An ad blocker is a small program, usually a browser extension, that inspects everything a web page tries to load and refuses the parts that match a list of known advertising servers. The ad never downloads, the tracking code that rides along with it never runs, and the page closes up the space where the ad would have sat. All of this happens in the moment between clicking a link and seeing the page.
That one mechanism explains most of what people notice after installing a blocker: pages appear faster, mobile data lasts longer, and products you glanced at once stop following you around the web. It also explains the less obvious security benefit. Ads are delivered by outside companies through an automated system that has repeatedly been abused to spread malware, so refusing ads also closes one of the more common infection routes on the web.
This guide walks through the machinery: how ads arrive, how blockers decide what to stop, why some ads slip through anyway, and how to confirm that yours is doing its job.
How an ad reaches your screen in the first place
When you open an article, your browser downloads the page itself first, then fires off dozens of follow-up requests for images, fonts, scripts, and other pieces. On an ad-supported site, many of those requests go to ad networks, outside companies hired to fill the empty ad slots. In the fraction of a second the page takes to appear, an automated auction runs: the network announces that a slot is available, advertisers bid on it based on the page topic and on what their trackers know about you, and the winner's ad is fetched and displayed.
The detail that matters for blocking is where the ad comes from. It is not stored on the site you are visiting. It is pulled in from the ad network's servers, at addresses separate from the site's own. The website is a frame, and the ads are shipped in from somewhere else at the last moment. That separation is the weakness ad blockers exploit: if the delivery addresses are known, the deliveries can be refused without touching the page itself.
Filter lists: the rulebook behind every blocker
An ad blocker does not decide on its own what counts as an ad. It follows filter lists, long plain-text files of blocking rules maintained mostly by volunteers. The best known is EasyList, which targets ads, and its companion EasyPrivacy, which targets trackers. There are regional lists for non-English sites, lists that remove cookie consent pop-ups, and lists aimed at especially annoying page furniture.
A rule can be broad or surgical. One rule might block every request to a known ad server. Another might block any address containing a folder name like "banners." A third might target a single stubborn script on a single site that the broader rules miss. Your blocker downloads updated lists automatically, usually every few days, which is how it keeps pace as advertisers change addresses to dodge the rules. It is a genuine cat-and-mouse contest: list maintainers often publish counter-rules within days of a new evasion trick.
Request blocking: stopping ads before they download
The core technique is network request blocking. The extension sits between the page and the internet, and every outgoing request passes its checkpoint. A request that matches a filter rule is canceled before it ever leaves your device.
Because the ad is never fetched at all, the benefits go beyond a cleaner page:
- Pages load faster. Ad auctions, ad scripts, and autoplaying video ads are often the heaviest things on a page. Skip them and the article you came for appears sooner.
- You use less data. On a capped phone plan, ads you never download are megabytes you never pay for.
- Trackers go quiet. The request that would have told an ad company "this person is reading this page right now" never leaves your browser, which is why a good blocker doubles as a privacy tool.
Cosmetic filtering: hiding what is left behind
Blocking requests can leave scars: an empty gray rectangle, a spinning loading icon, or a broken frame where the ad should have been. The second technique, cosmetic filtering, cleans this up. Filter lists include hiding rules alongside blocking rules, and the blocker applies them the way a browser applies a style sheet: this box, that banner, and that floating video player are all set to invisible, and the surrounding content flows in to fill the gap.
Cosmetic rules do not save data or stop tracking. Their job is purely visual. They are also the reason a well-tuned extension leaves no trace that ads were ever there, while a DNS blocker, described next, often leaves blank holes in the page.
Extension, app, or DNS: where the blocking happens
Ad blocking can live in three places, and the location decides what it can and cannot do.
- A browser extension is the most capable option. It sees the full address of every request, applies cosmetic filtering, and gives you a per-site switch so you can allow ads on sites you want to support. Install one only from your browser's official extension store.
- A DNS blocker works at the address-lookup level, as an app, a device setting, or a service configured on your home router. When anything on the device asks for the location of a known ad server, the lookup simply returns nothing. This covers every app rather than just the browser, and a router setup covers every device in the house, including smart TVs. The trade-offs: it sees only domain names rather than full addresses, cannot hide leftover gaps, and cannot stop ads served from the same domain as the content.
- Built-in browser protection. Many browsers now block known trackers and some ads out of the box. It is lighter than a dedicated blocker, but it is a sensible baseline if you install nothing else.
On iPhone, ad blockers work as content blockers: you install the app, then turn it on in Settings in your browser's extensions section. On Android, open Settings, search for Private DNS, and enter the hostname of a filtering DNS service to get device-wide blocking with no app at all.
Why some ads still get through
A blocker that seems to be slacking usually is not broken. Some ads are structurally hard to block.
- First-party ads. When a site serves ads from its own domain, mixed in with real content, refusing the ad request would break the page. Search results and ads inside social media apps commonly work this way.
- Sponsored content. An article a company paid to publish is, to a blocker, just an article. There is no separate request to cancel and nothing to hide.
- "Acceptable ads" programs. Some popular blockers allow certain nonintrusive ads by default, through a program advertisers can pay to join. If you want everything gone, find the acceptable ads checkbox in your blocker's settings and clear it.
- Brand-new ad domains. A rule cannot name an address nobody has seen yet, so there is a short window before the lists catch up.
- Anti-adblock walls. Some sites detect blockers and hold back their content until you allowlist them. Whether a site is worth that is your call, and the per-site toggle exists for exactly this decision.
The security case for blocking ads
The strongest argument for an ad blocker is not comfort. It is malvertising: attacks delivered through legitimate advertising slots. Because slots are filled by automated auction, an attacker does not need to hack a website to reach its readers. They only need to slip a booby-trapped ad past an ad network's review, and large, reputable sites have unknowingly carried malicious ads because the site never touches what the network delivers.
A malicious ad might redirect you to a fake virus warning, push a bogus software update, or land you on a counterfeit login page built to steal your password. The fake download button sitting beside the real one on a file-hosting page is a classic of the genre. Blocking ads removes the entire channel before anything inside it can run, which is why security professionals recommend ad blockers, not just people who find ads annoying. A blocker is still only one layer, so keep the fundamentals in place too: our guides to malware and how it spreads and spotting phishing cover the rest.
Set it up and prove it works
Ten minutes covers everything below, and the last step tells you whether the first ones worked.
- Install one blocker from your browser's official extension store. Two blockers running at once do not double the protection; they conflict and slow each other down.
- Check the developer's name and user reviews before installing. Fake blockers that inject their own ads exist, and the store listing is where they give themselves away.
- Open the blocker's settings and confirm filter lists update automatically. That is the default, but it is worth thirty seconds to verify.
- Decide about acceptable ads. Leave the program on to support lighter advertising, or switch it off for a fully clean page. Either is legitimate; it should just be your choice.
- Learn the per-site toggle by clicking the blocker's icon in your toolbar. Allowing ads on a small site you value is the fair-trade option, since ads are how most free sites pay their writers.
- Run our free ad blocker test to confirm requests are actually being blocked, and run it again after any browser update.
