Firefox ships with robust security defaults, but understanding them helps you make informed decisions about what to keep, what to change, and what to add.
What Firefox Protects by Default
HTTPS-First Mode (Firefox 83+)
Firefox now tries HTTPS first for every connection. When you type a domain without specifying http://, Firefox upgrades to HTTPS automatically. If the site doesn't support HTTPS, Firefox falls back to HTTP with a visual indicator in the address bar.
To verify it's on: Settings → Privacy & Security → HTTPS-Only Mode. Enable "Enable HTTPS-Only Mode in all windows."
Enhanced Tracking Protection
Firefox's ETP blocks:
- Social media trackers (Facebook pixels, Twitter widgets)
- Cross-site tracking cookies
- Cryptominers
- Fingerprinters
- Tracking content (in Strict mode)
The default is "Standard." For better protection at some site-breakage risk, switch to "Strict."
Certificate Verification
Firefox maintains its own root certificate store (separate from the OS on most platforms). This means:
- Updates to trusted CAs are handled by Firefox updates
- Corporate proxy MITM certificates must be explicitly added (not automatically trusted from OS)
- NSS (the crypto library) handles all certificate operations
For enterprise deployments, see the enterprise policies documentation for importing root certificates.
Sandboxing
Firefox uses multi-process architecture with OS-level sandboxing:
- Content processes (web pages) are sandboxed with restricted system access
- Media processes handle audio/video
- GPU process handles rendering
The isolation level depends on OS. On Linux, Firefox uses seccomp-BPF. On Windows, it uses the Windows sandbox. Check about:support → Security section to verify sandbox status.
Hardening Settings
In about:config
security.tls.version.min — Minimum TLS version allowed. Default 3 (TLS 1.2). Increasing to 4 (TLS 1.3 only) blocks connections to older servers.
security.mixed_content.block_active_content — Block active mixed content (scripts, iframes over HTTP on HTTPS pages). Default true.
security.mixed_content.block_display_content — Block passive mixed content (images over HTTP on HTTPS pages). Default false (Firefox shows warning but loads).
dom.security.https_only_mode — HTTPS-Only mode via about:config (same as the UI setting).
network.http.referer.XOriginPolicy — Control when the Referer header is sent cross-origin. Default 0 (always). Set to 2 to only send when hostname matches.
Extensions for Additional Security
uBlock Origin — Content blocker. The go-to for blocking ads, trackers, and malicious domains. Use the default filter lists plus Peter Lowe's Ad and tracking server list.
Firefox Multi-Account Containers — Isolates sites in separate "containers" so they can't share cookies or storage. Good for preventing cross-site tracking that ETP misses.
LocalCDN or Decentraleyes — Serves common CDN resources (jQuery, Bootstrap, etc.) locally instead of from CDN servers, preventing tracking via CDN usage patterns.
What NOT to Do
Don't disable JavaScript blanket-style — The web is unusable without JS. If you want to restrict JS, do it per-site via uBlock Origin's element picker or NoScript.
Don't use multiple anti-fingerprinting extensions — They conflict and can actually make your browser more unique. Pick one approach: privacy.resistFingerprinting in about:config OR a dedicated extension, not both.
Don't trust "secure" browsing extensions from unknown developers — Extensions have broad access to your browser. Stick to well-audited, open-source extensions.
Verifying Your Security Settings
about:support → Security section shows:
- Sandbox level
- TLS min/max version
- Fission (site isolation) status
SSL Labs (www.ssllabs.com/ssltest/viewMyClient.html) — Tests your browser's TLS capabilities from the outside.
Cover Your Tracks (coveryourtracks.eff.org) — EFF tool to check how unique your browser fingerprint is and whether tracking protection is working.
Firefox vs Chrome Security Model
A few notable differences:
Root certificates: Firefox uses its own store; Chrome trusts the OS store. In enterprise environments, Chrome automatically trusts corporate MITM certificates via OS policy. Firefox requires explicit enterprise configuration.
Extension permissions: Firefox's extension permission model is similar to Chrome's Manifest V3. Both require declaring permissions. Firefox still supports some MV2 APIs.
DNS over HTTPS: Firefox has its own DoH implementation (Trusted Recursive Resolver), separate from OS DNS. Provides encrypted DNS even when the OS doesn't. Configure in Settings → Privacy & Security → DNS over HTTPS.
Firefox's security posture out-of-box is solid. HTTPS-First mode, ETP, and sandbox isolation handle the common cases. For higher-risk use, the about:config tweaks and extension recommendations above add meaningful hardening without breaking most sites.
Top comments (0)