A step-by-step look at the Firefox settings that reduce fingerprinting, which extensions genuinely help, and why an over-customised profile can backfire.
On this page
Firefox is the only mainstream browser that lets you meaningfully change how it presents itself to websites. That flexibility is both its strength and its trap, and the difference between the two is entirely in how you use it.
An honest note on the limits
It is not a list of everything you could switch on. It is not a promise that a hardened browser makes you anonymous, and it is not an argument for copying someone else’s configuration wholesale. The same settings that reduce what you leak can, pushed too far, make your browser more distinctive than a stock install would have been.
What follows is a working order, roughly by impact, with an honest note where the returns fall away. Treat it as a set of decisions to make rather than a checklist to complete.
Start from a clean profile
Before changing anything, understand your baseline. A clean profile on a common operating system starts you in a large crowd, which is the entire point.
Install Firefox fresh
Skip any import of an old profile with years of accumulated extensions behind it.
Check what you look like now
Run the fingerprint test and note the uniqueness figure it gives you.
Keep that number
It is the measure every later change is compared against.
The browser fingerprint test gives you that number to compare against later, and it is the only reason to bother taking a baseline at all.
Raise tracking protection
Firefox’s Enhanced Tracking Protection has three levels, and the one you pick changes how much work the browser does on your behalf.
The three levels
The standard level blocks known trackers. The strict level blocks more, including known fingerprinting scripts and some tracking parameters. A custom level lets you choose which categories to block one by one.
For most people the strict level is the right starting point. It costs little in daily use and removes a large share of the scripts that build fingerprints in the first place. If a site breaks, the shield control lets you make an exception for that site alone rather than lowering the setting everywhere.
Decide what to do about canvas and WebGL
Canvas and WebGL are the highest-value signals a tracker can read, so they attract the most attention. Firefox gives you options rather than one answer.
- Block them outright. Effective, but breaks a surprising number of sites, since maps, image editors and charting libraries all use canvas legitimately.
- Ask each time. The browser prompts before allowing a read, which keeps control in your hands at the cost of frequent interruptions.
- Enable the anti-fingerprinting preference. A single advanced setting that standardises canvas and many other values together, rather than blocking them.
That last option is the one most people want, and it is the same mechanism behind the browser’s broader fingerprinting resistance.
Restrict font visibility
The set of fonts your system has installed is one of the richest identifying signals there is, and it is largely shaped by software you installed years ago. Firefox can limit what a page is allowed to enumerate, either to a standard set of fonts or to the fonts a page actually needs to render its own text.
This is a case where a visibly restrictive setting is usually worth it. See how exposed you are first with the font detection test — the list of fonts a site can currently read is often longer and stranger than people expect.
Keep WebRTC in check
WebRTC, the technology behind in-browser calls, can reveal network addresses that a VPN was supposed to hide. Firefox does not expose your local address the way some browsers once did, but it can still enumerate addresses on some network setups.
If you use a VPN, this is worth checking rather than assuming. See how to hide your IP address for the wider picture on what a tunnel does and does not cover.
Simple, honest preferences
A few smaller settings deserve a moment, and each is worth judging by what it actually changes rather than by how thorough it sounds.
| Preference | What it changes | Does it touch your fingerprint? |
|---|---|---|
| Do Not Track | Sends a preference signal a site may ignore | No |
| DNS over HTTPS | Encrypts lookups so your network provider cannot see them | No |
| Language settings | Shortens a list that is distinctive when long | Yes |
Treat Do Not Track as a statement of preference rather than a protection, because it relies on the site choosing to honour it; send it, then confirm with the Do Not Track test. Enable DNS over HTTPS for the privacy benefit rather than as a fingerprinting measure, since it does not affect your fingerprint at all. And keep your language list short and consistent with your actual region, because a long list of languages is a distinctive trait.
Extensions: fewer than you think
The instinct is to add a stack of privacy extensions. Resist it. Every extension can alter how the browser behaves in ways a page can observe, and the combination of extensions you run is a signature of its own.
A short list of well-maintained tools, perhaps a content blocker and one script blocker, does more good than a long one. An extension that claims to spoof your user agent or randomise your values is usually the most damaging kind, because the mismatches it creates between your browser and its claimed identity are easy to detect and rare among ordinary visitors. Fewer moving parts, in this case, genuinely means fewer things for a page to notice.
The paradox of the hardened profile
Everything above improves your position in isolation. Applied enthusiastically and all at once, the combination can do the opposite. Very few people run a Firefox profile with strict tracking protection, restricted fonts, an enabled anti-fingerprinting setting and a curated short extension list. If you do, your configuration may be rarer than a default install would have been.
This is not an argument for doing nothing. It is an argument for measuring. Re-run the browser fingerprint test after each meaningful change, and if the uniqueness figure rises rather than falls, undo the last step.
A short checklist
- Strict tracking protection on, with exceptions made per site rather than lowered everywhere.
- A deliberate decision about canvas and WebGL — block, prompt, or standardise — rather than leaving it alone.
- Font visibility restricted or left as it is, once you have seen the list your browser exposes.
- Extensions kept short and well maintained, with nothing that claims to spoof or randomise.
- The fingerprint test re-run after each change, and the last step undone if the number rises.
If you would rather compare browsers than tune one, our comparison of Brave, Firefox and Tor sets out the trade-offs.