Firefox Privacy Settings: A Practical Guide (Not Paranoia-Level)

Most Firefox privacy guides go one of two ways: "just enable Strict Mode" (too shallow) or "change 50 about:config settings" (too much). Here's a practical middle ground — what actually matters, what the tradeoffs are.

Start: Enhanced Tracking Protection

Go to about:preferences#privacy and look at "Enhanced Tracking Protection."

Three settings:

• Standard — blocks social media trackers, cross-site tracking cookies, fingerprinters in private windows
• Strict — adds tracking content blockers, more fingerprint resistance, blocks more trackers. Some sites may break.
• Custom — fine-tune what's blocked

Recommendation: Start with Strict. If a site breaks, you can click the shield icon in the address bar and disable ETP for just that site. The number of sites that break is lower than people expect.

DNS-over-HTTPS

By default, your DNS queries go to your ISP unencrypted. Firefox can encrypt them via DNS-over-HTTPS (DoH).

Go to about:preferences#privacy → scroll down → "DNS over HTTPS"

Options:

• Off
• Default Protection (uses your OS DNS as fallback)
• Increased Protection (uses DoH, falls back to OS)
• Max Protection (DoH only, if it fails the request fails)

Providers available by default: Cloudflare (1.1.1.1) or NextDNS.

What this does: Encrypts DNS lookups so your ISP can't see which domains you're visiting. Doesn't hide your IP from those domains.

Recommendation: "Increased Protection" with Cloudflare or NextDNS is a good default for most people.

HTTPS-Only Mode

Available in the same privacy settings: "HTTPS-Only Mode."

Enables: all connections use HTTPS. If a site only offers HTTP, Firefox warns before you proceed.

Recommendation: Enable "Enable HTTPS-Only Mode in all windows." The warning prompt when a site doesn't support HTTPS is a useful signal.

about:config Settings Worth Changing

These are the highest-signal about:config tweaks that don't break browsing:

// Disable telemetry
toolkit.telemetry.unified = false
toolkit.telemetry.enabled = false

// Disable Firefox Studies/Experiments
app.shield.optoutstudies.enabled = false

// Prevent WebRTC IP leaks
media.peerconnection.ice.default_address_only = true

// Disable Pocket integration
extensions.pocket.enabled = false

// Disable form autofill suggestions from previous sessions
browser.formfill.enable = false

// Clear cookies/site data on close (optional - breaks logins)
privacy.sanitize.sanitizeOnShutdown = true
privacy.clearOnShutdown.cookies = true

Note: The WebRTC leak prevention setting (media.peerconnection.ice.default_address_only) is worth setting if you use a VPN — without it, WebRTC can reveal your real IP even through a VPN.

Recommended Extensions for Privacy

Essential:

• uBlock Origin — ad and tracker blocking. Use Medium or Hard mode for more blocking (takes setup)

For identity separation:

• Multi-Account Containers — isolate sites from each other (cookies don't cross containers)

For dark mode without JS injection:

• NightOwl — CSS-inversion dark mode. Lighter than Dark Reader, no JS injection into pages.

For fingerprint resistance:

• Firefox's built-in Strict ETP covers most fingerprinting. The Resist Fingerprinting setting (privacy.resistFingerprinting = true in about:config) is more aggressive but can break things.

What Not to Do (Common Mistakes)

Don't disable JavaScript globally. NoScript-style blocking breaks too much of the modern web. uBlock Origin's dynamic filtering is a better approach if you want granular control.

Don't rely on private mode for privacy. Private/Incognito mode only prevents Firefox from saving your local history. Your ISP, employer network, and the sites you visit still see everything.

Don't install lots of privacy extensions. Paradoxically, having many extensions increases your fingerprint uniqueness. One good blocker (uBlock Origin) is better than five overlapping ones.

Don't trust "VPN mode" browser extensions. These are proxies, not VPNs. The distinction matters for what threat models they address.

Tab Sessions and Privacy

If privacy is a concern, how you manage tabs matters too. Firefox's built-in session restore keeps your last session on disk. If someone has access to your machine, they can see your browsing history via the session data.

Tab Manager & Session Saver lets you explicitly save named sessions — useful if you want to save a specific work session and clear your other tabs, rather than having everything automatically restored.

The Realistic Threat Model

Most people aren't trying to hide from nation-state actors. The practical threats are:

1. Ad tracking across sites → uBlock Origin + Strict ETP handles this
2. ISP visibility into DNS → DNS-over-HTTPS handles this
3. MITM attacks on HTTP sites → HTTPS-Only Mode handles this
4. Browser fingerprinting → Strict ETP + resist fingerprinting partially handles this

For most people, the settings above are sufficient. Going further (Tor Browser, custom build with all telemetry stripped) addresses threats most people don't face.

---

The key insight: the default Firefox settings are decent, but "Strict" ETP + DoH + HTTPS-Only is a meaningful improvement with minimal browsing friction. Everything beyond that is a tradeoff against usability.