Last updated: March 15, 2026

Start by opening about:config and setting privacy.resistFingerprinting to true, network.cookie.cookieBehavior to 1 (block third-party cookies), and network.trr.mode to 2 (enable DNS-over-HTTPS with fallback). These three changes form the core of Firefox privacy hardening in 2026. This guide covers every essential about:config tweak, extension recommendation, profile management strategy, and verification step for developers and power users.

Why Firefox for Privacy in 2026

Firefox is not the most private browser by default. that title belongs to hardened Tor Browser. However, Firefox occupies a practical middle ground: it is configurable enough to reach a strong privacy posture while remaining usable for everyday development and browsing work. Chrome’s privacy settings are architecturally constrained by Google’s advertising business. Safari is competitive on privacy but limited to Apple ecosystems. Firefox gives users the most control per unit of configuration effort.

Mozilla’s open-source model also allows external audits of the codebase. Privacy-focused projects like the Arkenfox user.js maintain community-reviewed settings lists that track changes across Firefox versions, giving users a living reference for hardening decisions.

Prerequisites

Before you begin, make sure you have the following ready:

Step 1 - Access Advanced Settings

The about:config interface exposes Firefox’s internal configuration. Type about:config in your address bar and press Enter. You will see a warning. accept it to proceed. The search bar at the top makes finding specific preferences straightforward.

Changes made through about:config persist across sessions but can be reset to defaults by right-clicking a preference and selecting “Reset.” This makes experimentation low-risk.

Step 2 - Core Privacy Preferences

Several settings form the foundation of Firefox’s privacy posture. Start with these critical preferences:

privacy.resistFingerprinting (Boolean, default: false)

Enabling this setting normalizes your browser’s fingerprint by reporting generic system information rather than unique values. It adjusts viewport size, timezone, and font availability.

privacy.resistFingerprinting = true

When enabled, Firefox reports a standard viewport and limits JavaScript access to detailed timing information. This protects against fingerprinting attacks that identify users based on hardware and configuration differences. The trade-off is occasional display quirks on sites that rely on accurate viewport dimensions.

privacy.trackingprotection.enabled (Boolean, default: true)

Built-in tracking protection blocks known trackers. Ensure this remains enabled:

privacy.trackingprotection.enabled = true

Firefox maintains a list of known trackers and automatically blocks requests to those domains. This reduces data leakage to advertisers and third-party analytics providers. Setting Enhanced Tracking Protection to “Strict” in Preferences > Privacy & Security catches additional trackers beyond the standard list.

browser.send_pings (Boolean, default: true)

Hyperlink ping tracking allows sites to notify a third-party URL when you click a link. Disable it:

browser.send_pings = false

Step 3 - Network and Connection Settings

Network-related settings control how Firefox communicates with servers:

network.cookie.cookieBehavior (Integer, default: 0)

This setting controls cookie handling:

For maximum privacy, set:

network.cookie.cookieBehavior = 1

network.cookie.thirdparty.sessionOnly (Boolean, default: false)

Session-only third-party cookies expire when you close the browser:

network.cookie.thirdparty.sessionOnly = true

network.cookie.lifetimePolicy (Integer, default: 0)

Controls cookie expiration:

network.cookie.lifetimePolicy = 2

network.prefetch-next (Boolean, default: true)

Firefox prefetches pages it predicts you will visit next. This leaks browsing intent to servers:

network.prefetch-next = false

Also disable DNS prefetching:

network.dns.disablePrefetch = true

Step 4 - WebGL and Canvas Protection

WebGL and HTML Canvas APIs can leak hardware information:

webgl.disabled (Boolean, default: false)

Disabling WebGL prevents WebGL-based fingerprinting but may break some web applications:

webgl.disabled = true

canvas.privacy.image_cipher (Boolean, default: true)

This setting adds noise to canvas readouts, making fingerprinting less reliable:

canvas.privacy.image_cipher = true

Canvas fingerprinting works by rendering an invisible image and reading back the pixel values, which differ slightly based on GPU drivers and rendering engines. Adding noise makes these values less unique.

Step 5 - Referrer and Header Control

Control what information Firefox sends to websites:

network.http.referer.XSSEnabled (Boolean, default: true)

Controls referrer sending for cross-site requests:

network.http.referer.XSSEnabled = false

network.http.referer.spoofSource (Boolean, default: false)

When true, Firefox spoofs the referrer to match the destination:

network.http.referer.spoofSource = true

privacy.reduceTimerPrecision (Boolean, default: true)

Reduces timing precision to prevent timing-based attacks:

privacy.reduceTimerPrecision = true

High-precision timers enable Spectre-class side-channel attacks and allow fingerprinting through performance measurement. Reducing precision degrades these attack vectors without noticeable impact on normal browsing.

Step 6 - DNS and HTTPS Settings

Modern DNS and HTTPS configurations improve privacy:

network.trr.mode (Integer, default: 0)

DNS-over-HTTPS (DoH) encrypts your DNS queries:

network.trr.mode = 2

network.trr.uri (String)

Specify your DoH provider. The default is Cloudflare, but you can use other providers:

network.trr.uri = https://dns.google/dns-query

Privacy-focused alternatives include Mullvad (https://dns.mullvad.net/dns-query) and NextDNS. Mullvad does not require an account and does not log queries.

security.tls.version.min (Integer, default: 1)

Enforce minimum TLS version:

security.tls.version.min = 3  # TLS 1.2 minimum

Step 7 - Telemetry and Data Collection

Firefox collects usage telemetry by default. Disable it:

toolkit.telemetry.unified = false
toolkit.telemetry.enabled = false
toolkit.telemetry.server = data:,
datareporting.healthreport.uploadEnabled = false
browser.crashReports.unsubmittedCheck.autoSubmit2 = false

These settings stop Firefox from sending usage data to Mozilla. The toolkit.telemetry.server value is set to a data URI to prevent any accidental connections to telemetry endpoints.

Step 8 - Extension Recommendations

Beyond about:config, Firefox’s extension environment enhances privacy:

uBlock Origin blocks advertisements and trackers at the network level. Install from addons.mozilla.org and enable built-in filter lists including EasyList, EasyPrivacy, and uBlock Filters. The “Medium mode” blocking profile is recommended for users comfortable with occasional site breakage. it blocks all third-party scripts by default.

Facebook Container isolates Facebook tracking to prevent cross-site tracking. Firefox includes this natively. enable it in Preferences > Privacy & Security.

Multi-Account Containers create isolated sessions for different purposes. Use separate containers for work, personal browsing, shopping, and sensitive accounts:

Containers can be managed via Firefox's built-in container tabs
Right-click a tab > "Move to Container" > select container

Each container has its own cookie jar, local storage, and IndexedDB. A tracker that sets a cookie in your shopping container cannot read that cookie in your banking container.

LocalCDN replaces requests to CDNs (Google Fonts, jQuery CDN, Bootstrap CDN) with locally served copies. This prevents CDN providers from tracking which sites you visit based on resource requests.

Step 9 - Persisting Settings with user.js

Settings entered through about:config survive browser restarts but can be overwritten by Firefox updates. A user.js file in your profile directory applies settings at every startup:

Find your profile directory
firefox --ProfileManager
Or check about:profiles in Firefox

Create or edit ~/.mozilla/firefox/YOUR-PROFILE/user.js:

// Core privacy settings
user_pref("privacy.resistFingerprinting", true);
user_pref("privacy.trackingprotection.enabled", true);
user_pref("network.cookie.cookieBehavior", 1);
user_pref("network.cookie.lifetimePolicy", 2);
user_pref("network.trr.mode", 2);
user_pref("network.trr.uri", "https://dns.mullvad.net/dns-query");
user_pref("webgl.disabled", true);
user_pref("browser.send_pings", false);
user_pref("network.prefetch-next", false);
user_pref("network.dns.disablePrefetch", true);

// Telemetry
user_pref("toolkit.telemetry.unified", false);
user_pref("toolkit.telemetry.enabled", false);
user_pref("datareporting.healthreport.uploadEnabled", false);

The Arkenfox project maintains an extensively commented user.js that covers additional preferences not included here. It is worth reviewing for users who want a community-maintained hardening baseline.

Step 10 - Automation and Profiles

Developers often need multiple browser configurations. Firefox profiles solve this:

Create a new profile
firefox -P

Launch with specific profile
firefox -P "privacy-dev"

Profile manager
firefox --ProfileManager

Each profile maintains separate settings, extensions, and cookies. Create dedicated profiles for development (looser privacy settings, DevTools access), general browsing (hardened settings, uBlock Origin), and sensitive browsing (maximum hardening, no extensions that could exfiltrate data).

Step 11 - Verification and Testing

After configuring settings, verify they work:

  1. Visit about:config and search for your modified preferences
  2. Check that values match your intended configuration
  3. Test in a fresh profile to confirm changes propagate correctly
  4. Visit coveryourtracks.eff.org to measure your fingerprint uniqueness
  5. Visit browserleaks.com to check WebGL, Canvas, and WebRTC leak status

WebRTC can leak your local IP address even through a VPN. Disable it if you do not need real-time communication:

media.peerconnection.enabled = false

Re-enable this setting only for tabs where you actively use video or voice calling.

Troubleshooting

Configuration changes not taking effect

Restart the relevant service or application after making changes. Some settings require a full system reboot. Verify the configuration file path is correct and the syntax is valid.

Permission denied errors

Run the command with sudo for system-level operations, or check that your user account has the necessary permissions. On macOS, you may need to grant terminal access in System Settings > Privacy & Security.

Connection or network-related failures

Check your internet connection and firewall settings. If using a VPN, try disconnecting temporarily to isolate the issue. Verify that the target server or service is accessible from your network.

Frequently Asked Questions

How long does it take to 2026?

For a straightforward setup, expect 30 minutes to 2 hours depending on your familiarity with the tools involved. Complex configurations with custom requirements may take longer. Having your credentials and environment ready before starting saves significant time.

What are the most common mistakes to avoid?

The most frequent issues are skipping prerequisite steps, using outdated package versions, and not reading error messages carefully. Follow the steps in order, verify each one works before moving on, and check the official documentation if something behaves unexpectedly.

Do I need prior experience to follow this guide?

Basic familiarity with the relevant tools and command line is helpful but not strictly required. Each step is explained with context. If you get stuck, the official documentation for each tool covers fundamentals that may fill in knowledge gaps.

Is this approach secure enough for production?

The patterns shown here follow standard practices, but production deployments need additional hardening. Add rate limiting, input validation, proper secret management, and monitoring before going live. Consider a security review if your application handles sensitive user data.

Where can I get help if I run into issues?

Start with the official documentation for each tool mentioned. Stack Overflow and GitHub Issues are good next steps for specific error messages. Community forums and Discord servers for the relevant tools often have active members who can help with setup problems.

Related Articles