A web page is not a document any more. It is a program that happens to look like one.

Why the default is deny

Opening a page today means running someone else scripts. Analytics counters, ad frameworks, session trackers, chat widgets and A/B testing libraries all execute in the same tab as the article being read. None of them are visible, all of them consume the machine, and a few of them are the delivery route for attacks that arrive without anyone clicking anything.

NoScript approaches this from the opposite direction to most tools. Instead of maintaining a list of bad things to block, it starts by treating unclassified sites as untrusted and lets the user grant permission. The effect is that a new site shows its content but runs nothing until it is allowed, which is a slower first visit and a much smaller attack surface.

The extension is open, and the same component is built into the Tor Browser, where blocking scripts is part of the threat model rather than an optional extra. Version 13.6.36 continues that line: the design has not changed in years because the reasoning behind it has not.

Granularity is the whole point

An allow list with one switch per site would be almost useless, because sites are rarely single origins. An article page pulls fonts from one domain, video from another, comments from a third and statistics from a fourth. NoScript exposes those origins separately, so a reader can allow the site itself and the content delivery network while leaving the tracker blocked.

Permissions can be set per site and, importantly, per context. Temporary permission covers the five minutes needed to watch a video, then expires; permanent permission is for the handful of sites visited daily. Having both means the safe default does not become an obstacle people disable entirely out of frustration.

There is also a cross-site scripting filter, which looks for the pattern where one site tries to inject script into another. That is a different problem from ordinary trackers, and catching it matters on sites that accept user content, where an attacker may be able to get code into a page other people read.

What it costs and who it suits

The cost is real and should be stated. Many sites break in visible ways when scripts are blocked: menus do not open, forms do not submit, video players show a black rectangle. First visits become an exercise in granting permissions one at a time, and some sites never work properly because the site assumes a functioning script environment throughout.

That makes it a poor default for someone who wants a browser to behave like an appliance. It suits people who accept a few minutes of configuration per new site in exchange for knowing what runs, and it suits anyone browsing material that is worth more than convenience, such as research on hostile topics or accounts that would be costly to lose.

Security settings that nobody understands get switched off. The one that survives is the one whose cost is visible and adjustable.

Practical notes: grant temporary permission first and only promote a site to permanent once it has been visited repeatedly; after adding an allowance, reload the page before assuming the site is broken; and if a page still misbehaves, check whether a third-party origin rather than the site itself is the one being blocked.