# Changing Tor Browser security settings and customising NoScript per website **URL:** \ **Category:** Tor Browser Desktop\ **Tags:** tor-browser\ **Created:** [March 29, 2025, 3:24pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148 "2025-03-29T15:24:26Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![compis](https://forum.torproject.org/letter_avatar_proxy/v4/letter/c/9d8465/32.png) [@compis](https://forum.torproject.org/u/compis)\ **Post date:** [March 29, 2025, 3:24pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/1 "2025-03-29T15:24:26Z")
While using Tor 14.07, on Linux, I could not proceed on a web site because noscript icon appeared. Why is a user not allowed to disable noscript ? ![tor noscript example preventing viewing](https://forum.torproject.org/uploads/default/original/2X/f/f3b242e4ac80a964e852e6ac9d7a8b9d85eb5abc.png) ---
**Author:** ![Alexey104](https://forum.torproject.org/user_avatar/forum.torproject.org/alexey104/32/1472_2.png) [@Alexey104](https://forum.torproject.org/u/Alexey104)\ **Post date:** [March 30, 2025, 3:16pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/2 "2025-03-30T15:16:46Z")
> [@compis](#): > > Why is a user not allowed to disable noscript ? You are allowed to do this: Hamburger Menu → Add-ons and themes → Extensions → Three dots on NoScript extension → Manage → Toolbar button → Show Now you can access noscript settings via the toolbar icon. ---
**Author:** ![abc](https://forum.torproject.org/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@abc](https://forum.torproject.org/u/abc)\ **Post date:** [March 30, 2025, 3:17pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/3 "2025-03-30T15:17:28Z")
> Why is a user not allowed to disable noscript ? From your screenshot I see you’re running in “Safer” mode. If you click the shield and choose “Standard” it’s possible NoScript will take more of a backseat. But it also leaves your browser in a much more vulnerable position. JavaScript is about as dangerous as email these days. JavaScript can do _ **far more** _ than it actually needs to. Lots of JavaScripts exist solely to track you and **constantly** send data from **your** computer to various computers on the Internet. How long have you been on the page? Where is your pointer on the page? What part of the page are you looking at? Can we get control of your microphone? Can we peer through your camera? Can I grab your contact information by using a hidden form on the page? Can I download a trojan without you knowing? Can I do sophisticated things in an effort to uniquely identify your: browser, computer, name, address, etcetera. JavaScripts are in effect programs run within your browser. The browser has bugs, the JS interpreter (I’m sure) has bugs, and JavaScripts themselves can have bugs. So I guess you don’t like my stock advice to always browse with JS off. 🙂 My next piece of advice is to customize your toolbar by putting the NoScript icon in it, then you can easily choose which scripts to run and which should not run. Right click in the toolbar and choose “Customize Toolbar…”, hopefully the next steps are intuitive for you. Personally I recommend browsing at the “Safest” level as much as possible. But on some sites, like this forum, without JS, the site is fundamentally hobbled and near useless. But if you put the NoScript icon in your toolbar, with some fairly easy clicking, you can browse this forum **without** connecting to **Google**. And that strategy applies to all sites. ---
**Author:** ![anong](https://forum.torproject.org/letter_avatar_proxy/v4/letter/a/e47c2d/32.png) [@anong](https://forum.torproject.org/u/anong)\ **Post date:** [March 30, 2025, 3:18pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/4 "2025-03-30T15:18:01Z")
Probably because scripting can reveal your real IP address which would defeat the purpose of Tor Browser. Use a normal browser to access these resources. ---
**Author:** ![BobbyB](https://forum.torproject.org/user_avatar/forum.torproject.org/bobbyb/32/5456_2.png) [@BobbyB](https://forum.torproject.org/u/BobbyB)\ **Post date:** [March 30, 2025, 3:18pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/5 "2025-03-30T15:18:11Z")
Try about:config Then make extensions.hideNoScript false Remember: **I never said this**. And assume the consequences if any. Doesn’t PBS require _Passport_ ---
**Author:** ![abc](https://forum.torproject.org/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@abc](https://forum.torproject.org/u/abc)\ **Post date:** [March 31, 2025, 7:01am UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/6 "2025-03-31T07:01:14Z")
> [@anong](#): > > Use a normal browser to access these resources. > [@BobbyB](#): > > Then make extensions.hideNoScript false 🔥 🚫 WRONG!!! 🚫 🔥 The Signal app is already being disparaged over what seems to be bad advice or something else. Don’t get me wrong, I have some major issues with Tor Browser, but: 1. diverting people away from taking advantage of onion routing is wrong, 2. telling people to disable NoScript and blithely accept all JavaScripts is definitely **NOT** something I advise, and I am sure most people in the Tor Project agree, whether or not you’re using their version of Firefox. ---
**Author:** ![BobbyB](https://forum.torproject.org/user_avatar/forum.torproject.org/bobbyb/32/5456_2.png) [@BobbyB](https://forum.torproject.org/u/BobbyB)\ **Post date:** [March 31, 2025, 3:07pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/7 "2025-03-31T15:07:09Z")
> [@abc](#): > > 🔥 🚫 WRONG!!! 🚫 🔥 Seems you only read/saw what you wanted to read/see. I ended with: > [@BobbyB](#): > > And assume the consequences if any. Key phrase was **assume the consequence** Like you are allow or can swipe a razor blade across your hand (because the option is there) _And assume the consequences if any_ ---
**Author:** ![compis](https://forum.torproject.org/letter_avatar_proxy/v4/letter/c/9d8465/32.png) [@compis](https://forum.torproject.org/u/compis)\ **Post date:** [April 1, 2025, 9:45am UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/8 "2025-04-01T09:45:46Z")
I don’t think hide is the same as disable ---
**Author:** ![compis](https://forum.torproject.org/letter_avatar_proxy/v4/letter/c/9d8465/32.png) [@compis](https://forum.torproject.org/u/compis)\ **Post date:** [April 1, 2025, 9:46am UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/9 "2025-04-01T09:46:02Z")
My concern is that I should be able to at least disable noscript from the Tor browser itself in the event it incorrectly believes a site is not valid. ---
**Author:** ![compis](https://forum.torproject.org/letter_avatar_proxy/v4/letter/c/9d8465/32.png) [@compis](https://forum.torproject.org/u/compis)\ **Post date:** [April 1, 2025, 9:46am UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/10 "2025-04-01T09:46:12Z")
That relies on the extension itself disabling itself instead of the Tor browser disabling. ---
**Author:** ![abc](https://forum.torproject.org/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@abc](https://forum.torproject.org/u/abc)\ **Post date:** [April 2, 2025, 8:44am UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/11 "2025-04-02T08:44:51Z")
> My concern is that I should be able to at least disable noscript from the Tor browser itself in the event it incorrectly believes a site is not valid. Neither Tor Browser nor NoScript make validity claims about websites. Maybe you mean a TLS (encryption) certificate being used by a site? Or a site without a certificate? Or a self-signed cert? When Tor Browser finds a problem with a website, it doesn’t load the page, thus NoScript isn’t run. ---
**Author:** ![abc](https://forum.torproject.org/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@abc](https://forum.torproject.org/u/abc)\ **Post date:** [April 2, 2025, 9:30am UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/12 "2025-04-02T09:30:23Z")
> Key phrase was **assume the consequences** You probably mean “accept the consequences.” Opting in to everything JS can do is patently unsafe. Loading every JavaScript a webpage links to is darn near crazy. But Tor Browser lets you do this, I noted it above. Change from **Safer** to **Standard**. 1. Click the shield to the right of the address bar. 2. Click “Settings…” 3. Under “Security Level” click “Standard.” 4. Close the “Settings” tab. 5. Done. NoScript will no longer require “click to play” for media. * * * Most people have no idea what “the consequences” are. Even JS programmers aren’t about to audit all the scripts on a page. And it gets even worse with web assembly. ---
**Author:** ![BobbyB](https://forum.torproject.org/user_avatar/forum.torproject.org/bobbyb/32/5456_2.png) [@BobbyB](https://forum.torproject.org/u/BobbyB)\ **Post date:** [April 2, 2025, 2:45pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/13 "2025-04-02T14:45:06Z")
I really meant **assume**. So I wondered if I got the meaning wrong and visited Merriam-Webster. We are both right. According to them: transitive verb 1 (a) : to take to or upon oneself assume responsibility Then I looked at a synonym for assume 1 as : in to accept to take to or upon oneself ---
**Author:** ![ebanam](https://forum.torproject.org/letter_avatar_proxy/v4/letter/e/eada6e/32.png) [@ebanam](https://forum.torproject.org/u/ebanam)\ **Post date:** [April 2, 2025, 2:53pm UTC](https://forum.torproject.org/t/changing-tor-browser-security-settings-and-customising-noscript-per-website/18148/14 "2025-04-02T14:53:15Z")
Closed on April 2, 2025, 2:53pm UTC