net::ERR_BLOCKED_BY_CLIENT: what it means and how to fix it
A script, font or analytics beacon fails in DevTools with net::ERR_BLOCKED_BY_CLIENT. The server never saw the request — something in the browser stopped it.
What ERR_BLOCKED_BY_CLIENT means
Chrome (and Chromium Edge) uses net::ERR_BLOCKED_BY_CLIENT when the browser itself or an extension aborts a request. You will not find a matching access-log line on the origin: no TCP connection was made for that URL. Firefox often shows the request as blocked by Tracking Protection or an add-on instead of this exact code.
Usual causes
| Symptom | Likely cause |
|---|---|
Only google-analytics, gtag, facebook.net, hotjar, ads fail | Ad / tracker blocker filter lists |
A first-party /api/collect or analytics.js on your domain fails | Filter list matched a path or name (false positive) |
| Fonts or a CDN script fail for some users only | Aggressive lists blocking CDNs, or a privacy extension |
| Fails in normal window, works in guest / private with extensions disabled | Almost certainly an extension |
| Fails for everyone, including curl | Not BLOCKED_BY_CLIENT — look at DNS, TLS, CORS, 404 instead |
| Safari / Firefox only | Intelligent Tracking Prevention / Enhanced Tracking Protection |
Diagnose which extension
- Open DevTools → Network, reproduce, click the red failed row. Initiator / status often says “(blocked:other)” or names the blocker.
- Try an Incognito/Private window with extensions disabled (Chrome: “Allow in Incognito” off for each). If the request succeeds, an extension is guilty.
- Disable extensions one by one, or use the blocker's own logger (uBlock Origin → logger icon) to see which filter rule matched.
- Compare with
curl -I https://…from a terminal. If curl gets 200 and the browser shows BLOCKED_BY_CLIENT, the server is fine.
False positives on your own assets
Filter lists sometimes block paths that contain words like ads, affiliate, tracking, analytics, or well-known third-party hosts you self-host under the same path shape. Renaming a benign bundle from ads-helper.js to something neutral, serving first-party analytics under a boring path, or asking users to allowlist your domain fixes it. Do not ask every visitor to turn off their blocker for essential app JS — keep product code on clean first-party URLs.
What it is not
- Not a CORS failure (those show up as CORS errors after a response).
- Not Mixed Content (that names http resources on https pages — see Mixed Content blocked).
- Not CSP
Refused to load(CSP names the directive; see the CSP explainer). - Not your firewall or nginx config for that single browser.
Related
TypeError: Failed to fetch · Mixed Content blocked · CORS errors · Refused to execute inline script · Who owns this link? · WebSocket connection failed
Questions
What does net::ERR_BLOCKED_BY_CLIENT mean?
The browser or an extension blocked the request locally. The server usually never received it.
Is ERR_BLOCKED_BY_CLIENT a server bug?
Almost never. Check ad blockers and privacy extensions first; confirm with curl or a clean private window.
How do I find which extension blocked a script?
Use a private window with extensions disabled, then re-enable one by one, or open uBlock/AdGuard's logger to see the matching rule.
Why do only some users report a missing script?
They run different blocker lists or Tracking Prevention settings. Your monitoring from a datacenter will not see BLOCKED_BY_CLIENT.
Should I tell users to disable their ad blocker?
Only for true false positives on first-party app code. Prefer renaming paths that look like ads/trackers instead.
Published .