Chrome extension site access: on click, specific sites or all sites

For most extensions, pick "On click". The extension then reads a page only when you invoke it. Use "On specific sites" for tools tied to a few domains, and keep "On all sites" for the few extensions that truly need to act on every page, such as a password manager.

What the three settings do

Chrome lets you open an extension's Details and choose site access. The three options are "On click", "On specific sites" and "On all sites". You can also reach a quicker version from the Extensions menu in the toolbar, where each extension shows whether it can read and change site data.

The setting controls when the extension may touch page content. It does not change what the extension can do once it has access. With access to a page, an extension can read and change what you see there, which includes text you type into forms.

How to choose

Think about what the extension is for.

• A tool for one service, such as an issue tracker helper, belongs on specific sites.
• A utility you invoke by hand, such as a screenshot or a color picker, belongs on click.
• A tool that must watch every page, such as a password manager or an ad blocker, may need all sites. These deserve the most scrutiny on who publishes them.

Start with the narrowest option and widen only if the extension stops working. If it demands all sites for a task that touches one site, that mismatch is itself a signal.

Why narrow access limits damage

Chrome's developer documentation says permissions help to limit damage if an extension is compromised by malware. This matters because extensions can change hands or be updated after you installed them. A narrow setting means a bad update has fewer pages to read.

Note that the user setting sits on top of what the developer asked for. A developer who declares broad host access in the manifest triggers a warning at install. A developer who uses the activeTab approach gets access only after you invoke the extension. Read more in what the activeTab permission means.

A worked example

Say you install a JSON formatter. It asks to read and change data on all sites. You set it to On click. Now it works when you press its icon on an API response, and it is idle while you use your bank. If an update later turned malicious, it would still need you to click before reading a page.

Quick check

Sources

• Manage Chrome extensions (Google Chrome Help)
• Declare permissions (Chrome for Developers)
• The activeTab permission (Chrome for Developers)

Last reviewed: 19 October 2026.