Chrome Extension Site Access: On Click

Chrome extension site access: on click explained

Short answer

Chrome extension site access settings decide where an extension's content scripts can run. On click grants access to a tab only after you click the extension's icon; On specific sites limits access to the hosts you add; On all sites allows every page. Lower site access constrains what code runs on each page without removing the capabilities declared in the manifest.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

The three runtime choices

The setting lives in the extension's details page under Site access and controls host access at runtime, separately from what the manifest requests. Chrome remembers your choice per extension.

On all sites matches a broad host permission; On specific sites and On click narrow it. Some extensions offer these choices in their own options page instead, or rely on user-gesture access only.

Runtime site access options
Option	What happens
On click	Content scripts run only after you click the icon
On specific sites	Runs only on hosts you explicitly add
On all sites	Runs on every page the browser opens

What it limits and what it does not

Site access narrows where content scripts execute. API permissions such as history, downloads or webRequest are not addressed by this setting, and a service worker can still receive events like browser update or alarm events.

Extensions that actively need per-page code, such as translators or page annotators, may work poorly on On click because their interface only activates after a click. Test the feature you actually use.

A sensible habit

Set site access to On click or On specific sites unless the extension genuinely works across the web, such as an ad blocker or a password manager filling forms everywhere.

After an update, revisit the details page: if the publisher adds a new host requirement, Chrome may show a new prompt and it deserves the same review as any other capability change.

Default new extensions to On click and raise only when needed
Re-check site access after every significant update
Compare the runtime choice with the manifest's host permissions

Frequently asked questions

Does On click remove the extension's broad host permission?

No. The manifest still declares the capability. On click pauses the runtime use of that access until you interact with the extension on a tab.

Why does an extension break on On click?

Features that inject code into pages as you browse need the page to be matched automatically. With On click, nothing runs until you click the icon, so automatic features stop working.

Is On specific sites the most private option?

For most people, yes. It limits content scripts to hosts you approve. Some features genuinely need wider access, so pick the narrowest choice that keeps the feature working.

Last reviewed: November 4, 2026