Harden Firefox With a user.js
A handful of preferences that cut fingerprinting, leak-prone APIs and cross-site tracking — versioned in one file you control.
Firefox reads a user.js file from your profile folder on every launch and applies its preferences, overriding whatever is set in about:config. That makes your hardening repeatable: one file, under version control, applied to every machine.
1. Find your profile
Open about:profiles, find the profile marked in use, and click Open Folder next to Root Directory. Create user.js there.
2. Baseline preferences
// --- fingerprinting -------------------------------------------------
// Normalises timezone, screen size, fonts, canvas and more.
// Expect sites to see UTC and a letterboxed window.
user_pref("privacy.resistFingerprinting", true);
// --- tracking -------------------------------------------------------
// Total Cookie Protection: partition cookies per site.
user_pref("network.cookie.cookieBehavior", 5);
user_pref("privacy.trackingprotection.enabled", true);
user_pref("privacy.trackingprotection.socialtracking.enabled", true);
// Only send the origin when navigating cross-site.
user_pref("network.http.referer.XOriginTrimmingPolicy", 2);
// --- leaks ----------------------------------------------------------
// WebRTC can expose your real IP behind a VPN.
user_pref("media.peerconnection.enabled", false);
user_pref("geo.enabled", false);
// --- transport ------------------------------------------------------
user_pref("dom.security.https_only_mode", true);
Restart Firefox, then confirm each value in about:config.
3. Test it
- coveryourtracks.eff.org — fingerprint uniqueness.
- browserleaks.com/webrtc — should report WebRTC as unavailable.
4. Tradeoffs
media.peerconnection.enabled = false breaks browser video calls. privacy.resistFingerprinting can break sites that depend on your real timezone. Keep a separate, unhardened profile for the few services that need them rather than weakening the main one.
For a fully maintained version of this approach, see arkenfox/user.js.