The Gap
Tor covers anonymity. I2P covers the hidden web. Most people need neither of those on a daily basis — they need an everyday browser that stops volunteering information about them to every site they visit.
Firefox is open source, deeply configurable, and built by a non-profit organisation that does not sell advertising. Chrome is built by the world's largest advertising company. That distinction matters more than any benchmark comparison or feature list. The browser you use every day decides which company sees every URL you visit, every search you type, and every form you fill in. Choose accordingly.
This tutorial hardens Firefox for privacy without breaking the web beyond repair. Every change has a trade-off. The trade-offs are documented below, because a privacy configuration you abandon after a week is worse than one you never started.
The Extension Stack
Install these before touching any settings. They handle the most impactful protections with the least breakage and require almost no ongoing configuration.
uBlock Origin
Not just an ad blocker — do not think of it that way. uBlock Origin is a wide-spectrum content blocker that filters network requests by domain, by type, and by pattern. It blocks advertising, tracking scripts, malware domains, coin miners, and annoyances — cookie consent banners, newsletter popups, notification permission prompts, "sign up for our app" overlays.
Leave it in easy mode for daily use. The default filter lists — EasyList, EasyPrivacy, Peter Lowe's Ad and Tracking List, and the malware domain lists — cover the vast majority of tracking and advertising without breaking sites. You do not need to configure anything. Install it and leave it alone.
Advanced users can enable dynamic filtering — accessible from the extension's popup panel — and block all third-party scripts and frames globally, then whitelist them per site as needed. This is dramatically more effective but also dramatically more disruptive. Most sites break until you whitelist the specific third-party resources they depend on. It is worth learning if you have the patience, but it is not necessary for meaningful protection.
Do not install uBlock Origin alongside other ad blockers — Adblock Plus, AdGuard, or any other. They conflict with each other, cause double-filtering that breaks pages in unpredictable ways, and use more memory than a single blocker would. One wide-spectrum blocker is sufficient.
Firefox Multi-Account Containers
Containers are one of Firefox's most underused features. They isolate sites into separate browsing contexts — effectively separate browsers within one browser window, distinguished by coloured tabs. Facebook in one container, Google in another, banking in a third, shopping in a fourth, work in a fifth.
Cookies, local storage, IndexedDB, and sessions do not cross container boundaries. Facebook's tracking pixel running in the blue container cannot read your Google cookies in the green container. Your Amazon browsing history does not follow you into your banking session. Each container is a separate identity as far as the web is concerned.
This prevents cross-site tracking without clearing cookies constantly and without logging in and out of services repeatedly. Assign sites to containers permanently — right-click a tab, select "Open in Container", choose the container, and tick "Always open in this container." The extension remembers. Facebook links always open in the Facebook container. Google links always open in the Google container. The isolation is automatic from that point forward.
The mental model is simple: anything you do not want to share between sites goes in different containers. Sites that know your identity — social media, email, banking — each get their own. Everything else goes in the default container or a general-purpose "browsing" container.
HTTPS-Only Mode
Built into Firefox since version 83. This is not an extension but a setting that should be enabled immediately after installation.
Settings → Privacy & Security → HTTPS-Only Mode → Enable HTTPS-Only Mode in all windows.
Firefox will attempt to upgrade every connection to HTTPS. If a site does not support HTTPS — increasingly rare, but not yet extinct — Firefox displays a full-page warning before loading it over plain HTTP. You decide whether to proceed. The warning is deliberate friction. Plain HTTP transmits everything — including cookies, form data, and page content — in cleartext, visible to every network between you and the server.
Cookie AutoDelete (Optional)
Automatically deletes cookies when you close a tab, except for sites you have whitelisted. Useful if you prefer not to use containers, or as an additional layer alongside them.
Whitelist the sites where you want to stay logged in — your email, your bank, the services you use daily. Everything else gets its cookies cleared on tab close. This limits the window during which a tracking cookie can accumulate data about your browsing to the lifetime of a single tab.
Built-in Privacy Settings
Before touching about:config, set the standard privacy options. Settings → Privacy & Security → Enhanced Tracking Protection → Strict. This enables Firefox's built-in tracker blocking, which blocks social media trackers, cross-site tracking cookies, fingerprinters, cryptominers, and most known tracking content. The Strict level occasionally breaks sites — typically login flows that depend on third-party cookies — but far less often than the about:config changes below.
In the same section, set "Send websites a 'Do Not Track' request" to Always. This is largely ignored by advertising networks — it is a polite request with no enforcement mechanism — but some sites do respect it. There is no cost to enabling it.
Under Cookies and Site Data, set Firefox to delete cookies and site data when the browser is closed. This is a blunter instrument than Cookie AutoDelete but requires no extension. The trade-off is that you log out of every site when you close the browser. If you use containers and Cookie AutoDelete together, this setting is redundant.
about:config Hardening
Navigate to about:config in the address bar. Accept the risk prompt — it warns you that changing these settings can break things, and it is telling the truth. These settings control Firefox's behaviour at a level the standard settings interface does not expose.
Fingerprinting Resistance
privacy.resistFingerprinting — set to true. This is the single most effective anti-fingerprinting measure available in any mainstream browser. It makes your browser report a generic configuration to fingerprinting scripts — a standard screen resolution of 1000x900 (rounded down from your actual resolution to a common size), UTC timezone regardless of your actual location, a generic set of system fonts, a spoofed user agent string, and a uniform canvas and WebGL rendering output.
Browser fingerprinting builds a unique profile from dozens of parameters — installed fonts, screen dimensions, WebGL renderer string, canvas rendering output, audio context behaviour, timezone, language settings, platform string. Combined, these parameters create an identifier as unique as a cookie but invisible and impossible to delete. With resistFingerprinting enabled, your browser looks like every other Firefox instance with the same setting — the fingerprint is generic rather than unique.
Trade-off: timezone-dependent features display in UTC, not your local time. Timestamps on social media, calendar widgets, and time-based features show the wrong time unless the site uses server-side timezone detection. Some CAPTCHAs become harder because the reported screen size does not match your actual mouse movement boundaries. Font rendering may differ slightly from what you are used to because Firefox reports a limited set of fonts.
WebRTC
media.peerconnection.enabled — set to false. WebRTC — Web Real-Time Communication — enables browser-based peer-to-peer video and voice calls. It also leaks your real IP address, even when you are behind a VPN. A page can use WebRTC's STUN protocol to discover your actual local network IP and your public IP address without any user interaction — no permission prompt, no notification, no indication that it happened.
This is one of the most well-known VPN bypass techniques. A site that wants to know your real IP address behind a VPN can discover it with a few lines of JavaScript using WebRTC.
Trade-off: browser-based video calls stop working. Jitsi Meet, Google Meet in the browser, Discord in the browser, and any other WebRTC-dependent application will fail to establish a call. Use the dedicated desktop applications instead — they handle their own networking. Or create a separate Firefox profile with WebRTC enabled exclusively for calls (covered below).
Referer Policy
network.http.referer.XOriginPolicy — set to 1. The Referer header — yes, the misspelling is in the HTTP specification and we are stuck with it — tells every site you visit which page sent you there. When you click a link on Site A that takes you to Site B, your browser sends a header to Site B saying "the user came from Site A, specifically from this URL."
Setting this to 1 sends the Referer header only for same-origin requests — navigations within the same site. Cross-origin navigations — clicking a link from one site to a different site — send no Referer. The destination site knows you arrived but not where from.
This prevents advertising networks from seeing which search query led you to a page. It prevents news sites from knowing which social media post linked to the article. It removes one of the oldest and simplest cross-site tracking mechanisms.
Geolocation
geo.enabled — set to false. Disables the Geolocation API entirely. Sites cannot request your physical location. The permission prompt — "this site wants to know your location" — never appears because the capability does not exist. Firefox does not even ask.
Hyperlink Auditing
browser.send_pings — set to false. Hyperlink auditing is a tracking mechanism embedded in HTML links. A link with a ping attribute sends a separate background HTTP request — a tracking ping — to a specified URL when clicked, independent of the actual navigation. The page you navigate to loads normally. The tracking ping goes to a completely different server. Disabling this stops that secondary request.
Battery Status
dom.battery.enabled — set to false. The Battery Status API lets sites read your device's battery level, charging state, and estimated time remaining. This seems innocuous. It is a surprisingly effective fingerprinting vector — a device at 37% battery, discharging, with an estimated 4 hours 12 minutes remaining narrows the set of possible devices dramatically. Combined with other signals, it contributes meaningfully to a unique fingerprint. There is no legitimate reason for a website to know your battery level.
Clipboard Events
dom.event.clipboardevents.enabled — set to false. Prevents sites from detecting when you copy, cut, or paste text. Some sites use clipboard events to append tracking URLs or attribution text to copied content — you copy a paragraph and a tracking link is silently appended. Others use it to prevent copying entirely, which is both annoying and futile.
Internationalised Domain Names
network.IDN_show_punycode — set to true. Internationalised Domain Names — IDN — allow Unicode characters in URLs. This is useful for non-Latin scripts but it also enables homograph attacks, where visually identical characters from different scripts create deceptive domain names. The Cyrillic letter "а" (U+0430) is visually identical to the Latin letter "a" (U+0061). A domain registered as аpple.com with a Cyrillic "а" looks identical to apple.com in the address bar. The site behind it is controlled by whoever registered the Cyrillic variant.
With this setting enabled, the Cyrillic version displays as xn--pple-43d.com — its punycode representation — immediately distinguishable from the real domain. This is a simple, zero-cost defence against a class of phishing that is otherwise nearly impossible to detect visually.
DNS-over-HTTPS
Settings → Privacy & Security → DNS over HTTPS → Max Protection. Set the provider to Cloudflare (1.1.1.1) or Quad9 (9.9.9.9).
DNS-over-HTTPS — DoH — encrypts your DNS queries so your ISP cannot see which domain names you resolve. Without DoH, every DNS query travels in plain text over your network. Your ISP can see, log, sell, and potentially modify every domain lookup you make. In the UK, ISPs are required by the Investigatory Powers Act to retain your browsing history — which is built from DNS logs — for twelve months.
Understand the limit. DoH does NOT hide which sites you visit from your ISP. The ISP can still see the IP addresses you connect to. Until Encrypted Client Hello — ECH — is widely deployed, the ISP can also read the Server Name Indication field in the TLS handshake, which contains the hostname in plain text. DoH protects the specific DNS lookup. It does not protect the connection that follows.
If you are running Pi-hole on your home network, configure DoH on the Pi-hole itself rather than in Firefox. If Firefox uses DoH directly, it bypasses your Pi-hole entirely — DNS queries go straight from Firefox to Cloudflare, skipping the sinkhole and all your blocklists. Configure Pi-hole's upstream resolver to use DNS-over-HTTPS instead.
Search Engine
Change the default search engine. Settings → Search → Default Search Engine. Firefox defaults to Google in most regions. Google is, again, an advertising company — every search query you type feeds its profiling infrastructure.
Switch to DuckDuckGo for general use. DuckDuckGo does not track searches, does not build user profiles, and does not personalise results based on your history. The results are adequate for most queries. For technical searches where Google's indexing depth matters, add Google as a secondary search engine and use it via the keyword shortcut — type @google before the query in the address bar to use it on demand without making it the default.
Startpage is another option — it proxies Google results through its own servers, giving you Google's index without Google seeing who you are. The trade-off is speed — the proxy adds latency.
Disabling Telemetry
Settings → Privacy & Security → uncheck every box under "Firefox Data Collection and Use." All of them. Then open about:config and set the following:
toolkit.telemetry.enabled — set to false. Disables Firefox's telemetry framework entirely.
datareporting.policy.dataSubmissionEnabled — set to false. Stops Firefox from submitting any collected data to Mozilla, even if collection is still partially enabled by other settings.
toolkit.telemetry.archive.enabled — set to false. Prevents local archiving of telemetry data. Without this, Firefox stores telemetry data locally even if it is not submitted.
browser.ping-centre.telemetry — set to false. Disables ping-centre, a telemetry subsystem that reports data about the new tab page and activity stream behaviour.
app.shield.optoutstudies.enabled — set to false. Disables Shield studies — Mozilla's A/B testing framework that pushes experimental features and configuration changes to a subset of users without explicit consent. You do not want your browser silently enrolled in experiments, regardless of Mozilla's intentions. Good intentions do not excuse silent modification of your browser's behaviour.
The Trade-offs
Every hardening measure breaks something. Knowing what breaks — and having a plan for it — is the difference between a usable configuration and one you abandon after a week.
privacy.resistFingerprinting breaks timezone-dependent sites and makes some CAPTCHAs harder to solve. Disabling WebRTC breaks in-browser video calls entirely. Strict cookie handling breaks some login flows — particularly sites that use third-party authentication services, OAuth redirects across domains, or single sign-on systems.
Some sites detect hardened browsers and refuse to load, display a degraded version, or show persistent warnings about enabling cookies or JavaScript features. This is uncommon but not nonexistent. Financial services and government sites occasionally fall into this category.
The solution is a second profile. Run firefox -P to open the profile manager. Create one hardened profile for daily browsing — apply all of the above to it — and one relaxed profile for the sites that demand concessions. Video calls, broken login flows, sites that refuse to work without JavaScript and cookies from fourteen different domains — open them in the relaxed profile.
Keep the hardened profile as your default. Open the relaxed profile only when necessary, and close it when you are done. The relaxed profile is a concession, not a fallback. The goal is to use the hardened profile for 95% of your browsing and accept the minor inconvenience of switching profiles for the rest.
You can run both profiles simultaneously. Firefox supports multiple instances with different profiles at the same time. Use firefox -P "Hardened" --no-remote and firefox -P "Relaxed" --no-remote to open them side by side. The windows look identical except for any visual cue you set — change the theme colour of the relaxed profile so you never lose track of which is which.
What This Does Not Protect
Browser hardening protects you from casual surveillance — the ambient tracking that follows you across the web, building a profile from your browsing habits. It does not protect you from a targeted attacker, a compromised network, or a hostile state actor.
If your threat model includes your ISP or government actively monitoring your traffic, you need Tor — not a hardened browser. If your threat model includes a compromised device, browser settings are irrelevant because the attacker has access to everything below the browser. If your threat model includes physical access to your machine, full-disk encryption matters more than anything in about:config.
Know what you are defending against. These settings defend against the advertising industry, data brokers, and opportunistic tracking. They make you a harder target for broad surveillance. They do not make you invisible.
Tor, covered in a separate tutorial, is the tool when your threat model includes the sites you visit and the network you are on. I2P serves a different purpose again — a closed network rather than an exit into the clearnet. This tutorial is for the browser you use every day — configured so it stops giving away information you never agreed to share.
Install uBlock Origin and Multi-Account Containers, enable HTTPS-Only Mode, apply the about:config changes listed above, configure DNS-over-HTTPS through your Pi-hole or directly in Firefox, disable all telemetry, and create a second profile for the handful of sites that break. The configuration takes twenty minutes. The result is a browser that respects your privacy by default rather than one you must constantly fight.