My Firefox Settings: Difference between revisions

Revision as of 21:04, 17 May 2026

Note: This article is imported from an old note-taking app and may be outdated.

Core Modifications & Bloatware Removal

Some guides, such as the Spyware Watchdog Mitigation Guide, recommend deleting default plugins bundled within the Firefox directory that may introduce privacy concerns or act as bloatware.

Navigate to your Firefox features directory and remove unnecessary add-ons:

cd /usr/lib/firefox/browser/features
doas rm *.xpi

List of bundled plugins commonly removed:

firefox@getpocket.com.xpi — Pocket
followonsearch@mozilla.com.xpi — Follow-On Search
activity-stream@mozilla.org.xpi — Activity Stream
screenshots@mozilla.org.xpi — Screenshots
onboarding@mozilla.org.xpi — Onboarding
formautofill@mozilla.org.xpi — Autofill
webcompat@mozilla.org.xpi — Web Compatibility Reporter

Configuration Tweaks (about:config) (if user.js does not cover them)

Privacy, Security & Networking

accessibility.blockautorefresh: Set to true to disable forced redirections. Combining this with disabled CSS and JS yields raw, unmangled result links. (via Pedantic Software)
browser.sessionstore.interval: Set to a very high value to reduce disk writes and SessionStore tracking.

Additional Hardening Actions

Disable Firefox SessionStore: Search for browser.sessionstore in about:config and disable relevant telemetry/saving mechanisms.
Disable CSS Visited Links: Mitigates history-sniffing vulnerabilities. Read the Reddit discussion here.

User.js Templates & Generators

Instead of manually configuring about:config, you can use pre-configured user.js files.

TODO: Add information about how to set up user.js here.

Generators:

ffprofile.com — Interactive user.js generator.
- Note on User-Agent Spoofing: While you can spoof your user-agent to a more common one (e.g., Chrome), doing so on Firefox can actually make your browser fingerprint more unique (alternative tools list). Because Firefox's engine behaves differently than Chromium, mismatched engine/user-agent data is easily detectable. For common agents, see Willhouse or WhatIsMyBrowser.

Popular Pre-configured Templates:

Arkenfox (Highly recommended, well-known)
Pyllyukko (Security focused)
Narsil's user.js (Privacy focused) (I use this one)
Vulpes
Narsil's user.js for Pale Moon (Privacy focused)
krathalan config
simeononsec FireFox Script
vermaden's Sensible Setup

Extensions & Add-ons

ximatrix: A Firefox extension similar to uMatrix capable of blocking inline scripts and advanced requests. Source code available here.
- Alternative: paraMatrix (a fork of ximatrix).
Chrome Extensions on Firefox: Firefox has introduced capabilities for importing Chrome extensions. Read the Slashdot coverage.
Extension Restrictions: Mozilla occasionally restricts add-ons on specific domains. To disable these restrictions and allow uBlock Origin to operate aggressively everywhere, read 12bytes' analysis and their uBlock suggested settings.

Browser UI & Maintenance Tweaks

Verify Database Integrity: Navigate to about:support -> Scroll down to Places Database -> Click Verify Integrity.
Turn Off Firefox Sidebar: Guide to disabling the PDF viewer sidebar.
Disable Firefox Translator: Guide to disabling built-in local translation.
Block Pop-Ups: Mozilla Support thread on native pop-up blocking.
GeckoView Config: You can access deeper settings via [chrome://geckoview/content/config.xhtml chrome://geckoview/content/config.xhtml].

TODO update this part with my settings

Comprehensive Hardening Guides & Reading

@@ Line 23: / Line 23: @@
 === Privacy, Security & Networking ===
-; <code>network.http.referrer.spoofSource</code> : Set to <code>true</code>.
 ; <code>accessibility.blockautorefresh</code> : Set to <code>true</code> to disable forced redirections. Combining this with disabled CSS and JS yields raw, unmangled result links. [https://pedantic.software/fxc/blog/why_there_is_no_css_on_my_website.html (via Pedantic Software)]
 ; <code>browser.sessionstore.interval</code> : Set to a very high value to reduce disk writes and SessionStore tracking.
@@ Line 34: / Line 33: @@
 Instead of manually configuring <code>about:config</code>, you can use pre-configured <code>user.js</code> files.
+TODO: Add information about how to set up user.js here.
 '''Generators:'''
@@ Line 42: / Line 43: @@
 # [https://github.com/arkenfox/user.js/raw/master/user.js Arkenfox] (Highly recommended, well-known)
 # [https://raw.githubusercontent.com/pyllyukko/user.js/master/user.js Pyllyukko] (Security focused)
-# [https://git.nixnet.services/Narsil/desktop_user.js/raw/branch/master/user.js Narsil's user.js] (Privacy focused)
+# [https://git.nixnet.services/Narsil/desktop_user.js/raw/branch/master/user.js Narsil's user.js] (Privacy focused) (I use this one)
 # [https://codeberg.org/polarhive/vulpes Vulpes]
 # [https://git.nixnet.services/Narsil/palemoon_user.js Narsil's user.js for Pale Moon] (Privacy focused)
@@ Line 63: / Line 64: @@
 * '''Block Pop-Ups''': [https://support.mozilla.org/bm/questions/1369602 Mozilla Support thread on native pop-up blocking].
 * '''GeckoView Config''': You can access deeper settings via [chrome://geckoview/content/config.xhtml chrome://geckoview/content/config.xhtml].
+TODO update this part with my settings
 == Comprehensive Hardening Guides & Reading ==