The Ultimate Guide to Firefox Hardening

Firefox is now the last major browser that runs full uBlock Origin, which makes it the right base for a private setup in 2026. This is the walkthrough: the settings to change, the one extension that matters, and how far to take it. Work top to bottom — the early steps take about ten minutes and put you ahead of almost everyone. If you want the why behind it — what you're defending against and why Chrome stopped being an option — that's at the end, after the steps.

Step 1: The easy layer (about ten minutes)

Start here. These are plain settings toggles, in order, and they do most of the work.

1. Turn on automatic updates so you get security patches promptly.
2. Set Enhanced Tracking Protection to Strict (Settings → Privacy & Security). This is the single most important toggle. Strict mode disables all cross-site cookies and turns on the strongest form of Total Cookie Protection — Firefox's per-site "cookie jar" isolation, where each site's cookies are walled off so they can't be read across sites. Total Cookie Protection is on by default now, but Strict extends it and shuts off the cross-site storage tricks that Standard still permits.
3. Clear cookies and site data on close, with exceptions for the handful of accounts you want to stay logged into.
4. Enable HTTPS-Only Mode in all windows.
5. Turn on DNS over HTTPS (set it to Max Protection), and switch the provider away from the default to something like Quad9 or NextDNS. DoH pairs with Encrypted Client Hello (ECH), on by default in current Firefox, which hides the site name from anyone watching the connection setup. The two together close most of the gap where your DNS and TLS handshake leak which sites you visit. (DNS privacy covers why the resolver you use matters.)
6. Disable Firefox's telemetry and data collection, and make sure the security toggles at the bottom of the privacy page — dangerous-content and deceptive-site protection — are on.
7. Change your default search engine to a privacy-respecting one.
8. Only install extensions you actually need and trust. The extension slot is an attack surface in its own right, so audit what you already have before adding more.

If you only do four of those, make them Strict protection, clearing site data on close, telemetry off, and extension discipline. The rest is worthwhile but supplementary.

Step 2: The one extension that matters

1. Turn on automatic updates so you get security patches promptly.
2. Set Enhanced Tracking Protection to Strict (Settings → Privacy & Security). This is the single most important toggle. Strict mode disables all cross-site cookies and turns on the strongest form of Total Cookie Protection — Firefox's per-site "cookie jar" isolation, where each site's cookies are walled off so they can't be read across sites. Total Cookie Protection is on by default now, but Strict extends it and shuts off the cross-site storage tricks that Standard still permits.
3. Clear cookies and site data on close, with exceptions for the handful of accounts you want to stay logged into.
4. Enable HTTPS-Only Mode in all windows.
5. Turn on DNS over HTTPS (set it to Max Protection), and switch the provider away from the default to something like Quad9 or NextDNS. While you're there, DoH pairs with Encrypted Client Hello (ECH), on by default in current Firefox, which hides the site name from anyone watching the connection setup — the two together close most of the "your DNS and TLS handshake leak which sites you visit" gap. (DNS privacy covers why the resolver you use matters.)
6. Disable Firefox's telemetry and data collection, and make sure the security toggles at the bottom of the privacy page (dangerous-content and deceptive-site protection) are on.
7. Change your default search engine to a privacy-respecting one.
8. Only install extensions you actually need and trust. The extension slot is an attack surface in its own right — audit what you already have before adding more.

If you only do four of those, make them Strict protection, clearing site data on close, telemetry off, and extension discipline. The rest is worthwhile but supplementary.

You do not need a dozen extensions any more. Most of what people used to bolt on is now handled by Firefox itself. Install one:

uBlock Origin — ad and tracker blocking plus script control, and on Firefox it runs at full strength with no Manifest V3 limits. If you install one extension, install this. It's worth configuring it properly rather than leaving it on defaults; medium mode in particular blocks a lot of what fingerprinting relies on by simply not letting third-party scripts run.

One more built-in feature worth turning on: Firefox Multi-Account Containers. Each container keeps its own cookie store, so a site open in one can't see sessions in another. It's the clean way to wall off a Google or Facebook login from the rest of your browsing (more on why that matters in the context section below).

Skip the rest. uMatrix is unmaintained and uBlock Origin covers its ground. Ghostery, Disconnect, Privacy Badger, DuckDuckGo's extension and similar tracker-blockers add little on top of Strict protection plus uBO. ClearURLs and other URL cleaners can be replaced with uBO's own filtering. Canvas Blocker is largely redundant given Firefox's own canvas protections. Adding poorly-understood extensions can make your fingerprint more unique, not less, so the minimalist path is genuinely the better one.

Step 3: The advanced layer (only if you want it)

For advanced hardening, Arkenfox is the main tool worth knowing. It's a maintained user.js file that applies a large set of privacy-hardening preferences at once. Installing it is three steps:

1. In Firefox, open Help → More Troubleshooting Information.
2. Next to Profile Directory, click Open Directory.
3. Drop the Arkenfox user.js file into that folder and restart the browser.

Be honest with yourself before you do this, though — it's not the same as installing an extension. Arkenfox will break sites by default, and it expects you to read the wiki and override the specific settings that cause the breakage yourself. Don't apply it unless you're prepared for that.

The setting doing most of the anti-fingerprinting work — whether via Arkenfox or on its own — is privacy.resistFingerprinting (RFP) in about:config. It's Mozilla's own fingerprinting defence, inherited from the Tor Browser. It standardises the values sites can read, like timezone and (through letterboxing) the reported window size, so you look like everyone else running RFP rather than like you. Turning it on is a one-line change, but expect side effects: a light-grey border around pages (that's letterboxing doing its job), the timezone reporting as UTC, and some sites misbehaving. It's the toggle to reach for if you want fingerprinting resistance without the full Arkenfox commitment — as long as you can live with the rough edges.

If all of this sounds like more maintenance than you want, there's a shortcut. Two Firefox-based browsers ship most of the hardening pre-configured. LibreWolf is a Firefox fork with telemetry stripped, RFP and strict blocking on by default, and uBlock Origin bundled. It's essentially "hardened Firefox" as a download, for people who don't want to babysit settings. Mullvad Browser goes further. Built with the Tor Project, it bundles Tor Browser's anti-fingerprinting defences into a normal clearnet browser — no onion routing — so your fingerprint blends into the crowd of other Mullvad Browser users. Both spare you the manual work. The tradeoff is that you're trusting their defaults rather than tuning your own, and Mullvad Browser in particular breaks some convenience on purpose to keep everyone's fingerprint identical.

And here's the limit worth stating plainly: even a fully hardened Firefox is not as resistant to fingerprinting as the Tor Browser. A stock Chrome and a stock Firefox are both highly fingerprintable, and hardening narrows the gap without closing it. So if fingerprinting resistance is genuinely part of your threat model, run the Tor Browser (or Mullvad Browser) alongside your hardened Firefox for the browsing where it matters. Both are purpose-built for that problem in a way no amount of solo Firefox tuning matches.

That's the setup. Everything below is the reasoning behind it — useful if you want to understand why these are the right moves, and skippable if you just came to harden your browser and you're done.

Why Firefox, and not Chrome

For years the standard advice was "install a good ad blocker." In 2025 Google made that advice impossible to follow on its own browser. The mechanism was Manifest V3, which replaced Chrome's webRequest extension API with a weaker one, declarativeNetRequest. Where webRequest let an extension inspect and block network requests in real time, the replacement forces a pre-declared static list of rules and caps how many it can have. An ad blocker can no longer make dynamic, per-request decisions or run the large, frequently-updated filter lists that made uBlock Origin effective. Ghostery showed the new API would render over 90% of their capabilities unusable.

Google called it security and performance. The developers weren't convinced — the performance impact of webRequest was a few milliseconds at most, and filtering requests on your own device enhances privacy rather than harming it. Google's business is serving ads and profiling users, so a change weakening the tools people use to opt out of that was always going to draw suspicion.

It's no longer a prediction. Chrome 138 (July 24 2025) permanently disabled Manifest V2 for all users and removed the toggle to turn it back on; Chrome 139 stripped the enterprise override; the Chrome Web Store pulled classic uBlock Origin, leaving only the cut-down Lite version. Edge followed. Firefox kept webRequest, so the full blocker still works there — which is the whole reason this guide is about Firefox.

What you're actually defending against

A tracker is, at its simplest, a cross-site cookie. When a site shows an ad, that slot is usually an embedded script from Google's ad network or one of the ad companies Google owns. Because those domains are embedded across a huge share of the web, they read their own cookie on every one of those sites — which is how a company you never visited builds a picture of everywhere you go. The slot is auctioned in real time, so more ad companies drop cookies too. That's why a blocker has to block so many domains at once.

The ads aren't the problem. What's recorded to serve them is: your locations, IP addresses, clicks, purchases and site visits, stored and often sold on, and used to profile people. Two techniques make cookie-blocking alone insufficient. Fingerprinting identifies you by the unique combination of device, screen size, timezone, fonts and extensions — no cookie needed, which is why Strict mode and RFP matter more than clearing cookies (the fingerprinting deep dive covers it fully). Cross-device tracking ties everything to your Google ID, the account your two-factor prompts run through, linking every device into one profile. The real lever is there: temporary cookie identifiers are limited, but a permanent identity — a Google ID, a Facebook ID — ties it all together. Deny the platforms a permanent identity and most profiling falls apart.

Going further: isolate your Google login

That's what makes browser isolation worth the small effort. Use one browser or profile only for your Google login, and never visit anything else in it. Use another for everything else, and never log into Google there. Without a Google ID present, there's no long-term identifier to attach your activity to — the most Google gets is a short-lived IP guess, easily broken with a VPN. Keep sensitive categories on the browser that never sees a Google login, and don't visit Facebook, X or Instagram in the Google browser either, since the shared browser is what re-links them. Firefox's Multi-Account Containers (from Step 2) does this cleanly without juggling separate installs.

The piece no browser setting can fix is the phone. It's logged into a Google or Apple ID at the OS level, which ties your activity together regardless of which browser you use. A de-Googled Android (GrapheneOS, LineageOS, CalyxOS) is the real answer; short of that, just be conscious that the phone is the most thoroughly tracked device you own. Do the easy layer and you're already ahead of almost everyone — add the rest to match your own threat model, not someone else's.