What does net::ERR_BLOCKED_BY_CLIENT mean?

Something inside your browser, almost always an ad blocker or privacy extension, cancelled the request. The server never saw it. Try the page in an Incognito window with extensions off; if it works there, pause the blocker for the site or rename the URL (paths containing words like 'ads', 'track' or 'analytics' get caught by filter lists).

What does net::ERR_BLOCKED_BY_RESPONSE mean?

The server answered, but a header in its response forbids the browser from using it in this context: X-Frame-Options or CSP frame-ancestors for iframes, Cross-Origin-Resource-Policy for images and scripts from another site, or a Cross-Origin-Embedder-Policy mismatch. The suffix after the dot, such as .NotSameOrigin, names which.

What does net::ERR_BLOCKED_BY_ORB mean?

Chrome's Opaque Response Blocking stopped a cross-origin response loaded by a tag like , or because it looked like data, not the media or script the tag expected. Usually the URL returned an HTML error or login page, or JSON, or a file with the wrong Content-Type. Open the URL in a tab to see what it really returns.

How is ERR_BLOCKED_BY_RESPONSE different from a CORS error?

CORS controls whether your JavaScript may read a response it fetched. ERR_BLOCKED_BY_RESPONSE comes from headers that stop a page embedding the resource at all, even in an img or iframe tag where CORS never applies.

ERR_BLOCKED_BY_CLIENT, _RESPONSE and _ORB: which one you have

Chrome's Network tab and console show a request as (blocked:…) or net::ERR_BLOCKED_BY_…. The last word matters: it tells you whether your browser, the server or Chrome's own safety check stopped the request.

Error	Who blocked it	Usual cause
`ERR_BLOCKED_BY_CLIENT`	Your browser, before sending	Ad blocker or privacy extension
`ERR_BLOCKED_BY_RESPONSE`	The server's response headers	Framing rules, Cross-Origin-Resource-Policy, COEP
`ERR_BLOCKED_BY_ORB`	Chrome, after receiving	The URL returned HTML, JSON or the wrong type

net::ERR_BLOCKED_BY_CLIENT

"Client" means your browser. An extension, nearly always an ad or tracker blocker (uBlock Origin, AdBlock, Privacy Badger, Ghostery, Brave Shields), cancelled the request before it left. The server never saw it.

Confirm it: open the page in an Incognito window, where extensions are off by default. If it works there, it's an extension.
As a visitor: pause the blocker for that site.
As the developer: filter lists match URLs. Paths and file names with ads, advert, banner, track, analytics, pixel or sponsor get blocked even when they're your own features. Rename /api/ads-settings to something neutral. Remember a slice of your real users run blockers too, so the page shouldn't break when an analytics script is blocked.

net::ERR_BLOCKED_BY_RESPONSE

The server responded, but its headers say this page may not use the response this way. The part after the dot tells you which rule:

You see	Header responsible	Fix (on the server that sent it)
In an iframe, often with "refused to connect"	`X-Frame-Options` or CSP `frame-ancestors`	Allow your site in `frame-ancestors`. Details.
`.NotSameOrigin` / `.NotSameSite`	`Cross-Origin-Resource-Policy: same-origin` or `same-site`	Send `Cross-Origin-Resource-Policy: cross-origin` on files meant to be embedded elsewhere
`.NotSameOriginAfterDefaultedToSameOriginByCoep`	Your page sends `Cross-Origin-Embedder-Policy: require-corp`	The other server must send CORP `cross-origin`, or load it with `crossorigin` plus CORS, or use `COEP: credentialless`

If the file isn't yours, you can't fix it for your visitors; copy it to your own server if its licence allows. Pages using COEP usually do so for SharedArrayBuffer; if you don't need that, dropping COEP makes the error disappear.

net::ERR_BLOCKED_BY_ORB

Opaque Response Blocking is Chrome's protection against pages using <img>, <script> or <video> tags to pull private data from other sites. When a cross-origin response loaded that way doesn't look like the image, script or media the tag expects, Chrome throws it away. In practice, the URL is wrong:

It returns an HTML page: a 404 page, a login page, a "hotlinking not allowed" page, or a cookie-consent wall.
It returns JSON, because it's an API URL and not the file itself.
It returns the right file with the wrong Content-Type plus X-Content-Type-Options: nosniff, such as a script served as text/plain.

Check: open the URL in its own tab and look at what comes back and its Content-Type in the Network tab. Fix the URL, or on your own server send the correct Content-Type together with X-Content-Type-Options: nosniff; without nosniff, Chrome guesses the type from the first bytes, and that guess is what blocks some legitimate files. If you're fetching data, use fetch() with CORS instead of a tag.

Testing header fixes before the server changes

For ERR_BLOCKED_BY_RESPONSE, you can check that a header change fixes it by changing the header in your own browser first, then asking whoever runs the server for the real fix.

HeaderForge (Chrome, free)

Remove X-Frame-Options or Cross-Origin-Resource-Policy from a site's responses, or set CORP to cross-origin, only on the sites you choose, and see whether each rule fired. No account, no tracking.

Get HeaderForge for Chrome

More on this topic: CORS tester · CORS error: what it means and how to fix it (including localhost) · “Has been blocked by CORS policy”: every variant and its fix · Access-Control-Allow-Origin: values, multiple origins and server examples