On both Chrome and Firefox I am unable to reliably block popups without extensions. Though both browsers come with such settings, there seems to be ways to circumvent this behavior.

Now why is that? How are sites able to open pop-ups anyway?

  • 1
    One of the technique is called clickbaits. when ever you click, they take that event and trigger the opening of the link. Usually done with javascript hidden item which moves close with your mouse. Extensions are intelligent enough to identify ads and block them at the network end. Browsers are not so intelligent/specific like extensions - which just execute javascript it is told. They do have some knack on identifying virus/malware sites through a common list. Disable Javascript to block popups (though it may fail many other sites as well) – Sairam Mar 4 '17 at 5:57
  • It's the good ol' arms race concept. The people who make pop-up ads want their ads to be seen whether the users want to see them or not. The users want the pop-up blockers to block pop-ups, so the blocker authors keep having to find new ways to block the new tricks the ad makers come up with. – Shadur Mar 5 '17 at 9:09
  • so when a browser says it block popups, it really only block popups that are caused by non-user-interaction events? – jannikb Mar 6 '17 at 9:18
  • Just use the Adblock extension. Not Adblock Plus because it is a memory hog as it loads lists of "acceptable" ads. – SDsolar Apr 13 '17 at 18:54
  • I'm not asking about tool recommendations, but about the underlying problem with the current technology – jannikb Apr 15 '17 at 6:45

As a long-term webdev, I've seen this evolve from IE6. This is all by design and consideration actually. Legitimate user-desired actions are not to be blocked. Many corporate portals use popups, as do web-based email, messaging, media players, and more. To developers, "Popups" and "popunders" are unintended and unexpected sub-window openings to be exact. If a site launches a popup, it's because you did something.

The rules for FireFox, Chrome, and Safari are identical: if the popup happens as a result of a user action, like a click or keyboard press, it's allowed. If the popup happens on it's own, it's blocked.

How does the browser determine what caused the action? JavaScript has a way to trace the caller of event-handling function(s) and sub-functions all the way back to a physical user action, like a click. If it doesn't find such a caller on the call stack of the popup-launching code, the popup is blocked. Developers generally cannot extend the user-initiated action until later, you have to window.open() right away, or else it's blocked. Extensions can block whatever they want, regardless of the user intent, or lack thereof. Links/forms with target=_blank only fire as a result of user-action, so they need not even be audited.

| improve this answer | |

The site that bypass that settings won't open it on a new tab, but in another window using the command: window.open. There's also this command target="_blank" but it only a new tab, (I ain't sure about this) and this kind of command is blocked by the pop up blocker of the browser by default
The window.openisn't easily recognised by the blocker, therefore it might open the pop up, anyway the extensions do a better job about it.

| improve this answer | |
  • Then why window.open is allowed anyway? When I say I want to block popups, why do browsers execute window.open? – jannikb Mar 6 '17 at 9:20
  • I think because it mistakes as something the user have done. The browser probably thinks that you resquested the open window. – d. fritoti Mar 6 '17 at 17:36
  • thats what I dont understand. How can I want a successful execution of open.window when I use the 'block popups' setting? That don't make sense to me. Do you have an example of such a situation? – jannikb Mar 12 '17 at 7:10
  • Its like that because it would break functionality on some websites. I like how you put it: what you want is clearly not what is assumed to be what you want. For the most part in FF you can fix it by putting some random characters in about:config?filter=dom.popup_allowed_events (put that in your address bar or a bookmark) But since this week some advertisers found a way to make popups onclick without any allowed events. lol I'm going to request there to be a delay popup content about:config entry, something like 3-5 seconds should be enough to close it before rendering any content at all. – user40521 Apr 3 '17 at 2:55
  • Agreed, even some banking sites use that type of undesired 'functionality' and blocking it becomes a big problem. – Overmind May 4 '17 at 10:27

Because "pop-up" is a generic term for a variety of methods of displaying data in a window or modal that displays upon a certain action. There's no one way of creating and displaying a pop up just as there's no one way to do much of anything in the programming and web development world. Sites can use a variety of javascript functions (especially if they also use libraries like jQuery or any number of other javascript frameworks which make displaying modals trivial) or even good ol' HTML to display these windows, so a catch-all solution for getting rid of them is difficult to implement.

Speaking to jQuery specifically, developers have a huge number of triggers that they can use for displaying pop ups, and those popups can take the form of a new tab, new window, creating a new HTML element that displays, displaying a previously hidden/invisible HTML element, and the list goes on...

For example, I could set 3 different triggers for 3 different kinds of popups very simply on one page. First trigger will create a popup anytime the user hovers their cursor over a large div that encompasses the top half of my page. The second trigger will popup whenever a user selects/highlights any text anywhere on the page, and it will display right above the cursor (very common practice with a lot of ad providers that target the specific highlighted text). The final trigger can simply be when a user clicks a button, or to be a little more stealthy, a link on the page. When they click this link it will do two things: first it will trigger a javascript onclick event that I have set to open a predetermined advertisement link in a new window; second it will actually redirect the user to the intended location of the link itself.

Again those are very simplified examples with no code to showcase them (check out http://jquerymodal.com/ for a few examples of what modals can do) but the concepts are very real and very much in use in the wild. It's important to note that not all popups are nefarious or spammy and you should use your own judgement and discretion on whether or not to allow/block them on a per-site basis.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.