix had a home, I would probably set up a forum, but I do not plan for such thing, I really just want to code, not manage web sites. If you need help to un-break a site when using uMatrix, you can try Wilders Security, where you are likely to receive help if needed, whether by me or other users. uMatrix can be set to work in allow-all/block-exceptionally mode with a single click on the all cell in the global scope *, if you prefer to work this way. This will of course break less sites, but you would then lose all the benefits which comes with block-all/allow-exceptionally mode -- though you will still benefit from the 62,000+ blacklisted hostnames by default. License GPLv3.
Read the full README on GitHub

What Hacker News says

9 sources
pavon·Sep 20, 2020
This is a good opportunity to inform folks about the Public Suffix List[1]. In short, there is no algorithmic way to know how far up a subdomain is controlled by a single entity. For example ".org", ".co.uk", and ".cloudfront.com" are all public suffixes where subdomains under them are controlled by different entities. Mozilla created[2] the public suffix list to document these regions of control. If you write any software that gives subdomains the same privilege as the base domain, you should (at a minimum) check this list and verify that the subdomain is not known to be controlled by a different party. If you share a domain across multiple entities, you should add your domain to the public suffix list. I don't know if bitwarden uses PSL or not. I learned about this from gorhill who is very diligent about appling this in uMatrix, etc[3].
Read the rest
[1]https://publicsuffix.org/ [2]https://wiki.mozilla.org/Public_Suffix_List [3]https://github.com/gorhill/uMatrix/issues/264
In Bitwarden leaks passwords to other subdomains
danShumway·May 21, 2020
Heads up to anyone who doesn't already know, uMatrix[0] can be set up to block websockets by default from 3rd-party and/or first-party domains. In the UI, websockets are grouped under the "xhr" column[1]. I'm a pretty big Javascript advocate, but I do recommend advanced users run uMatrix and consider disabling at least 3rd-party JS by default. uMatrix is a fantastic tool and it really doesn't take long to get used to. And honestly, a relatively large portion of the web works with only 1st party Javascript, and a surprising chunk of the web still works just fine with no Javascript at all. This is also why I advise advanced users to run Firefox. uMatrix isn't available for Safari, and it's looking extremely likely that it'll be at least underpowered in Chrome once Manifest v3 comes out. Or I guess run Brave or Vivaldi or whatever. Dang kids
Read the rest
running around with their hipster browsers, I can't keep track of them all. The point is, even though I'm extremely bullish on the web as a secure application platform, part of the reason I'm bullish is because the web makes it relatively easy to take simple security measures like disabling scripts by default. You should absolutely take advantage of that, you should absolutely be disabling at least some Javascript features when you browse. You can even globally turn off fingerprinting vectors like WebGL[2]/Canvas[3] in Firefox, and just swap to a different profile whenever you want to visit the rare game/app that requires them. Although with more and more people trying to embed their own DOM models in Canvas, maybe that'll be harder in the future. [0]: https://github.com/gorhill/uMatrix [1]: https://github.com/gorhill/uMatrix/wiki/The-popup-panel#the-... [2]: about:config -> `webgl.disabled` -> true [3]: https://bugzilla.mozilla.org/show_bug.cgi?id=967895
In Stealing secrets from developers using WebSockets

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.