Block websites from reading or modifying Clipboard contents in Firefox

Martin Brinkmann
Jan 8, 2014
Firefox
|
19

Depending on how a website is configured, it may be able to read or modify Clipboard events that happen on it. Say, you highlight text on the site to copy it to the clipboard of your operating system to paste it into another application.

A script could record what you are copying, or, to take it to another extreme, modify the contents. Some services may for instance add copyright information to the copied text automatically.

A website could also use these events to block you from copying any contents, again by manipulating the event so that nothing is returned.

Other possibilities include preventing paste operations on the site, so that you cannot paste data into form fields but have to type it instead.

Besides being annoying, as you may get a different result than expected, it does have privacy implications as well as sites can log what users paste -- into text areas only I assume -- as well.

dom.event.clipboardevents.enabled

dom events clipboardevents enabled

Firefox has a preference for that, to stop that behavior in its tracks. There may be a downside however to it which needs to be mentioned.

If you are working with rich text editors on the Internet, some may require that those events remain enabled for functionality. A basic example is an editor that processes the text that you are pasting in it to remove all formatting information from it.

To block sites from reading or modifying Clipboard contents in Firefox, do the following:

  1. Type about:config into Firefox's address bar and hit the enter key on the keyboard.
  2. Confirm you will be careful if a warning message pops up.
  3. Use the search up to to find the dom.event.clipboardevents.enabled preference.
  4. The default value of the preference is true, which means that sites can intercept Clipboard events.
  5. Double-click the preference to change its value to false.
  6. Once set, it will block sites from intercepting these events.

Tip: I suggest you monitor your online activities to see if any online editor or site behaves in a different way after you have disabled the feature.

There is unfortunately no option to enable it for individual websites.

Anyway, I highly suggest you set the value of the preference to false to block websites from manipulating Clipboard events in the web browser.

Advertisement

Tutorials & Tips


Previous Post: «
Next Post: «

Comments

  1. Anonymous said on December 28, 2019 at 1:40 pm
    Reply

    I have a question relating to privacy.

    If the last thing I highlighted and copied is sensitive information, can a website I visit copy this from my clipboard?

    1. Anonymous said on January 3, 2021 at 4:50 am
      Reply

      Absolutely yes. This “feature” is a highly insecure POS that should be made illegal, it has no upside.

  2. James Herron said on March 12, 2019 at 2:48 pm
    Reply

    I was trying to copy text from the Economic Times, but the website kept trunkating it and adding a URL with a source code added to it saying that it was copied. I was using Chrome. Is there any way to keep websites in Chrome from modifying the clipboard? (If there isn’t, I can use Firefox when reading news.)

  3. rmpbklyn (@rmpbklyn) said on February 22, 2016 at 3:14 am
    Reply

    is there an add on to toggle back and forth. eg youtube requires false while facebook needs true (if you are copying text as a comment eg a photo_)

  4. Jake said on August 16, 2015 at 12:16 am
    Reply

    Hi, I have an addon for Firefox 39.0 that can read the clipboard contents. Any text I have stored in the clipboard is then visible in the addon – Any idea how it’s doing this or how I can deactivate it – I wonder if websites can do this also? Thanks

  5. me said on April 10, 2015 at 12:28 pm
    Reply

    if you have a CMS: setting dom.event.clipboardevents.enabled = false will break the TinyMCE editor in wordpress (prevents pasting), possibly other editors as well

  6. Anonymous said on March 31, 2015 at 4:50 pm
    Reply

    false = you are unable to paste text on a facebook comment (without the botton Share).

  7. Ken Saunders said on January 14, 2014 at 7:16 am
    Reply

    Well after setting it to false, some forms aren’t automatically filled and that the only change that I can attribute that behavior to so I set it back to true.
    We’ll see.

  8. Dwight Stegall said on January 10, 2014 at 7:07 am
    Reply

    Another potential problem might be sites like TinyURL that give you a Copy To Clipboard llnk when you have the following set to true.

    signed.applets.codebase_principal_support

  9. Maou said on January 9, 2014 at 12:40 pm
    Reply

    Thanks Martin, I was unaware about this security issue.

    Sometimes I need to copy passwords from my security vault to paste somewhere else, so that´s a big deal to me.

  10. Ron said on January 8, 2014 at 10:03 pm
    Reply

    Thanks for the tip. Never realized that the clipboard could be accessed through Mozilla browsers.

  11. Mark M said on January 8, 2014 at 7:40 pm
    Reply

    The first site I tried with the setting was my GMail calendar; trying to change the date on an appointment crashes the site. Oh well.

  12. Kulm said on January 8, 2014 at 5:38 pm
    Reply

    Thanks for the info.
    There’s an add-on too.

    Disable clipboard manipulations 1.0.1

    “Web pages will no longer be able to listen to copy, paste and cut events to learn what you are copying or pasting, they won’t even know that you do it at all. And they won’t be able to interfere to push unwanted content to your clipboard when you copy text.”

    1. emegeve said on January 8, 2014 at 10:29 pm
      Reply

      I was about to comment the exact same thing. Here is the link for the lazy: https://addons.mozilla.org/en-US/firefox/addon/nocopypaste/

  13. g2free said on January 8, 2014 at 3:52 pm
    Reply

    Tor browser has that set to true maybe they are not aware of it should you tell them?

  14. Virtualguy said on January 8, 2014 at 2:59 pm
    Reply

    Finally!!! There has always been a setting in IE’s internet options, going back as far as I can remember, to disable clipboard access, and I have always made it a point to do so in every computer I service. But, I’ve never known the way to disable clipboard access in Firefox, until now. Thanks!
    Now, I need to find out how to do this with Chrome.

    1. InterestedBystander said on January 8, 2014 at 6:25 pm
      Reply

      Does the Chrome version of AdBlock Plus have an option to block clipboard manipulations? Seems to me I read something about that.

      Very important, obviously, if one uses long-and-strong passwords and copy-pastes them from a file or utility on the PC.

      1. Boris said on January 9, 2014 at 12:28 am
        Reply

        I know that makers of Adblockplus have separate extension to do exactly that in Firefox. Chances are that they have something like that for Chrome.

  15. 桜 said on January 8, 2014 at 2:54 pm
    Reply

    Excellent advice. Thank you.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.