When a Shadowrocket module marks a flow REJECT, the pop stays green and one site or one button dies. Disable every module and script, leave the subscription and base rules, reproduce once. If it recovers, you have a false positive, not a dead provider. Exempt the hostname or live without the module. Long-lived HTTPS decryption just to filter ads is usually the worse deal.
Rule order can still let FINAL win—exceptions. A probe URL that is REJECT’d reddens a whole group—groups. Decrypt plus modules: risk. App: download.
What a misfire looks like versus a dead pop
Dead pop: many sites time out, another node revives a batch. Module: news loads, the sign-in control no-ops; images in one app 404; comments are empty. On a computer, DevTools shows the blocked host. On iPhone, Recent Requests filtered to REJECT.
Payment interstitials, captchas, and OAuth callbacks are where “tracker” lists do the most damage. You see “cannot log in.” The IdP sees a callback that never arrived. Do not rotate subscriptions in that window. Kill the module.
| Symptom | Module first? | Node first? |
|---|---|---|
| One login or pay host | Yes | No |
| URL Test all-timeout, web fine | Probe REJECT’d | No |
| All HTTPS dead | Maybe decrypt | Or the plan expired |
| Another node restores many sites | No | Yes |
Local lists, remote lists, rewrite scripts
Local modules you can search. Remote modules are a URL whose author can add cdn.example to the ads list tonight. Disable auto-update. Rewrite scripts that mutate JSON fail as “200 OK, empty object,” which is nastier than REJECT. Do not run experimental JS on a commute or at checkout.
iOS cannot exempt WeChat by process, only by domain. Put the full hostname on a non-REJECT rule above the module set—same ordering as the exception article. PROCESS-NAME is a desktop port—cross-platform.
Streaming licenses and expired plans
Ad lists love player telemetry hosts; some platforms glue telemetry to the license, so you get a black frame. Disable the module before you hunt a region pop. Streaming: here. An expired plan is dead with or without modules—expiry.
Treat module URLs with the same suspicion as random IPAs. This site does not ship third-party module files. Unknown JS inside the tunnel is someone else’s code on your session.
Converge after the A/B
If login works with modules off, do not re-enable that remote list. Keep a handful of local lines you actually read. Five exemptions later and a refresh still kills you: retire the module. Keep one REJECT screenshot for the next changelog.
Backups restore module URLs and the misfire returns on a new phone—backup. Hub: guides, FAQ. The store build on the download page does not include an “ad-module pack.”