declarativeNetRequest

This is the primary API for content blocking extensions in Manifest V3.

Examples:

• Ad blockers.
• Privacy extensions that block tracking scripts.
• Extensions that redirect requests to a more secure (HTTPS) version of a site.
• Parent control extensions that block access to certain websites.

Using this API requires the declarativeNetRequest permission. Host permissions are only needed for rules whose action is redirect or modifyHeaders; pure block, allow, allowAllRequests, and upgradeScheme rules apply across origins without any host permissions.

{
  "name": "My Content Blocker",
  "version": "1.0",
  "manifest_version": 3,
  "permissions": [
    "declarativeNetRequest"
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "declarative_net_request" : {
    "rule_resources" : [{
      "id": "ruleset_1",
      "enabled": true,
      "path": "rules.json"
    }]
  }
}

Why is it not risky?

This is the modern, safe way for extensions like ad blockers to work. The extension gives the browser a list of rules (e.g., "block all requests from tracking.com") and the browser enforces them.

The key is that the extension cannot see your network activity. It just provides the rules and has no idea when they are used. This design protects your privacy while still allowing for effective content blocking. The installation warning you see is because the extension can still affect how websites load.

Here is an example rules.json file that blocks all requests to ads.example.com.

// rules.json

[
  {
    "id": 1,
    "priority": 1,
    "action": { "type": "block" },
    "condition": {
      "urlFilter": "||ads.example.com^",
      "resourceTypes": ["main_frame", "sub_frame", "script", "image"]
    }
  }
]