Developers have learned to use showModalDialog (deprecated) or replace pop-ups with <div> -based modals. But for true new windows, the click must be immediate. Mobile Safari takes this to another level. On iPhone, every new window is a tab , not a separate window. The blocker is identical, but with one twist: Meta refresh redirects are also blocked if they occur too quickly. This prevents those malicious "Your iPhone has a virus" fake warnings that try to open 20 tabs per second.
If a script tries to open a new window without being directly triggered by a user click (or tap), Safari smothers it. safari pop up blocker
// This works (directly inside a click handler) button.onclick = () => { window.open('/payment', 'PaymentWindow', 'width=500,height=600'); }; // This fails (even 100ms delay) button.onclick = () => { setTimeout(() => { window.open('/popup-ad'); // BLOCKED }, 100); }; On iPhone, every new window is a tab , not a separate window
That’s now the job of Safari’s and Hide Distracting Items feature—a manual scalpel instead of an automatic shield. If a script tries to open a new
In the early days of the internet, pop-ups were the digital equivalent of a used car salesman jumping through your window. They multiplied, they hid, and they played loud audio from an unknown tab. Today, thanks largely to Safari’s aggressive and intelligent pop-up blocking technology, that chaos has been tamed. But how does it actually work, and where does it draw the line between "helpful window" and "hostile takeover"? The Definition Shift: What Is a "Pop-up" in 2024? To understand Safari’s blocker, you have to understand its quarry. A classic pop-up is a new browser window spawned by JavaScript. But modern "pop-unders," modal overlays, and subscription dialogs blur the line. Safari doesn't just block window.open() —it analyzes the user gesture .
But for the classic, runaway, multi-window, ad-infested pop-up nightmare? Safari’s gatekeeper has won. And the web is quieter for it. Safari doesn’t just block pop-ups—it redefines them by intent, user action, and privacy threat. It’s not a filter; it’s a philosophy. And for 99% of users, it’s the only pop-up blocker you’ll ever need.
Furthermore, since iOS 13, any attempt to repeatedly call window.open() in a loop is throttled to one attempt per 30 seconds. This kills the "pop-up storm" attack entirely. Sometimes legitimate sites break. You click "Print" or "Open Doc," and nothing happens.