Does disabling right click protect your content?
Short answer
No: a disable right click script cancels one browser event, and MDN notes Firefox shows the menu anyway when the visitor holds Shift while right-clicking.
Keyboard shortcuts, view source, developer tools, screenshots and turning off JavaScript all still work, because the browser has already downloaded the page. What protects your work is legal and documentary: copyright vests when you create the work, a licence states the terms, and signed commits or C2PA Content Credentials record who made it and when.
What actually works
- 1 event The script calls preventDefault() on the contextmenu event; that cancels the menu and nothing else. MDN, Element: contextmenu event
- Copyright Vests in the author as soon as a work is created; US authors generally must register before suing. Thaler v. Perlmutter, D.C. Cir. 2025
- git commit -S Signs a commit; git log --show-signature checks it. A signature proves which key made a commit. Pro Git, Signing Your Work
What does a disable right click script do?
It listens for one event and cancels it. The whole mechanism fits on a line: document.addEventListener("contextmenu", e => e.preventDefault()). The MDN reference for the contextmenu event says the event fires when the user attempts to open a context menu, typically by clicking the right mouse button or pressing the context menu key. Calling preventDefault() cancels the browser's menu. That is the entire effect: nothing is hidden, encrypted or locked.
Scripts like this were common on hobby sites in the early 2000s, offered by script libraries including the old CodeLifter collection. The wish behind them was reasonable: I made this, please do not take it. The script could not deliver that.
Why does disabling right click fail?
MDN's own example carries a warning: in Firefox, if the user holds Shift while right-clicking, the context menu is shown without the contextmenu event being fired, so cancelling the event does not stop it.
The deeper reason is that a web page is delivered, not displayed from a distance. By the time a script runs, the browser has already downloaded the HTML, the images and the script itself. View source, developer tools, the keyboard shortcut for copy, saving the page and screenshots never pass through the context menu. A visitor who turns JavaScript off never runs the listener at all.
A web page is delivered, not lent: by the time any script runs, the visitor already has the copy.
What does it break for real visitors?
The context menu is how many people use the web: open link in new tab, copy link address, save image, spelling suggestions in text fields, translate, and items that browser extensions and assistive software add. Removing it costs every reader something and stops the few who copy for only a moment.
If you inherited the script on an old site, removing it is the fix. Search your templates for a contextmenu listener or an oncontextmenu attribute and delete it, along with any script that blocks text selection or the copy shortcut.
What actually shows you made it?
Law and records. In its March 2025 opinion in Thaler v. Perlmutter, the D.C. Circuit explains that the Copyright Act vests copyright in a work's author as soon as the work is created, and that owning it does not depend on registration or publication, although US authors generally must register before suing for infringement. The same court held that the author must be a human being.
A licence tells people what they may do. GitHub's documentation on licensing a repository says that without a licence, default copyright applies and no one may reproduce, distribute or create derivative works. Stating your terms on purpose does more for a careful copier than any script.
For code, signed history is the strongest everyday record. The Pro Git chapter on signing your work shows how to sign commits with git commit -S and tags with git tag -s, and how to check them with git log --show-signature; in Git 1.8.3 and later, git merge can be told to reject commits without a trusted signature using --verify-signatures. A signature proves which key made a commit, not who typed every line.
For images, audio and video, the open standard is C2PA. The C2PA and Content Credentials Explainer describes a Content Credential as a cryptographically bound structure recording an asset's origin, modifications and use of AI, so that tampering is evident. The explainer is frank about limits: Content Credentials do not judge whether provenance data is true, provenance is not always complete, the metadata can be removed, and unlike DRM they do not restrict user access.
What should a site owner do instead?
Delete any disable right click, select-blocking or copy-blocking script. Add a visible copyright and licence line stating what reuse you allow. Keep dated originals and your commit history, signed if you can. Export photographs and media with Content Credentials where your tools support them. If someone copies your work, use those records when you contact them or file a takedown notice.
If a client insists on the script, scope it to a single element such as a canvas game that replaces the browser menu with its own, never the whole document.
How we checked
Checked on 2026-10-15 by the CodeLifter editors: MDN's contextmenu event reference (last modified 28 July 2026), the Pro Git chapter on signing your work, the C2PA and Content Credentials Explainer version 2.3, GitHub's Licensing a repository documentation and the D.C. Circuit's opinion in Thaler v. Perlmutter. We did not run a cross-browser test or check mobile long-press behaviour, and the list of lost menu items is our description, not a quoted source. Drafted with AI assistance; every claim checked against its source. Not legal advice.
Questions and answers
Does disabling right click stop people copying my website?
No. The script only cancels the contextmenu event. MDN notes that Firefox shows the menu on Shift plus right-click anyway, and view source, keyboard copy, developer tools and screenshots never use that menu.
How do I disable right click with JavaScript?
Add a contextmenu listener that calls event.preventDefault(). It cancels the browser menu and nothing else, so we recommend not using it on a whole page.
Can people still see my source code if right click is disabled?
Yes. The browser downloads the HTML, scripts and images before any script runs, and desktop browsers offer view source and developer tools that do not use the context menu.
Do I need to register copyright to own my website content?
No. The D.C. Circuit's 2025 Thaler opinion explains that copyright vests in the author as soon as a work is created; US authors generally must register before suing for infringement.
What proves I wrote a piece of code?
Records made at the time: commit history, signed commits and tags, dated drafts and a licence notice. Pro Git shows how git commit -S signs a commit and git log --show-signature checks it.
Do C2PA Content Credentials stop copying?
No. The C2PA explainer says that, unlike DRM, Content Credentials do not restrict access, and that the metadata can be removed. They make provenance records tamper-evident.
Should I remove an old no right click script from my site?
Yes. Delete the contextmenu listener or oncontextmenu attribute and add a clear copyright and licence line instead.
Sources
An editor checked every claim on this page against these sources on 2026-10-15. If a source has changed since, the source is the authority.
