Block access to a list of URLs

What it does

Setting the URLBlocklist policy stops web pages with prohibited URLs from loading. Administrators can specify the list of URL patterns to be blocked. If left unset, no URLs are blocked in the browser. Up to 1,000 exceptions can be defined in URLAllowlist. See how to format a URL pattern ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). Note: This policy does not apply to in-page JavaScript URLs with dynamically loaded data. If you blocked example.com/abc, then example.com could still load it using XMLHTTPRequest. Additionally, this policy does not prevent web pages from updating the URL shown in the omnibox to a blocked one using the JavaScript History API. From Brave version 73, you can block javascript://* URLs. But, this only affects JavaScript entered in the address bar or, for example, bookmarklets. From Brave version 92, this policy is also supported in the headless mode. From Brave version 147, the wildcard * on its own does not apply to internal chrome:// URLs. To block these, you must explicitly use the chrome://* pattern. Note: Blocking internal chrome://* and chrome-untrusted://* URLs can lead to unexpected errors or can be circumvented in some cases. Instead of blocking certain internal URLs, see if there are more specific policies available. For example: - Instead of blocking chrome://settings/certificates, use CACertificateManagementAllowed. - Instead of blocking chrome-untrusted://crosh, use SystemFeaturesDisableList. - Instead of blocking devtools://*, use one of the DeveloperToolsAvailability, DeveloperToolsAvailabilityAllowlist or DeveloperToolsAvailabilityBlocklist policies. Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme:* *

What it writes

Hive

HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER

Registry key

Software\Policies\BraveSoftware\Brave

Options

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\URLBlocklist]

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Block access to a list of URLs
# Name: URLBlocklist
# Scope: Machine
# State: Enabled
# Source: brave.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\URLBlocklist'

./Device/Vendor/MSFT/Policy/Config/ADMX_brave/URLBlocklist

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' {
            $actualBits = if ($actual -is [uint64]) { $actual } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$actual), 0) }
            $expectedBits = if ($Expected -is [uint64]) { $Expected } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$Expected), 0) }
            return $actualBits -eq $expectedBits
        }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Block access to a list of URLs
# Name: URLBlocklist
# Scope: Machine
# State: Enabled
# Source: brave.admx

$keyPath = 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\URLBlocklist'
if (Test-Path -LiteralPath $keyPath) {
    $propertyNames = (Get-Item -LiteralPath $keyPath).Property
    if ($propertyNames.Count -gt 0) {
        $reasons.Add('Key should be empty: HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\URLBlocklist') | Out-Null
    }
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Block access to a list of URLs
# Name: URLBlocklist
# Scope: Machine
# State: Enabled
# Source: brave.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\URLBlocklist'

History 49 retained releases

1. 1.89.1328 Apr 2026
   Registry key: Software\Policies\BraveSoftware\Brave · Value name: Not specified
   • Description … Brave version 92, this policy is also supported in the headless mode. [added: From Brave version 147, the wildcard * on its own does not apply to internal chrome:// URLs. To block these, you must explicitly use the chr…]Note: Blocking internal chrome://* and chrome-untrusted://* URLs can lead to unexpected errors … of blocking chrome://settings/certificates…[added: - Instead of blocking devtools://*, use one of the DeveloperToolsAvailability, DeveloperToolsAvailabilityAllowlist or DeveloperToolsAvailab…] Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme…
     Whole description, marked

     Setting the URLBlocklist policy stops web pages with prohibited URLs from loading. Administrators can specify the list of URL patterns to be blocked. If left unset, no URLs are blocked in the browser. Up to 1,000 exceptions can be defined in URLAllowlist. See how to format a URL pattern ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). Note: This policy does not apply to in-page JavaScript URLs with dynamically loaded data. If you blocked example.com/abc, then example.com could still load it using XMLHTTPRequest. Additionally, this policy does not prevent web pages from updating the URL shown in the omnibox to a blocked one using the JavaScript History API. From Brave version 73, you can block javascript://* URLs. But, this only affects JavaScript entered in the address bar or, for example, bookmarklets. From Brave version 92, this policy is also supported in the headless mode. [added: From Brave version 147, the wildcard * on its own does not apply to internal chrome:// URLs. To block these, you must explicitly use the chrome://* pattern. ]Note: Blocking internal chrome://* and chrome-untrusted://* URLs can lead to unexpected errors or can be circumvented in some cases. Instead of blocking certain internal URLs, see if there are more specific policies available. For example: - Instead of blocking chrome://settings/certificates, use CACertificateManagementAllowed. - Instead of blocking chrome-untrusted://crosh, use SystemFeaturesDisableList.[added: - Instead of blocking devtools://*, use one of the DeveloperToolsAvailability, DeveloperToolsAvailabilityAllowlist or DeveloperToolsAvailabilityBlocklist policies.] Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme:* *

2. 1.88.13214 Mar 2026
   • Already present in the first release ChangeIntel keeps.

47 later releases left it unchanged.

Template

Internal name

URLBlocklist

Namespace

BraveSoftware.Policies.Brave

Template file

brave.admx

Release

Brave Browser 1.98.62 · file set 0e6215da2f0d1ff5…

<policy class="Both" displayName="$(string.URLBlocklist)" explainText="$(string.URLBlocklist_Explain)" key="Software\Policies\BraveSoftware\Brave" name="URLBlocklist" presentation="$(presentation.URLBlocklist)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="BraveSoftware.Policies.Brave:brave" />
      <supportedOn ref="BraveSoftware.Policies.Brave:SUPPORTED_WIN7" />
      <elements>
        <list id="URLBlocklistDesc" key="Software\Policies\BraveSoftware\Brave\URLBlocklist" valuePrefix="" />
      </elements>
    </policy>

<presentation id="URLBlocklist" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"><listBox refId="URLBlocklistDesc">Block access to a list of URLs</listBox></presentation>

BraveSoftware.Policies.Brave:category:Cat_Brave
<category displayName="$(string.Cat_Brave)" name="Cat_Brave" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
BraveSoftware.Policies.Brave:category:brave
<category displayName="$(string.brave)" name="brave" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="BraveSoftware.Policies.Brave:Cat_Brave" />
    </category>
BraveSoftware.Policies.Brave:definition:SUPPORTED_WIN7
<definition displayName="$(string.SUPPORTED_WIN7)" name="SUPPORTED_WIN7" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
BraveSoftware.Policies.Brave:category:Cat_Brave
<category displayName="$(string.Cat_Brave)" name="Cat_Brave" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="BraveSoftware.Policies.Brave:Cat_Brave">Brave Software</string></strings>
BraveSoftware.Policies.Brave:category:brave
<category displayName="$(string.brave)" name="brave" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="BraveSoftware.Policies.Brave:Cat_Brave" />
    </category>
<strings><string id="BraveSoftware.Policies.Brave:brave">Brave</string></strings>
BraveSoftware.Policies.Brave:definition:SUPPORTED_WIN7
<definition displayName="$(string.SUPPORTED_WIN7)" name="SUPPORTED_WIN7" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="BraveSoftware.Policies.Brave:SUPPORTED_WIN7">Microsoft Windows 7 or later</string></strings>