ERR_BLOCKED_BY_ORB is a Chromium network-security decision, not a Puppeteer exception. Puppeteer controls Chromium, while Opaque Response Blocking (ORB) evaluates certain cross-origin no-cors responses and blocks them when the response does not provide convincing evidence that it is the requested resource type. Find the exact request, inspect its status, headers, and body, then correct the server or use an explicitly CORS-enabled request. Do not treat disabling browser security as a production fix.
What ERR_BLOCKED_BY_ORB means
ORB protects pages from exposing sensitive cross-origin responses through contexts that do not apply the usual same-origin rules. It is implemented by Chromium; Puppeteer merely drives the browser that makes the request.
The policy is most relevant to qualifying no-cors requests. Chromium uses the response metadata and content as evidence of the intended type. As the Chromium ORB documentation puts it, “A ‘correct’ MIME type is good enough evidence.” If a server labels bytes accurately, ORB normally has no reason to intervene. A wrong label, an unexpected response body, or a redirect to a different kind of document can make the response look unsafe.
This message is not interchangeable with net::ERR_BLOCKED_BY_CLIENT, which Puppeteer documents in connection with Chrome’s HTTPS-first warning flow. Diagnose the exact error text before applying a remedy.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
First, isolate the failing request
A page can load successfully while one image, font, script, media file, or fetch request is blocked. Identify that URL and the request’s context rather than changing launch flags at random.
Use Chrome DevTools
- Run the same page in the same Chrome or Chromium build that Puppeteer uses.
- Open DevTools → Network, reload, and filter for “blocked” or the failing resource URL.
- Record the request URL, initiator, destination type, status or redirect chain, request mode (especially
no-cors), and the page origin. - Open the response headers and preview or copy the response body. Save the browser version shown at chrome://version.
Capture evidence from Puppeteer
This script logs request mode where available, response status and headers, and failed requests. It also saves a screenshot so you can correlate the network event with the page.
import puppeteer from 'puppeteer';
const browser = await puppeteer.launch({headless: true});
const page = await browser.newPage();
page.on('request', request => {
const type = request.resourceType();
const headers = request.headers();
console.log('REQUEST', type, request.method(), request.url(), headers);
});
page.on('response', async response => {
const request = response.request();
const status = response.status();
const headers = response.headers();
if (status >= 400 || request.resourceType() !== 'document') {
console.log('RESPONSE', status, request.resourceType(), response.url(), headers);
}
});
page.on('requestfailed', request => {
console.error('FAILED', request.resourceType(), request.url(), request.failure());
});
await page.goto('https://example.com', {waitUntil: 'networkidle2', timeout: 90000});
await page.screenshot({path: 'diagnostic.png', fullPage: true});
await browser.close();Some failed network requests do not expose a readable response body to page code. In that case, reproduce the URL with an HTTP client or inspect it in DevTools, preserving the exact redirects and request headers.
Inspect the response, not just the URL
Compare these four things before selecting a fix:
| Check | What to record | Why it matters |
|---|---|---|
| Request context | Destination (image, script, media, fetch), initiator origin, and no-cors versus CORS mode |
ORB applies to particular cross-origin response paths, not every request. |
| Status and redirects | HTTP status, every Location, and the final URL |
A supposed image may actually end at a login page, denial page, or HTML error. |
| Declared type | Content-Type and X-Content-Type-Options |
Metadata is evidence used by the browser; a misleading type can cause blocking, especially with nosniff. |
| Actual body | Initial bytes or a safe preview, without logging secrets | HTML, JSON, or a proxy error returned where binary data was expected indicates a server-side problem. |
For example, an endpoint intended to return a PNG but responding with text/html and an HTML login form is not fixed by a Puppeteer option. Correct authentication, routing, or proxy behavior so the endpoint returns the promised bytes and metadata.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Fix an incorrect Content-Type or proxy response
Serve the type that matches the bytes
Set the response’s Content-Type to the actual representation: for example, image/png for PNG bytes, image/jpeg for JPEG, application/javascript for JavaScript, or the appropriate media type for your file. Configure the origin, CDN, reverse proxy, and object-storage metadata consistently; a correct origin header can be overwritten at the edge.
Remove accidental HTML and authentication redirects
- Check whether an expired session redirects to a sign-in page.
- Check authorization and signed-URL expiry for private assets.
- Check WAF, bot protection, and rate-limit responses for HTML or JSON bodies.
- Check that your proxy does not rewrite a missing asset to the application’s HTML shell.
Return an appropriate status for errors instead of a successful HTML document carrying an asset URL. If the resource is intentionally protected, supply the required cookies or authorization in a legitimate, policy-compliant way.
Understand nosniff
X-Content-Type-Options: nosniff tells the browser not to guess a different type. That is valuable when metadata is correct and dangerous when it is not. Chromium developer guidance specifically identifies an actual image mislabeled text/html alongside nosniff as a case to correct at the site.
Use CORS when page JavaScript must read the response
If JavaScript needs to read data from another origin, do not rely on a readable no-cors response. Make the request a CORS request and configure the server’s Access-Control-Allow-Origin policy for the calling origin. Include any required preflight handling for methods or headers, and configure credentials deliberately; wildcard origins cannot be used with credentialed requests.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
CORS does not make an incorrectly typed response correct. The server must still return the intended status, body, and MIME type. Conversely, adding an Access-Control-Allow-Origin header does not grant permission to expose a response if the request remains an opaque no-cors fetch.
Example browser-side fetch
const response = await fetch('https://assets.example.test/data.json', {
mode: 'cors',
credentials: 'omit'
});
if (!response.ok) throw new Error(`HTTP ${response.status}`);
const data = await response.json();The server must answer with a matching Access-Control-Allow-Origin value and Content-Type: application/json. Use the exact origin required by your application rather than opening access unnecessarily.
Verify browser and Puppeteer versions for reproducibility
Puppeteer normally downloads a compatible Chrome version, but its configuration also permits an alternate executable path. Record both versions and confirm which executable is actually launched. Reproduce the failure with that same pair before comparing results across machines.
Changing Puppeteer versions or launch flags is not established as an ORB remedy. Version checks help determine whether behavior changed in a particular Chromium build; they do not repair a wrong server response.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Keep installation failures separate
If Puppeteer cannot find its browser, that is an installation problem, not an ORB block. Package managers can suppress install scripts; Puppeteer’s documented recovery command is:
npx puppeteer browsers installRun it only when the expected browser is missing. Once Chromium starts and a request is blocked, return to response inspection.
What not to do
- Do not disable web security in production. It removes protections rather than fixing the origin’s response and can hide a vulnerability.
- Do not treat every
ERR_BLOCKED_*message alike. Client blocking, certificate failures, CORS errors, and ORB have different causes. - Do not assume a 200 status means success. A 200 HTML login page is still the wrong body for an image or script.
- Do not use the old CORB diagnostic flag as an ORB fix. Chromium’s developer material discusses such flags for controlled diagnosis of earlier behavior, not as a production solution.
When the response appears correct
If request mode, status, redirects, headers, and body all match the intended resource, repeat the test on a current Chrome or Chromium build and preserve a minimal reproduction. Capture the complete request and response headers and a non-sensitive body sample. Chromium developer guidance recommends filing an issue when a block appears incorrect, including that evidence and the exact browser version. Avoid publishing cookies, authorization headers, personal data, or private URLs in a report.
Troubleshooting checklist
- Only one asset fails: compare that asset’s final response with a working asset from the same host; look for a CDN rule or expired signature.
- Everything from a host fails: inspect origin policy, proxy routing, WAF decisions, and whether the host is returning an interstitial.
- It fails only in headless mode: compare the exact executable, user agent, cookies, and headers, then test a normal Chrome session. Do not assume headless itself is the cause.
- It fails after deployment: check edge-cache metadata and redirect differences between environments.
- It changed after a browser update: save both Chrome versions and a response capture; verify whether the server was relying on type sniffing.
- You see
ERR_BLOCKED_BY_CLIENTinstead: follow the HTTPS-first/client-blocking diagnosis, not the ORB steps above.
Or skip the browser setup
For a clean website image or PDF, ScreenshotNeo provides a single HTTP request instead of requiring you to maintain Chromium launch code. It accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each cleanup step can be disabled. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and the response identifies the page verdict and billing status in X-Page-Verdict and X-Billed headers. Its MCP server exposes take_screenshot, get_page_info, and capture_pdf to Claude, Cursor, and other MCP clients.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSee the ScreenshotNeo API documentation for all options, including full-page and selector captures, device presets, retina scale, dark mode, PDF settings, custom CSS and JavaScript, clicks, waits, blocking rules, headers, cookies, user agents, authorization, timezone, geolocation, transparent backgrounds, resizing, TTL caching, signed links, asynchronous webhooks, bulk capture, usage data, and the OpenAPI specification.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
r.raise_for_status()
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = Buffer.from(await res.arrayBuffer());
await import('node:fs/promises').then(fs => fs.writeFile('shot.webp', data));Every plan includes every feature. The Free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots. Yearly billing provides two months free. If you want to avoid ORB-prone browser scripting for routine captures, sign up for ScreenshotNeo free.
Cost, reliability, and performance considerations
For self-hosted Puppeteer, account for browser startup, page load, JavaScript execution, network idle waits, memory, and retries. Reuse a browser process when safe, isolate pages, set explicit navigation timeouts, and avoid treating a blocked optional asset as a failed document capture. Log request IDs and response metadata so a retry does not erase the original evidence.
For ScreenshotNeo, choose a wait condition that matches the page rather than an unnecessarily long fixed delay, use caching with a TTL when content may be reused, and use bulk capture for up to 100 URLs per call. Because failed loads and cache hits are not billed, inspect the returned verdict and billing headers when reconciling usage. Pricing is Free (1,000 monthly), Starter $5/3,000, Growth $15/15,000, Pro $39/60,000, Scale $99/250,000, and Business $249/1,000,000; yearly billing gives two months free.
Recommended Free Tools
Frequently Asked Questions
Does adding a User-Agent header fix ORB?
Not by itself. A different user agent may change what a server returns, but you must verify the final status, headers, and body and correct the server or access policy if the response is still wrong.
Can Puppeteer intercept and rewrite the blocked response?
Interception can help you observe or deliberately mock a response in a controlled test, but it does not make an unsafe cross-origin response valid for a real page. Fix the origin response or use an appropriate CORS design.
Is ORB the same as CORS?
No. CORS governs whether page JavaScript may read a cross-origin response. ORB is a Chromium blocking mechanism for certain opaque cross-origin responses; a request can involve both mechanisms.
Why does the page look fine in a browser but fail in automation?
Compare the exact browser build, cookies, authentication, redirects, user agent, and timing. A normal session may receive a different response, and a seemingly harmless difference can expose an incorrect MIME type or an interstitial to automation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
