Most Firefox users know uBlock Origin for blocking ads. Fewer know uMatrix, the same author's (Raymond Hill) tool for granular control over what browsers can request. Here's what uMatrix does differently and when to use it.
uBlock Origin vs uMatrix
uBlock Origin: Filter-list-based blocking. Blocks known bad domains, ad networks, trackers. Works by default with minimal user input. Great for most users.
uMatrix: Request-type-based blocking. You decide: should this page be allowed to load JavaScript? CSS? Cookies? Third-party frames? XHR requests? Default-deny with whitelist approach.
uMatrix is for users who want control over what a page can do, not just which domains are blocked.
The Matrix UI
uMatrix's popup shows a grid where:
- Rows = request origins (first-party, specific third-party domains)
- Columns = request types (Cookie, CSS, Image, Media, Script, XHR, Frame, Other)
- Cells = allow/block state (green/red/inherited)
You click cells to toggle. A green cell = that request type from that origin is allowed.
The global default: uMatrix defaults to blocking third-party scripts and cookies while allowing first-party resources.
Installation Note
uMatrix development has been archived by its author (Raymond Hill / gorhill) since 2020. It still works but is no longer actively maintained. It's available on AMO and functions correctly in current Firefox. For active development, consider alternatives like uBlock Origin's advanced mode.
Default Behavior
Out of the box, uMatrix:
- Allows: First-party everything, third-party CSS, third-party images
- Blocks: Third-party scripts, third-party cookies, third-party XHR, third-party frames
This breaks many modern web apps (which rely heavily on third-party JS) but provides a clean baseline for research/high-security browsing.
Working with uMatrix
The workflow:
- Load a page
- It's broken (third-party scripts blocked)
- Open the uMatrix popup
- See what's blocked
- Click to allow specific origins/types that the page legitimately needs
- Reload
Over time you build up a whitelist of trusted origins for each site you regularly use.
Shortcut: Allow all third-party scripts from the current page's domain temporarily with one click, then narrow down as needed.
Practical Use Cases
Research / Reading
For reading news or research: block everything, allow only first-party content. You get text and images, nothing else. Zero tracking, no ad scripts, no analytics.
High-Security Browsing
When visiting unfamiliar sites: default-deny all JavaScript. The site may not work, but you won't accidentally execute malicious JS.
Analyzing What Sites Load
uMatrix's popup shows exactly which third-party domains a site contacts. Useful for understanding how a site is instrumented — which analytics, CDNs, social widgets, ad networks it uses.
uBlock Origin's Advanced Mode vs uMatrix
Since uMatrix is archived, uBlock Origin in "Advanced mode" provides similar functionality:
- Click the gear icon in uBlock Origin
- Enable "I am an advanced user"
- The popup gains a "Dynamic Filtering" section
In advanced mode, uBlock Origin can do per-site, per-type rules similar to uMatrix. It's not as granular as uMatrix's full grid, but it covers the main use cases and is actively maintained.
Dynamic rules syntax:
# Block all third-party scripts globally
* * 3p-script block
# Allow google-analytics for no domains (effectively remove from exceptions)
# Allow a specific CDN
cdn.site.com * * allow
The Privacy Reality
Both tools reveal the same uncomfortable truth: modern websites contact a surprising number of third-party domains for a simple page view.
A typical news article might contact:
- 3-5 ad networks
- 2-3 analytics services
- Social sharing buttons (Facebook, Twitter)
- CDNs for fonts and scripts
- A/B testing services
- Subscription paywall services
uMatrix (or uBlock Origin advanced mode) makes this visible and controllable.
Who Should Use uMatrix
- Security researchers analyzing site behavior
- Privacy enthusiasts who want full control
- Developers building web apps (to see what their app requests)
- Anyone browsing high-risk content who wants script blocking per-site
Not recommended for:
- Users who want everything to "just work" (use uBlock Origin standard mode)
- Users who don't want to maintain whitelists
Tab Manager Side Note
If you use uMatrix or any request-blocking extension, combined with Tab Manager & Session Saver for Firefox, you can save different browser sessions per research project — keeping your extension state (and whitelist decisions) organized alongside the tabs for each project. Named sessions don't affect extension settings, but having separate windows per project keeps context clean.
Top comments (0)