Skip to content
QR Code Tools logo
QR Code Tools
Sign in
Security Tool

QR Blocklist Tester

Test a URL against your own blocklist with wildcard matching. Editing the URL or the list recomputes the block / allow verdict and names the matching rule. Everything runs in your browser.

1. Enter the URL and the blocklist

Matching: host must match exactly or via a *. wildcard (which also covers the bare domain); a scheme prefix restricts the scheme; a path ending in * matches any path under it. Patterns without a scheme match any scheme.

Result
Verdict
BLOCK
1 matching rule(s)

Matched rules

*.example.com

A Blocklist Only Catches What It Lists

Blocklists are a useful second line: they stop known-bad destinations fast, and testing a URL against the list before a campaign ships proves the list actually fires on the patterns you wrote. But their weakness is structural — a new malicious domain is not on any list yet. For destinations you control, pair the blocklist with an allowlist so that anything unlisted is denied rather than waved through.

Test with real URLs

Test every destination you actually print, including subdomain and path variants. A rule that blocks the bare domain but misses a subdomain is a hole, and this tester shows it before the code ships.

Frequently Asked Questions

How do the patterns work?

One pattern per line. "example.com" matches that host exactly. "*.example.com" matches the host and all its subdomains. Adding a path with "*" matches any path under it, e.g. "example.com/bad/*". A lone "*" blocks everything.

What does "allow" mean here?

Allow means the URL matched no blocklist entry. It does not mean the URL is safe — a blocklist only catches what is listed. An unlisted malicious URL still passes a blocklist check.

Should I use a blocklist or an allowlist?

For controlled QR deployments, an allowlist (only listed destinations permitted) is stronger: anything new is denied by default. A blocklist is better for flagging known-bad destinations while letting everything else through.

Is anything sent to a server?

No. The URL and the list are matched entirely in your browser. Nothing leaves the page.