Personal Browser Privacy Audit: Testing Firefox's Actual Protection Level

A personal privacy audit — checking what information your browser reveals — is a useful exercise. Here's how to do it using tools Firefox has built in, plus a few external services.

What Information Does Your Browser Reveal?

When you visit any website, your browser automatically sends:

1. IP address (via TCP/IP — unavoidable without VPN/Tor)
2. DNS queries (which hostnames you look up — visible to ISP without DoH)
3. User-Agent (Mozilla/5.0 (X11; Linux x86_64) Firefox/131.0)
4. Accept headers (language, encoding preferences)
5. Browser fingerprint (canvas, WebGL, fonts, screen size, plugins, timezone, etc.)
6. Referrer header (which URL you came from)
7. Cookies (if set from previous visits)
8. TLS fingerprint (from your browser's TLS implementation)

Checking Your Current State

Fingerprint Analysis

Visit coveryourtracks.eff.org (by EFF). This shows:

• How unique your browser fingerprint is
• Which properties are most identifying
• Whether Firefox's protections are working

What to look for: "Your browser fingerprint appears to be unique among the X tested in the past 45 days" = high risk. With privacy.fingerprintingProtection = true, you should see a much larger "group" of users with similar fingerprints.

IP and DNS Leak Testing

IP check: ipleak.net shows:

• Your public IP address
• ISP and location
• WebRTC leaks (is your local IP visible?)
• DNS servers being used (are they different from your configured ones?)

DNS leak test: dnsleaktest.com → Extended Test:

• Shows which DNS servers are actually resolving your queries
• If you have DoH enabled, DNS should go through your chosen provider (Cloudflare, NextDNS), not your ISP

Expected results with Firefox DoH enabled:

• DNS servers: Cloudflare (1.1.1.1) or NextDNS (your ID), NOT your ISP's servers

WebRTC Leak Test

browserleaks.com/webrtc:

• Shows your public IP (expected)
• Shows local network IP (192.168.x.x) if WebRTC local discovery is enabled

If your local IP appears: add media.peerconnection.ice.no_host = true in about:config to prevent local IP disclosure. This doesn't break video calls.

About:Networking

about:networking#dns shows active DNS cache entries. Look at the "Resolver" column — should show your DoH resolver, not blank or ISP.

The Full Audit Checklist

Run through these checks:

1. Enhanced Tracking Protection Level
Settings → Privacy & Security → Enhanced Tracking Protection → verify it's "Strict" (or at minimum "Standard").

2. DNS over HTTPS
Settings → Privacy & Security → DNS over HTTPS → enabled. Verify at dnsleaktest.com.

3. HTTPS-Only Mode
Settings → Privacy & Security → Enable HTTPS-Only Mode in all windows. Verify with http:// test sites.

4. WebRTC local IP leak
Verify at browserleaks.com/webrtc. Fix with media.peerconnection.ice.no_host = true.

5. Fingerprint uniqueness
Visit coveryourtracks.eff.org. Enable privacy.fingerprintingProtection = true if fingerprint is highly unique.

6. Extension security audit
Go to about:addons → review each extension:

• Is it still needed?
• Does it have more permissions than needed?
• Has it been updated recently?

7. Cookies status
Settings → Privacy & Security → Cookies → Enhanced Tracking Protection cookies setting should restrict cookies.

8. Password security
about:logins → click "Check for Breached Logins". Address any breached entries.

9. Certificate errors log
about:networking#http shows recent HTTPS connections. about:certificate (as URL with a site parameter) shows certificate details.

Testing With Developer Tools

The Network panel in DevTools shows exactly what your browser sends with each request:

1. Open DevTools → Network
2. Visit a site
3. Click the first request (the main document)
4. Headers tab → Request Headers

You'll see:

• User-Agent header
• Accept-Language (your language preference)
• Cookie (if any cookies set)
• Referer (if coming from another page)

For privacy: consider network.http.sendRefererHeader = 1 (send only origin, not full URL) in about:config — though this can break some OAuth flows.

After the Audit: The Minimum Effective Settings

If your audit shows issues, the minimum effective configuration:

1. ETP → Strict
2. DNS over HTTPS → Enabled (Cloudflare or NextDNS)
3. HTTPS-Only Mode → All windows
4. media.peerconnection.ice.no_host → true
5. uBlock Origin installed (default list + optional Privacy lists)

This addresses: commercial tracking (ETP + uBlock), DNS surveillance (DoH), unencrypted connections (HTTPS-only), and WebRTC local IP (no_host).

Optional but valuable:

• privacy.fingerprintingProtection = true → reduces fingerprint uniqueness
• VPN → addresses IP-based surveillance (ISP can't correlate your browsing)

Privacy as a Gradient

There's no "fully private" browser. Privacy is a spectrum:

• Zero config Chrome: highly tracked
• Default Firefox: significantly better
• Firefox + settings above: much better
• Firefox + arkenfox user.js: aggressive, some breakage
• Tor Browser: maximum anonymity, not for daily use

The settings above represent a practical baseline that significantly improves privacy without meaningfully degrading usability. That's the right starting point for most users.

Run the audit annually or after major Firefox updates to ensure settings haven't been reset and no new leaks have appeared.