No, it's a full dimension. That you can't see it in the GUI is because the GUI is already scoped to the currently-active url, and you can only control the speci

No, it's a full dimension. That you can't see it in the GUI is because the GUI is already scoped to the currently-active url, and you can only control the specificity of the rules, as you say. But if you view the rules, you'll see its three dimensions spelled out: * * * block * * script block * 1st-party * allow stackexchange.com sstatic.net * allow stackexchange.com cdn.sstatic.net script allow This is full [source domain] [target domain] [request type] flexibility. The GUI will only show the stackexchange rules above when you're actually visiting that site; it doesn't mean the third dimension is fake.