In Microsoft Edge, runtime_blocked_hosts takes host patterns built from a scheme, an optional subdomain, a required hostname and a required eTLD, with asterisks as wildcards. Extensions then cannot read or change those sites, but users can still install them. Scope it to all extensions or to named IDs.
What the setting does
Microsoft describes it as a way to stop extensions reading and changing data on sensitive websites. It blocks actions such as injecting scripts into your sites, reading cookies and modifying web requests. It does not stop anyone installing or removing extensions. It only limits the sites they can touch.
That makes it a good complement to an allowlist, because even an approved extension may not need to run on your admin console.
The pattern format
Microsoft gives this shape: a scheme (http, https, ftp or asterisk), then an optional subdomain, then a hostname, then the eTLD. The hostname and eTLD parts are required, and the subdomain is optional.
Worked examples from the documentation
| Pattern | Matches | Does not match |
|---|---|---|
| asterisk, colon, double slash, asterisk dot example dot asterisk | http://example.com and https://test.example.co.uk | https://example.microsoft.com |
| http://example.* | http://example.com and http://example.ly | https://example.com and http://test.example.com |
| http://example.com | http://example.com | https://example.com |
| asterisk, colon, double slash, asterisk | All URLs | None |
Read the second row carefully. A pattern that names http only does not match https, and a pattern with no subdomain wildcard does not match a subdomain. Those two details catch most people.
Scope: every extension or named ones
Use the asterisk as the extension ID to apply the rule to all extensions. Use one extension ID to apply it to that extension only. Microsoft says you can set more than one, but they must be separate entries.
{
"*": {
"runtime_blocked_hosts": ["*://*.internal-admin.example"]
}
}
The domain is a placeholder. Replace it with your own sensitive hosts.
Choosing sites to protect
Think about where an over-privileged extension would do the most damage.
- Identity provider and single sign on pages.
- Cloud consoles and admin panels.
- Source hosting and CI dashboards.
- Internal tools that show customer data.
- Payment or finance systems.
Start with five or six. A long list is harder to maintain, and Google's help notes a limit of 100 host patterns for the Chrome version of this field.
Allow exceptions
Microsoft also documents runtime_allowed_hosts, which lets extensions work on listed sites. Use it for the rare case where a required tool must run on a protected host. Keep the exception per extension where you can.
Test every pattern
- Install a test extension that modifies pages.
- Apply the pattern.
- Visit the protected site over http and https, and on a subdomain.
- Confirm the extension does nothing on matching sites and still works elsewhere.
Related reading: match patterns explained and Chrome site access on click or all sites.
Safeguard note
Safeguard offers browser extensions for Chrome and Edge, and a free scan at gold.safeguard.sh/scan. Host blocking is set in Edge policy.
Quick check
Does runtime_blocked_hosts stop an extension being installed?
No. Microsoft says it only prevents extensions altering the specified sites.
Does an http pattern match https?
No. In Microsoft's examples a pattern naming http does not match https.
Sources
- Use group policies to manage Microsoft Edge extensions, Microsoft Learn
- Manage Chrome extensions, Chrome Enterprise help
Last reviewed: 19 October 2026.
