Firefox Privacy Settings: Hardening Steps and Tradeoffs

The question behind most Firefox privacy searches is really “can I make Firefox as private as Brave without switching browsers?” The honest answer is: you can close most of the gap in about five minutes, and the last part of it you cannot close at all. Firefox’s architecture is strong, but Mozilla ships it tuned for compatibility, so several of its best protections are opt-in and one of them is deliberately buried because of what it breaks.

This is the order to do it in, cheapest wins first, with the cost of each step stated plainly. Steps 1 to 4 are all in the ordinary Settings panel and take about five minutes between them; only step 5 touches about:config, and it is the one step that is genuinely optional.

What Firefox already does before you touch anything

Two defaults do most of the heavy lifting, and it is worth knowing them so you do not waste effort duplicating them with extensions.

Enhanced Tracking Protection blocks known trackers from a maintained list, along with cryptominers and, in stricter modes, fingerprinting scripts. Mozilla’s documentation describes Standard as the balanced default and Strict as the stronger setting that may break some pages.

Total Cookie Protection is the architectural one. Rather than blocking third-party cookies by category, Firefox gives every website its own isolated cookie jar, so a tracker embedded across twenty sites ends up with twenty unrelated identities for you instead of one stitched profile. Mozilla documents this as on by default, and it covers brand-new tracking domains that no blocklist has caught yet. It is the single best thing about Firefox’s privacy posture and it needs no configuration.

What Firefox’s stock build does not do is randomise the values that identify your device — canvas, audio, WebGL, font metrics. That is where the Brave gap lives, and it is the subject of step 5.

Step 1: Switch Enhanced Tracking Protection to Strict

Settings → Privacy & Security → Enhanced Tracking Protection → Strict.

This is the highest-value single change in the browser. Strict adds tracking-content blocking in all windows, tightens cookie handling, and turns on the fingerprinting protections that Standard leaves partly off.

What it costs: a small number of sites will show a broken embed, a stuck login, or a comment widget that never loads. The fix is per-site rather than global — click the shield icon in the address bar and toggle protections off for that one domain. Get in the habit of checking the shield before assuming a site is down.

Step 2: Turn off telemetry and study enrollment

Settings → Privacy & Security → Firefox Data Collection and Use. Clear every checkbox.

Firefox’s technical and interaction data collection is enabled on a fresh install. Turning it off costs you nothing functionally — no protection in this guide depends on it, and nothing on a page renders differently afterwards. While you are there, disable “Allow Firefox to install and run studies”, which lets Mozilla push experimental changes to your browser without asking, and clear the sponsored-content options under Home and Search that put paid tiles on your new-tab page and paid suggestions in the address bar.

Step 3: Enable HTTPS-Only mode

Settings → Privacy & Security → HTTPS-Only Mode → Enable in all windows.

This stops silent downgrades to plaintext HTTP and gives you an interstitial warning instead. Almost nothing on the modern web breaks, and the few sites that do are usually old internal tools where an explicit exception is the right call anyway.

Step 4: Fix DNS and the default search engine

Two leaks sit outside the page itself.

DNS. Under Privacy & Security → DNS over HTTPS, choose Increased or Max protection and pick a resolver you are willing to trust. Without this, your resolver — usually your ISP’s — sees a plaintext list of every domain you visit regardless of how well the browser blocks trackers.

Search. Firefox’s default engine is a commercial deal, not a privacy decision. Changing it under Settings → Search is a one-click improvement, and which engine to move to is a real question: several “private” engines simply proxy Google or Bing results, while a smaller number run their own index. Private search engines ranked breaks that distinction down. Also uncheck search suggestions if you would rather your keystrokes not stream to a provider as you type.

Step 5: Fingerprinting protection, and the trade you are making

This is the step that decides how close to Brave you get, and it is genuinely a trade rather than a free win.

Firefox has two related mechanisms. The blocklist-driven one, described in Mozilla’s fingerprinting documentation, blocks scripts known to fingerprint and is included in Strict mode from step 1. The stronger one is privacy.resistFingerprinting in about:config, inherited from the Tor Browser project, which switches Firefox to uniformity: a standardised timezone, a quantised window size via letterboxing, a fixed font list, and normalised hardware reporting.

Why it is not on by default: uniformity is aggressive. It reports UTC regardless of where you are, which breaks calendars and scheduling tools. It letterboxes the viewport, adding grey bars at some window sizes. It can interfere with dark-mode detection and with sites that legitimately read screen dimensions. Mozilla’s judgement is that most users would blame the browser rather than the setting, and that judgement is defensible.

Why it works when it works: the point is not to hide your device, it is to make your browser report the same values as everyone else running the same configuration. That only helps if the crowd is large. A lightly-used configuration with three extensions installed and a custom window size gets uniformity’s costs without its benefit.

If you want this protection with a large crowd and none of the manual tuning, the correct move is not to force it in Firefox — it is to run Mullvad Browser or Tor Browser, which are engineered around uniformity from the ground up and where every user shares the same profile by design.

Step 6: Extensions — one, maybe two

uBlock Origin is the only extension most hardening guides agree on. It is the highest-value addition to a Firefox install and it does what Brave’s Shields do for ad and tracker blocking.

Everything past that is usually negative. Each additional extension is another observable signal, so a browser stuffed with six privacy add-ons is more identifiable than a plain one, not less. Extension-detection is a live fingerprinting technique, and canvas-blocker style add-ons in particular tend to produce a distinctive signature rather than a common one. Install uBlock Origin, stop there, and let ETP Strict cover the rest.

Where Firefox still cannot match Brave

Being straight about the ceiling: after all six steps, a hardened Firefox is roughly level with Brave on tracker blocking, ahead of it on cookie architecture, ahead on engine independence, and behind on out-of-the-box fingerprinting resistance unless you accept the resistFingerprinting trade. Brave’s randomisation approach — different canvas and audio readouts per site, per session — requires no configuration and breaks nothing, which is a real advantage for anyone who will not maintain settings.

The counter-argument for Firefox is structural rather than feature-by-feature. It runs Mozilla’s Gecko engine, so it is not downstream of Google’s decisions about what content blockers are permitted to do. Brave, being Chromium-based, is. If your concern includes who controls the platform and not just who is tracking you today, that is not a small point. Brave versus Firefox for privacy works through the head-to-head in detail, and the full privacy browser ranking places both against the uniformity-first browsers.

If you would rather not maintain any of this

Two shortcuts skip the manual work.

LibreWolf is a Firefox fork that ships these decisions pre-made: telemetry removed, resistFingerprinting on, uBlock Origin bundled, no vendor search deal. You inherit the compatibility costs along with the protections, and the crowd you blend into is smaller than Firefox’s.

arkenfox/user.js is a maintained, heavily-commented user.js template for people who want Firefox itself hardened to a documented standard. The project repository is explicit that it is opinionated and that some settings will break sites, and the comments explain what each preference costs. It is the right tool if you want to understand every change rather than inherit it.

Verify the result

Two checks are enough. The EFF’s Cover Your Tracks reports how distinctive your browser looks against its sample, and re-running it before and after step 5 shows exactly what the fingerprinting trade buys. PrivacyTests.org publishes open-source, regularly refreshed comparisons of browsers at default settings, so you can see where the current Firefox build sits without taking any vendor’s word for it.

One last note on scope: none of this hides your IP address. A hardened browser stops sites from recognising the device; it does nothing about the network path. That is a separate tool and a separate decision, covered in Tor Browser versus a VPN for anonymity and, if a VPN is the answer for you, in what makes a VPN actually private.

---

Want the rest of the stack scored against your own priorities rather than ours? The privacy stack builder re-ranks every tool on this site by the criteria you weight.