Firefox Privacy Hardening Guide

Transform Firefox into a privacy fortress with advanced configurations and essential extensions

Current Extension Versions

uBlock Origin 1.75.0

Wide-spectrum content blocker

Full uBO runs on Firefox. Chrome users only get the reduced uBO Lite (MV3)

Privacy Badger 2026.9.15

Heuristic tracker blocker

Optional: sends Global Privacy Control by default, overlaps heavily with uBO

Firefox now ships on a two-week release cadence (since Firefox 155). Versions last verified October 2026.

Why Firefox for Privacy?

Firefox is the only major browser not built on Google's Chromium engine, it keeps full support for powerful content blockers, and it is open source and deeply configurable. It isn't perfect: Mozilla still earns most of its revenue from search deals, added Terms of Use in 2025, and collects technical and interaction data by default. The steps below turn those defaults off.

October 2026 Status: Google finished its Manifest V3 transition. Since Chrome 150 (June 2026) even the enterprise-policy workarounds no longer keep MV2 extensions alive, so full uBlock Origin is gone from Chrome and only the reduced uBO Lite remains. Opera is also moving developers to MV3. Firefox has no plan to remove MV2, so it stays the best mainstream browser for full content blocking. Brave keeps a special setting for installing uBO. HTTPS Everywhere was retired in 2023: use the built-in HTTPS-Only Mode instead.

Open Source

Auditable code, no hidden tracking

Extension Support

Full WebExtensions API, no limitations

Customizable

Deep configuration options

Settings to Change First (No Extensions Needed)

Do these in Settings (the menu ☰ → Settings) before touching about:config. They cover most of what hardening guides used to require.

Privacy & Security

• Enhanced Tracking Protection → Strict (adds fingerprinting protection and query-parameter stripping)
• Website Privacy Preferences → Tell websites not to sell or share my data (Global Privacy Control)
• HTTPS-Only Mode → Enable in all windows
• DNS over HTTPS → Increased or Max Protection (see the DNS section below)

Firefox Data Collection and Use

• Uncheck Send technical and interaction data
• Uncheck Allow Firefox to install and run studies
• Uncheck Automatically send crash reports
• Under Home, turn off Sponsored shortcuts and Sponsored stories

AI Controls (Firefox 148+)

Settings → AI controls has a single switch that turns off the AI chatbot sidebar, link previews, AI tab-grouping suggestions and PDF alt-text generation. It also covers the on-device Translations feature, so expect that to switch off too.

Built-in VPN (Firefox 149+)

Firefox now includes a free, browser-only VPN with 50 GB per month in supported countries. See the Free VPNs in Firefox section for how it works and how it compares to extensions.

Essential Privacy Extensions Setup

uBlock Origin Installation & Configuration

1Download & Install uBlock Origin

Always install from the official Mozilla Add-ons store to ensure you get the authentic extension:

1.Navigate to addons.mozilla.org
2.Search for "uBlock Origin"
3.Click "Add to Firefox"
4.Confirm installation in popup

Screenshot Placeholder:
uBlock Origin on Mozilla Add-ons Store

2Enable Advanced User Mode

Advanced mode unlocks powerful filtering capabilities:

1.Click the uBlock Origin icon in toolbar
2.Click the settings/dashboard button
3.Go to "Settings" tab
4.Check "I am an advanced user"

Screenshot Placeholder:
uBlock Origin Settings Panel

3Configure Filter Lists

Recommended Filter Lists:

✓ Enabled by Default:

• uBlock filters (Ads, Privacy, Badware risks, Quick fixes, Unbreak)
• EasyList
• EasyPrivacy
• Online Malicious URL Blocklist
• Peter Lowe's Ad and tracking server list

✓ Worth Adding:

• AdGuard URL Tracking Protection (strips tracking parameters, replaces ClearURLs)
• EasyList Cookie Notices and Annoyances lists
• Regional lists for your language
• uBlock filters: Annoyances (optional)

Access filter lists via Dashboard → Filter lists tab. Enable additional lists based on your needs, but avoid overloading as it may impact performance.

4Dynamic Filtering (Advanced)

Dynamic filtering allows real-time blocking of specific domains and resources:

Block third-party scripts globally
Control image loading per site
Manage domain connections
Block inline scripts and frames

Screenshot Placeholder:
uBlock Dynamic Filtering Interface

Privacy Badger Installation & Setup

1Install Privacy Badger

Privacy Badger automatically learns to block trackers based on their behavior. It is optional: uBlock Origin with the lists above already blocks most of what it catches, and every extra extension adds attack surface and makes your browser slightly more unique.

1.Go to addons.mozilla.org
2.Search for "Privacy Badger"
3.Install the EFF Privacy Badger
4.Pin to toolbar for easy access

Screenshot Placeholder:
Privacy Badger Installation Page

2Configure Global Privacy Control

Essential Settings:

1.Click the Privacy Badger icon in toolbar
2.Click the gear icon for settings
3.Confirm the Global Privacy Control signal is on (it is by default)
4.Keep "Replace social media widgets" enabled
5.Optionally enable local learning to block new trackers

3Understanding Privacy Badger's Interface

Red (Blocked)

Tracker completely blocked

Yellow (Restricted)

Third-party cookies blocked

Green (Allowed)

Not tracking, allowed to load

Screenshot Placeholder:
Privacy Badger Popup Interface

Firefox Configuration Hardening

1Accessing Advanced Configuration

Firefox's about:config interface provides access to hundreds of privacy and security settings:

1.Type "about:config" in the address bar
2.Click "Accept the Risk and Continue"
3.Use the search box to find specific settings
4.Double-click to toggle boolean values

Screenshot Placeholder:
Firefox about:config Interface

2Essential Privacy Configurations

Disable Telemetry & Data Collection:

# Same as the Data Collection checkboxes, useful for scripting

datareporting.healthreport.uploadEnabled → false

datareporting.usage.uploadEnabled → false

app.shield.optoutstudies.enabled → false

browser.crashReports.unsubmittedCheck.autoSubmit2 → false

Tracking Protection & Privacy Signals:

# Strict mode (prefer setting this in the UI)

browser.contentblocking.category → strict

# Global Privacy Control (replaces Do Not Track)

privacy.globalprivacycontrol.enabled → true

# Strip known tracking parameters from URLs

privacy.query_stripping.enabled → true

Do Not Track was removed from Firefox settings in 2025 because almost no site honored it. GPC is legally binding for opt-out of data sales in several US states.

3Anti-Fingerprinting Configuration

Fingerprinting Protection:

# Recommended: FPP in all windows

privacy.fingerprintingProtection → true

# Strongest, but breaks more (Tor-style)

privacy.resistFingerprinting → true

privacy.resistFingerprinting.letterboxing → true

Mozilla only supports resistFingerprinting inside Tor Browser. It forces UTC time, light mode and a spoofed user agent, so most people are better off with FPP plus Strict mode.

WebRTC & WebGL:

# Keep video calls but stop IP leaks via proxy/VPN

media.peerconnection.ice.proxy_only_if_behind_proxy → true

media.peerconnection.ice.default_address_only → true

# Or kill WebRTC entirely (breaks calls)

media.peerconnection.enabled → false

# Optional: breaks maps and 3D sites

webgl.disabled → true

4DNS over HTTPS & Network Security

Enable DNS over HTTPS:

1. Settings → Privacy & Security → DNS over HTTPS
2. Pick Max Protection (DoH only, never falls back to your ISP) or Increased Protection (falls back if DoH fails)
3. Choose a provider or enter a custom URL from the list

# about:config equivalent

network.trr.mode → 3

network.trr.uri → https://dns.quad9.net/dns-query

DoH Providers:

• Quad9 (non-profit, DNSSEC on all endpoints): https://dns.quad9.net/dns-query
• Cloudflare: https://cloudflare-dns.com/dns-query
• NextDNS (custom blocklists): https://dns.nextdns.io/[ID]

Mullvad's public DNS shuts down on November 2, 2026. Switch to Quad9 if you used it.

If you use a VPN, its app usually forces its own DNS. Firefox DoH overrides that for browser traffic, so pick one approach on purpose.

⚠ Important Notes:

• These settings may break some websites - test thoroughly
• Create a backup profile before making extensive changes
• Some settings require Firefox restart to take effect
• Use Firefox's "Troubleshoot Mode" to test if sites break

user.js Automation Setup

1Understanding user.js Files

What is user.js?

A user.js file contains Firefox preferences that are automatically applied when Firefox starts. Unlike manually changing settings in about:config, user.js ensures settings persist through updates and profile resets.

Find your profile: about:support → Profile Folder → Open Folder

Advantages:

• Consistent settings across profiles
• Survives Firefox updates
• Version control friendly
• Easy backup and sharing
• Community-maintained templates

Considerations:

• Overrides manual about:config changes
• Can break websites if too strict
• Requires understanding of preferences
• May need custom overrides

2Arkenfox user.js Implementation

Download and Install Arkenfox (Linux/macOS):

# Close Firefox, then cd into your profile folder (about:support → Profile Folder)

cd /path/to/your/profile

# Get the official updater and cleaner scripts

curl -LO https://raw.githubusercontent.com/arkenfox/user.js/master/updater.sh

curl -LO https://raw.githubusercontent.com/arkenfox/user.js/master/prefsCleaner.sh

chmod +x updater.sh prefsCleaner.sh

# Downloads user.js and appends user-overrides.js

./updater.sh

# Resets prefs that arkenfox no longer sets

./prefsCleaner.sh

Windows users get updater.bat and prefsCleaner.bat from the same repo.

Version lag: the latest arkenfox release is 144.0 (April 2026), while Firefox is on 157+. The project is maintained and most prefs still apply, but read the release notes and the wiki before using it. If you don't want to maintain a user.js, Strict mode plus the settings above is a solid baseline.

Arkenfox Features:

• Enhanced Tracking Protection: Blocks fingerprinting

• Privacy Enhancements: Disables telemetry

• Security Improvements: Hardens TLS settings

• Fingerprint Resistance: Reduces browser uniqueness

• Cookie Management: Strict cookie policies

• Network Isolation: Prevents cross-origin leaks

• Media Restrictions: Blocks autoplay and WebRTC

• Extension Security: Restricts addon permissions

3Custom Overrides for Usability

Create user-overrides.js (same folder as user.js):

// Keep cookies and history between restarts

user_pref("privacy.sanitize.sanitizeOnShutdown", false);

// Allow DRM for Netflix and other streaming services

user_pref("media.eme.enabled", true);

// Search directly from the address bar

user_pref("keyword.enabled", true);

// Restore previous session on startup

user_pref("browser.startup.page", 3);

updater.sh appends this file automatically, so your overrides survive every arkenfox update.

Common Overrides:

• Enable DRM for Netflix/streaming

• Keep logins by not clearing on shutdown

• Address-bar search

• Session restore

Security Balance:

• Only override what you need

• Understand privacy trade-offs

• Test thoroughly after changes

• Document your overrides

4Profile Management & Maintenance

Update Process:

# With Firefox closed, from the profile folder

./updater.sh

# updater.sh backs up the old user.js into userjs_backups/

# then clean out prefs that were removed upstream

./prefsCleaner.sh

Backup Strategy:

• Backup entire profile regularly

• Version control your overrides

• Test new versions before applying

• Keep working configuration copies

Multiple Profiles:

• Hardened profile for privacy

• Standard profile for daily use

• Work profile with relaxed settings

• Testing profile for experiments

Verification & Testing:

• Check about:config: Verify settings are applied correctly

• Test key sites: Ensure important functionality works

• Privacy tests: See the Testing Your Setup section below

• Monitor console: Watch for errors or blocked content

Container Tabs & Isolation

1Install Multi-Account Containers

Firefox already isolates third-party cookies per site with Total Cookie Protection (on by default). Containers go further: they keep your logins and first-party cookies apart, so you can be signed into two accounts at once or keep a shopping site from seeing your social media session:

1.Visit addons.mozilla.org
2.Search for "Firefox Multi-Account Containers"
3.Click "Add to Firefox"
4.Pin the container icon to toolbar

Screenshot Placeholder:
Multi-Account Containers Extension

2Creating Purpose-Specific Containers

Recommended Container Strategy:

🏢 Work Container

• Email and office applications
• Company resources and intranet
• Professional social media

🛒 Shopping Container

• E-commerce sites
• Payment and banking
• Price comparison sites

🎮 Personal Container

• Social media and entertainment
• Gaming and streaming
• Personal interests

🔒 Sensitive Container

• Banking and financial
• Medical and legal
• Government services

3Automatic Container Assignment

Set up automatic rules so sites always open in their designated containers:

1.Click the container icon in the toolbar
2.Select "Manage Containers"
3.Click "Always open in..." for each site
4.Choose the appropriate container

Common Auto-Assignments:

facebook.com→ Social Container

amazon.com→ Shopping Container

gmail.com→ Work Container

bankofamerica.com→ Banking Container

4Facebook Container Integration

Enhanced Facebook Isolation:

Facebook Container (by Mozilla) is a one-click option if you only want to fence off Meta. If you already use Multi-Account Containers, a Social container does the same job:

• Automatic Facebook, Instagram and Messenger isolation
• Blocks Facebook login buttons and Like widgets on other sites
• Prevents cross-site data sharing
• Redundant if you use Multi-Account Containers and Strict mode

⚠ Important Notes:

• May break Facebook login on other sites
• Social media buttons won't work outside container
• Some legitimate integrations will be blocked
• Can be disabled for specific sites if needed

Pro Tip: Use containers to separate different aspects of your digital life. This prevents websites from building comprehensive profiles across your various online activities.

Private Search Configuration

1Change the Default Search Engine

1. Settings → Search → Default Search Engine
2. Pick DuckDuckGo from the list (it ships with Firefox)
3. To add another engine, visit its site, right-click the address bar and choose Add "[engine]"
4. Under Search Suggestions, turn off Show search suggestions so every keystroke isn't sent to the engine
5. Under Address Bar, turn off Suggestions from sponsors

2Choosing an Engine

DuckDuckGo

No search history or profiles. Results mostly come from Bing. Has an .onion address for Tor users.

Startpage

Google results without sending Google your IP. Its "Anonymous View" proxies pages you open from results.

SearXNG

Open-source metasearch you can self-host with Docker, so no third party sees your queries. Public instances are listed at searx.space.

Every hosted engine still sees your queries. The privacy gain comes from them not tying queries to an account or ad profile.

Free VPNs in Firefox

Read this first: a VPN inside the browser is really a proxy. It only covers Firefox, not your other apps, torrents or system updates. The operator sees your real IP and every site you visit, and an extension with "access your data for all websites" can read and change the pages you load. A free VPN moves trust from your ISP to the VPN company. It does not make you anonymous: use Tor Browser for that.

1Firefox Built-in VPN (Best Free Option)

Firefox 149 (March 2026) added a free VPN right in the browser. Nothing to install, no extension permissions.

1.Update Firefox (☰ → Help → About Firefox). Picking a server location needs 151+
2.Click the VPN icon at the top right of the toolbar, then Get started
3.Sign in with a free Mozilla account (required)
4.Click Turn on VPN and optionally choose a location
5.Per-site exceptions: Settings → Privacy & Security → VPN → Manage website settings

What You Get:

• 50 GB per month, with in-browser warnings near the cap
• Servers run by Fastly (Mozilla's partner) using the MASQUE proxy protocol
• HTTPS stays end-to-end: the proxy can't read page contents
• Fastly says it doesn't log destinations. Mozilla says it doesn't sell data or inject ads
• Locations: US, UK, France, Germany, Canada
• Desktop launched in the US, UK, Germany and France. Android rolled out to about 29 countries from July 2026

Some sites are excluded automatically to avoid sign-in problems. Mozilla still collects basic usage telemetry (connection success, data used) unless you turned data collection off.

2Free VPN Extensions Compared

Proton VPN

Recommended

Free plan works in the Firefox extension. No data cap, no ads, audited no-logs policy, servers in 10 countries (Netherlands, Japan, Romania, Poland, Norway, Switzerland, Singapore, Mexico, Canada, US). Free users mostly get auto-assigned servers, with a cooldown when switching. One device on the free plan.

Windscribe

Good

10 GB per month with a confirmed email (2 GB without), 10 free countries. Open-source extension with built-in WebRTC leak protection and uBO-based blocking. Its no-logs claim held up in court in 2025, when its founder was acquitted in Greece because there was no user data to hand over.

TunnelBear / hide.me

OK, limited

TunnelBear gives 2 GB a month and publishes yearly security audits. hide.me has an official "hide.me VPN Free Proxy" extension. Make sure you install the official one: similarly named "Hide My IP" add-ons come from other developers.

SetupVPN (Lifetime Free VPN)

Use with caution

Popular and easy: install from addons.mozilla.org, click the icon, pick a free location. It will change your IP for casual geo-unblocking. But know what you're trading:

• Run by VPN1 LLC in Coral Gables, Florida (US jurisdiction), the same company behind Hoxx VPN
• Its own privacy policy says it logs pages viewed, IP address, access times and device info, uses Google ad pixels, and may disclose information to third parties at its discretion
• It's a browser proxy, not a real VPN. "4096-bit military grade encryption" names no actual protocol
• Needs access to all websites, and the listing pushes a separate WebRTC leak add-on, so run a leak test
• The Firefox add-on hasn't been updated since June 2024, and 2026 reviews report free locations moving behind the paywall and servers failing to load

Verdict: OK for watching a region-locked video. Never use it for logins, banking or anything sensitive. Proton VPN or the built-in Firefox VPN are better free choices.

Avoid: Urban VPN, Hola, Hoxx, Browsec

Do not use

• Urban VPN: caught in December 2025 silently capturing full ChatGPT, Claude, Gemini and other AI chats, even with the VPN off, and passing the data to a data broker affiliate
• Hola: the free tier works by reselling your connection to Bright Data; the network was once used to attack a website
• Hoxx: same operator and logging policy as SetupVPN, with DNS and WebRTC leaks reported in testing
• Browsec: vague ownership and logging details, and it asks for permission to change your privacy settings

3Check It's Actually Working

1. Note your real IP at ipleak.net with the VPN off
2. Turn the VPN on and reload: the IP and country should change
3. Check the WebRTC section: no real IP should appear
4. Check the DNS section: servers shouldn't belong to your ISP

# If WebRTC leaks, set in about:config

media.peerconnection.ice.proxy_only_if_behind_proxy → true

# SOCKS proxies only: resolve DNS remotely

network.proxy.socks_remote_dns → true

Need whole-device protection? Paid options like Mozilla VPN (built on Mullvad, about $5/month yearly), Mullvad, IVPN or Proton VPN Plus cover every app. Free VPN details last verified October 2026.

Balancing Privacy & Usability

1Essential vs Optional

Do These (Almost Nothing Breaks):

• uBlock Origin with default lists
• Strict tracking protection
• HTTPS-Only Mode and DNS over HTTPS
• Global Privacy Control
• Data collection, studies and AI features off

Optional (Expect Some Breakage):

• arkenfox user.js
• resistFingerprinting and letterboxing
• Disabling WebGL or WebRTC
• Clearing cookies on every shutdown
• uBO medium mode (blocking all third-party scripts)

2Per-Site Exceptions

• Tracking protection: click the shield in the address bar and toggle it off for that site only
• uBlock Origin: click the big power button in the popup to disable it for the current site
• Permissions: click the lock icon → Connection secure → permissions to allow camera, mic or notifications for one site
• Cookies you want to keep: Settings → Privacy & Security → Cookies and Site Data → Manage Exceptions

3Fixing a Broken Site

1. Turn off uBO for the site. If it works, re-enable uBO and use the element picker or logger to find the culprit
2. Toggle tracking protection off for the site via the shield icon
3. Try a Private Window, which uses a clean cookie jar
4. Restart in Troubleshoot Mode (☰ → Help → Troubleshoot Mode) to rule out extensions and prefs
5. Still broken? Use a separate, less-hardened profile (about:profiles) for that site instead of weakening your main one

Testing Your Setup

Fingerprinting

• coveryourtracks.eff.org: shows whether trackers are blocked and how unique you look
• browserleaks.com: detailed canvas, WebGL, fonts and header checks

IP, DNS & WebRTC Leaks

• ipleak.net: IP, DNS servers and WebRTC in one page
• browserleaks.com/webrtc: focused WebRTC test
• dnsleaktest.com: extended DNS test

Blocking

• Open the uBO logger (popup → list icon) while browsing to watch what gets blocked
• The uBO popup shows blocked request counts per page

Reading the Results

A "unique fingerprint" result is normal for any non-Tor browser. What matters is that trackers are blocked and your fingerprint isn't stable across sites. Only Tor Browser makes everyone look the same.