prevent-window-open

The prevent-window-open snippet prevents window.open calls whose arguments match a pattern, optionally returning a decoy pop-up handle so the page cannot detect the block by inspecting the returned window. Calls that do not match are passed through to the native window.open, so legitimate pop-ups keep working.

window.open is wrapped once, on the first filter; further filters append rules, and the first rule that matches wins. The wrapper preserves the native property descriptor and toString() output. If window.open cannot be wrapped, the snippet logs a warning and leaves the page untouched.

Parameters

Name	Description	Mandatory	Default
pattern	Matched against all `window.open` arguments joined with spaces — there is no per-argument matching. `/.../` is a regex, `/.../i` a case-insensitive regex, anything else an escaped literal. A leading `!` inverts the match. Empty or omitted matches every call, including `window.open()` with no arguments.	No	'', matches every call
delay	Milliseconds. If omitted, prevented calls return `null`. If set, a decoy pop-up handle is returned instead and removed after this many milliseconds. It is the presence of the parameter, not its numeric value, that switches the decoy on: `0`, a negative value or a non-numeric value all return a decoy that is cleaned up immediately.	No	'', returns `null`
decoy	Which decoy to hand back — see below. Only relevant when `delay` is set. Any value other than the three listed throws before the rule is registered, so the filter installs nothing and the error is printed to the console.	No	`iframe`

Decoy values

Value	Behaviour
`iframe`	The requested URL is loaded in a hidden 1×1 `<iframe>` and a fake pop-up handle is returned. The element is removed and the handle reports `closed` after `delay` ms.
`obj`	The same, backed by an `<object data="...">` element instead. Use it for pages that watch for injected iframes, or when a CSP rejects the iframe.
`blank`	A real pop-up is opened, but pointed at `about:blank` instead of the requested URL, and closed after `delay` ms. Use it when the page needs a genuine window handle. The user sees the window, and the browser's own pop-up blocker can still deny the call, in which case the handle is `null`.

For iframe and obj the handle is a facade over an object owned by the snippet, never a real window. It serves closed, close, opener, frameElement, parent, top, self, window, globalThis, frames, location, document and history, and never returns live host objects such as navigator or storage. popup.location is an inert about:blank whose assign, replace and reload do nothing.

Filter examples

For parameter syntax and escaping rules, see Snippets Overview.

Filter	Result
`prevent-window-open`	Prevents every `window.open` call on the page. Each returns `null`.
`prevent-window-open /popunder/`	Prevents only calls whose joined arguments match `/popunder/`. Other pop-ups keep working.
`prevent-window-open /POPUNDER/i`	Same, case-insensitive.
`prevent-window-open _blank`	Literal match: prevents calls whose joined arguments contain `_blank`.
`prevent-window-open /popunder/ 2000`	Returns a decoy pop-up handle backed by a hidden `<iframe>`, removed after 2000 ms.
`prevent-window-open /popunder/ 2000 obj`	Same, but the decoy is backed by an `<object>` element.
`prevent-window-open /popunder/ 2000 blank`	Opens a real pop-up pointed at `about:blank` and closes it after 2000 ms.
`prevent-window-open !/^https://([^.]+[.])?example[.]com/ 1000`	Inverted match: prevents every call except the ones aimed at example.com or one of its subdomains, returning a decoy iframe removed after 1000 ms.

Debugging

Message	When	Definition
`window.open not wrappable, bailing out`	Beginning of snippet execution	`window.open` is missing, is not a function, or its property descriptor is not configurable. The snippet does nothing.
`Wrapped window.open`	After `window.open` has been wrapped	Calls are now intercepted. Logged once per page, for the first filter.
`Prevented window.open(<<joined arguments>>)`	Each time a call matches a rule	The call was prevented. The logged arguments are the haystack the pattern was tested against, so use them to refine `pattern`.
`Allowed window.open(<<joined arguments>>)`	Each time a call matches no rule	The call went through to the native `window.open`.

Pop-ups opened by a hidden <form target="_blank"> and submit(), or by a hijacked anchor click, never call window.open and are not affected by this snippet.