Microsoft Edge Pop-Up Blocker: How to Safely Allow Only the Sites You Trust

It’s a familiar frustration: you click a button to open a document, sign into a portal, or complete a payment, and… nothing happens. A tiny icon in the address bar tells the story: “Pop-up blocked.” Microsoft Edge’s built-in pop-up blocker is doing its job—protecting you from annoying ads, scam pages, and malicious overlays. But when it stops a window from your bank, university, or employer, the default protection suddenly feels like a barrier.

The good news: you don’t have to dismantle Edge’s security to get things working. The smarter fix is a narrow, deliberate exception for the site you trust, leaving every other tab guarded. Here’s exactly how to do that on every platform Edge runs on, plus what to do when the usual steps aren’t enough.

Why Edge Says No—and Why That’s Usually a Good Thing

A pop-up isn’t automatically a villain. Many modern web applications—online banking, enterprise software, learning management systems—launch new windows for statements, print labels, identity verification, and receipts. Edge’s blocker, enabled by default, aims to suppress the endless parade of intrusive ads, fake prize notifications, and tech-support scams that weaponized pop-ups in the browser’s earlier years.

Microsoft’s documentation is clear: the blocker is on by default because unwanted pop-ups remain a real vector for phishing and annoyance. But the company also acknowledges that legitimate pop-ups triggered by a user action (a button click, for instance) may be permitted automatically. When that heuristic fails, the result is a dead click—and a user hunting for a way out.

The Safest Fix: Give One Site a Pass

For the overwhelming majority of users, the correct response is to allow pop-ups only for the domain that needs them. This creates a permanent or one-time exception while keeping the global “Blocked (recommended)” setting intact.

Adding a Trusted Site on Desktop

1. Open Microsoft Edge and click the three-dot menu (Settings and more) in the top-right corner.
2. Select Settings.
3. In the left sidebar or main pane, navigate to Privacy, search, and services.
4. Scroll down to Site permissions and click it.
5. Choose All permissions (sometimes listed directly under Site permissions).
6. Find and click Pop-ups and redirects.
7. Under Allowed to send pop-ups and use redirects, click Add site.
8. Enter the full web address of the site, beginning with https://, and click Add.

Now revisit the page and repeat whatever action triggered the block. Because Edge doesn’t retroactively revive a prevented pop-up, you must initiate the action again.

Pro tip: Use the exact domain that launches the pop-up. If your bank’s login page redirects through a separate authentication service, you may need to allow that service’s domain, not just your bank’s. When in doubt, add the primary site first, test, and check the address bar for clues if the problem persists.

The Even Faster Way: Use the Address Bar Indicator

When Edge blocks a pop-up, it often displays a small icon in the address bar—a window with a red X or a similar indicator. Clicking it reveals a quick-permission prompt:

• Return to the page and repeat the action that failed.
• Click the Pop-up blocked indicator in the address bar.
• Select Always allow pop-ups and redirects from this site.
• Click Done.
• Try your button again.

This method skips the full settings labyrinth and applies the exception immediately.

The Nuclear Option: Allow Pop-Ups Everywhere

In some rare scenarios—a dedicated test machine, a tightly controlled internal network with multiple trusted web apps—turning off the global blocker may be acceptable. To do so:

1. Go to Settings > Privacy, search, and services > Site permissions > All permissions > Pop-ups and redirects.
2. Toggle off Blocked (recommended).

Edge will now allow all sites to spawn pop-ups. The risks are significant: every site, including phishing pages and ad networks, can open new windows. If you must use this mode, treat it as a temporary bypass: complete your task and re-enable the blocker immediately. For most people, the per-site exception list is the far better daily driver.

Mobile Pop-Ups: Android and iOS Are Different

The steps vary by mobile platform, and the setting’s reach is broader on these devices.

On Android

1. Open Edge, tap the three-dot menu, then Settings.
2. Tap Site permissions.
3. Select Pop-ups and redirects.
4. Turn the switch on to allow pop-ups globally.

Note: Android doesn’t currently expose a per-site allow list in the Edge settings UI. The toggle affects all websites. Use it sparingly—disable it after you’re done, and consider using the desktop version of the site if you need a one-time workaround.

On iPhone and iPad

The path is slightly different:

1. Tap the three-dot menu, then Settings.
2. Open Privacy and security (on some versions, it may appear as “Privacy” or “Safety”).
3. Turn off Block Pop-ups.
4. Tap Done.

Again, this is a global switch. After your task, turn “Block Pop-ups” back on to restore protection.

Accessibility: Navigating Pop-Up Settings Without a Mouse

For users relying on screen readers or keyboard-only navigation, Edge’s settings are fully accessible. To reach the pop-up controls:

1. Press Alt + F to open the Settings and more menu.
2. Use the down arrow to select Settings, then press Enter.
3. Press Tab to move into the settings categories.
4. Navigate to Cookies and site permissions (sometimes labeled differently) and press Enter.
5. Tab until you reach Pop-ups and redirects, and press Enter.
6. Tab to the Block (recommended) toggle and press Spacebar to change it.

Microsoft’s accessibility guide for Edge confirms these steps work with Narrator, the built-in Windows screen reader. If a blocked pop-up is preventing access to critical information—like an accessible document or necessary verification—this keyboard sequence ensures you can grant permission without visual navigation.

When Allowing Still Doesn’t Work: A Troubleshooting Checklist

Occasionally, even after adding a site to the allow list, the expected window refuses to appear. Before you disable every security feature in desperation, run through these checks.

Verify the Correct Domain

A site may use multiple subdomains (e.g., login.example.com vs. www.example.com). Ensure the entry in the allowed list matches the subdomain that actually fires the pop-up. Also, confirm you’re using https://—mistyped protocols can ruin the match.

Retry the Action (Yes, Again)

The permission change does not magically resurrect a previously blocked pop-up. You must manually trigger it anew. It’s an obvious step that’s easy to overlook.

Extensions: The Hidden Interlopers

Ad blockers, privacy tools, script managers, and corporate security add-ons can all interfere with legitimate pop-ups. Temporarily disable all extensions (via the Extensions menu) and test. If the pop-up works, re-enable extensions one by one to find the culprit. Then you can configure that extension to allow the specific site rather than removing it entirely.

It’s Not a Pop-Up: Notifications vs. In-Page Elements

Two lookalikes commonly confuse users:

• Browser notifications: These appear as system-level alerts (e.g., Windows notification center) even when the pop-up blocker is active. To stop them, manage notifications on a per-site basis under Settings > Cookies and site permissions > Notifications.
• In-page modals and ads: Floating boxes that stay within the same tab, without opening a new window, are not pop-ups and can’t be blocked by Edge’s pop-up setting. These require content blockers or, often, leaving the offending site.

Managed Devices: When IT Makes the Rules

If you’re using a work or school computer, the pop-up settings might be locked or overwritten by group policy. Administrators can enforce a global block or allow specific domains via policies like DefaultPopupsSetting (set to 2 for block, 1 for allow) and PopupsAllowedForUrls. These policies apply across Windows, macOS, Android, and iOS where Edge is managed.

If you encounter a blocked pop-up that’s essential for your job or coursework:

• Contact your IT support team.
• Provide the exact https:// domain, the action you’re trying to complete, and any error messages.
• Request they add the site to the PopupsAllowedForUrls list rather than disabling the blocker entirely.

This keeps the organization secure while restoring your workflow.

A Note on Old Internet Explorer Habits

If you’re tempted to dig into Windows’ Internet Options control panel, stop. Internet Explorer’s pop-up blocker settings are a relic; IE11 has been retired and no longer receives updates. The modern Edge browser uses its own self-contained permissions system. Configuring pop-ups through Internet Options has no effect on Edge and can lead to confusion.

Outlook: Permission Models Are Evolving

As web applications burgeon in complexity, browser vendors continue refining permission interfaces. Edge is likely to introduce more granular toggles and clearer indicators for pop-up requests. But the core principle will endure: security defaults that can be tailored per site. Staying familiar with these controls now ensures you’re never locked out of a legitimate workflow again.

The Bottom Line: Precision Over Panic

Microsoft Edge’s pop-up blocker is a sensible default that has matured alongside the web. The trick isn’t to defeat it but to use it intelligently. By adding specific trusted sites to the allow list—and using the address bar shortcut when the moment strikes—you can keep the blocker active for the 99.9% of the web that doesn’t need pop-ups while ensuring your bank, school, or employer’s tool works every time.

Think of it like locking your front door but handing a key to a friend. You’re not leaving the house open; you’re just making sure the right people can get in.