Editing My Firefox Settings

<blockquote>'''Note:''' This article is imported from an old note-taking app and may be outdated.</blockquote>

== Core Modifications & Bloatware Removal ==

Some guides, such as the [https://spyware.neocities.org/guides/firefox Spyware Watchdog Mitigation Guide], recommend deleting default plugins bundled within the Firefox directory that may introduce privacy concerns or act as bloatware.

Navigate to your Firefox features directory and remove unnecessary add-ons:
<syntaxhighlight lang="bash">
cd /usr/lib/firefox/browser/features
sudo rm *.xpi
</syntaxhighlight>

'''List of bundled plugins commonly removed:'''
* <code>firefox@getpocket.com.xpi</code> — Pocket
* <code>followonsearch@mozilla.com.xpi</code> — Follow-On Search
* <code>activity-stream@mozilla.org.xpi</code> — Activity Stream
* <code>screenshots@mozilla.org.xpi</code> — Screenshots
* <code>onboarding@mozilla.org.xpi</code> — Onboarding
* <code>formautofill@mozilla.org.xpi</code> — Autofill
* <code>webcompat@mozilla.org.xpi</code> — Web Compatibility Reporter

== Configuration Tweaks (about:config) (if user.js does not cover them) ==

=== Privacy, Security & Networking ===
; <code>accessibility.blockautorefresh</code> : Set to <code>true</code> to disable forced redirections. Combining this with disabled CSS and JS yields raw, unmangled result links. [https://pedantic.software/fxc/blog/why_there_is_no_css_on_my_website.html (via Pedantic Software)]
; <code>browser.sessionstore.interval</code> : Set to a very high value to reduce disk writes and SessionStore tracking.

=== Additional Hardening Actions ===
* '''Disable Firefox SessionStore''': Search for <code>browser.sessionstore</code> in <code>about:config</code> and disable relevant telemetry/saving mechanisms.
* '''Disable CSS Visited Links''': Mitigates history-sniffing vulnerabilities. [https://www.reddit.com/r/privacy/comments/15fddo0/retrieving_your_browsing_history_through_a/juf5br1/ Read the Reddit discussion here.]

== User.js Templates & Generators ==

Instead of manually configuring <code>about:config</code>, you can use pre-configured <code>user.js</code> files.

To use a <code>user.js</code> file, you need to place it in your Firefox profile directory. This file is read every time Firefox starts, overriding any matching settings in <code>about:config</code> or <code>prefs.js</code>:

# Navigate to <code>about:support</code> in your URL bar.
# Find the '''Profile Directory''' row and click the '''Open Directory''' button.
# Create a new text file in this directory and name it exactly <code>user.js</code>.
# Open the file using a text editor.
# Paste your desired configuration settings from the templates below into the file and save it.
# Restart Firefox for the changes to take effect.

'''Generators:'''
* [https://ffprofile.com ffprofile.com] — Interactive <code>user.js</code> generator.
** ''Note on User-Agent Spoofing:'' While you can spoof your user-agent to a more common one (e.g., Chrome), doing so on Firefox can actually make your browser fingerprint [https://deviceinfo.me more unique] ([https://www.billdietrich.me/ComputerPrivacy.html alternative tools list]). Because Firefox's engine behaves differently than Chromium, mismatched engine/user-agent data is easily detectable. For common agents, see [https://techblog.willshouse.com/2012/01/03/most-common-user-agents/ Willhouse] or [https://www.whatismybrowser.com/guides/the-latest-user-agent/chrome WhatIsMyBrowser].

'''Popular Pre-configured Templates:'''
# [https://github.com/arkenfox/user.js/raw/master/user.js Arkenfox] (Highly recommended, well-known)
# [https://raw.githubusercontent.com/pyllyukko/user.js/master/user.js Pyllyukko] (Security focused)
# [https://git.nixnet.services/Narsil/desktop_user.js/raw/branch/master/user.js Narsil's user.js] (Privacy focused) (I use this one)
# [https://codeberg.org/polarhive/vulpes Vulpes]
# [https://git.nixnet.services/Narsil/palemoon_user.js Narsil's user.js for Pale Moon] (Privacy focused)
# [https://git.sr.ht/~krathalan/firefox-complement krathalan config]
# [https://github.com/simeononsecurity/FireFox-Privacy-Script simeononsec FireFox Script]
# [https://vermaden.wordpress.com/2024/03/18/sensible-firefox-setup/ vermaden's Sensible Setup]

== Extensions & Add-ons ==

* '''ximatrix''': A Firefox extension similar to uMatrix capable of blocking inline scripts and advanced requests. [https://github.com/xi/xiMatrix Source code available here]. 
** ''Alternative:'' [https://gitler.moe/Wrongthink/paraMatrix paraMatrix] (a fork of ximatrix).
* '''Chrome Extensions on Firefox''': Firefox has introduced capabilities for importing Chrome extensions. [https://news.slashdot.org/story/23/08/24/2233242/firefox-users-may-import-chrome-extensions-now Read the Slashdot coverage].
* '''Extension Restrictions''': Mozilla occasionally restricts add-ons on specific domains. To disable these restrictions and allow uBlock Origin to operate aggressively everywhere, read [https://12bytes.org/tech/mozilla-wants-more-control-over-your-add-ons/ 12bytes' analysis] and their [https://12bytes.org/ublock-origin-suggested-settings/ uBlock suggested settings].

== Browser UI & Maintenance Tweaks ==

* '''Verify Database Integrity''': Navigate to <code>about:support</code> -> Scroll down to '''Places Database''' -> Click '''Verify Integrity'''.
* '''Turn Off Firefox Sidebar''': [https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxPdfViewerSidebarOff Guide to disabling the PDF viewer sidebar].
* '''Disable Firefox Translator''': [https://xnacly.me/posts/2023/disable-firefox-translation/ Guide to disabling built-in local translation].
* '''Block Pop-Ups''': [https://support.mozilla.org/bm/questions/1369602 Mozilla Support thread on native pop-up blocking].
* '''GeckoView Config''': You can access deeper settings via [chrome://geckoview/content/config.xhtml chrome://geckoview/content/config.xhtml].

=== Custom GUI Settings ===
Navigate to the standard Firefox Settings (<code>about:preferences</code>) to adjust the following:

'''General'''
* '''Tabs:''' Enable ''Open links in tabs instead of new windows''. Disable ''Show an image preview when you hover on a tab'' and disable ''Enable link previews''.
* '''Fonts:''' Uncheck ''Allow pages to choose their own fonts, instead of your selections above''.
* '''Language:''' Set to English (US). Enable ''Request English versions of web pages for enhanced privacy''. Disable ''Enable full page translations''.
* '''Typing:''' Disable ''Check your spelling as you type''.
* '''Browsing & Media:''' Disable ''Enable picture-in-picture video controls'' and ''Control media via keyboard, headset, or virtual interface''.

'''Home'''
* '''New Windows and Tabs:''' Set both ''Homepage and new windows'' and ''New tabs'' to '''Blank Page'''.

'''Search'''
* '''Default Search Engine:''' Switch to a privacy-respecting alternative like <code>lite.duckduckgo.com</code>, or your own self-hosted '''SearXNG''' or '''4get''' instance.
* '''Search Suggestions:''' Disable ''Show search suggestions''.

'''Privacy & Security'''
* '''Tracking Protection:''' Set Enhanced Tracking Protection to '''Strict''' (disable ''Fix major site issues'' if opting for absolute strictness without exceptions).
* '''Global Privacy Control:''' Enable ''Tell websites not to sell or share my data''.
** ''Note:'' You can also explicitly enable the Do Not Track header by setting <code>privacy.donottrackheader.enabled</code> to <code>true</code> via the hidden <code>about:config</code> entry.
* '''Cookies and Site Data:''' Enable ''Delete cookies and site data when Firefox is closed''.
* '''Logins and Passwords:''' Disable saving passwords, payments, and addresses.
* '''History:''' Set to ''Use custom settings for history'' and enable ''Clear history when Firefox closes''.
* '''Permissions:''' Disallow all requests (Location, Camera, Microphone, Notifications, etc.). Enable ''Block pop-up windows'' and ''Warn you when websites try to install add-ons''.
* '''Data Collection and Use:''' Disallow/uncheck all telemetry and data collection options.
* '''Security:''' Enable ''HTTPS-Only Mode in all windows''.
* '''DNS over HTTPS:''' Set to '''Max Protection''' and select a privacy-friendly provider.

== Comprehensive Hardening Guides & Reading ==

* [https://github.com/awesome-windows11/firefox Awesome Firefox]
* [https://github.com/JArmandoG/Firefox-Hardening JArmandoG's Firefox Hardening Guide]
* [https://github.com/drduh/macOS-Security-and-Privacy-Guide#browser drduh's macOS Browser Privacy Guide]
* [https://sunknudsen.com/privacy-guides sunknudsen's Privacy Guides]
* [https://wrongthink.link/posts/hardened-web-browser/ Wrongthink: Hardened Web Browser]
* [https://unixsheikh.com/articles/choose-your-browser-carefully.html#tweaking-firefox Unixsheikh: Tweaking Firefox]
* [https://spyware.neocities.org/guides/firefox Spyware Watchdog: Firefox Mitigation]
* [https://fingerprint.com/blog/browser-anti-fingerprinting-techniques/ Fingerprint.com: Browser Anti-Fingerprinting Techniques]
* [https://gist.github.com/atcuno/3425484ac5cce5298932 atcuno's Privacy Guide] (Outdated but helpful concepts)
* [https://github.com/CISOfy/privacy-guide/blob/master/browser-security.md CISOfy Browser Security Guide]
* [http://kb.mozillazine.org/Category:Firefox MozillaZine Firefox Wiki]

[[Category:Hardening]]
[[Category:Web browsers]]
[[Category:Privacy]]
[[Category:Security]]