← Home  |  ← Protection Tools

Step-by-step: Optimize your browser for maximum privacy

Why Hardening Matters

Your browser is the primary window through which Big Tech tracks you. Most browsers are "leaky" by default, broadcasting your identity even if you try to stay private. By tweaking built-in settings like about:config, you can reclaim your anonymity without slowing down your system with heavy extensions.

What This Guide Solves

• Fingerprinting Resistance: Stop sites from identifying you via your screen resolution, fonts, and hardware.
• Timezone & Language Spoofing: Blend in by forcing your browser to report UTC and en-US regardless of your location.
• WebRTC Leak Protection: Close the "backdoor" that can expose your real IP address.
• Aggressive Cookie Control: Block the third-party trackers that follow you from site to site.
• JavaScript Control: Neutralize the #1 tool used for advanced tracking and browser exploits without breaking the sites you visit.
• ISP Privacy (IPv6): Disable secondary connection routes that can bypass your primary privacy layers.

Browser Compatibility Matrix

Not every setting is available in every browser. This matrix shows native support, workaround-only options, and settings that are simply not available.

Firefox stands out with the most comprehensive native privacy settings. Chrome and Edge lack built-in fingerprint resistance entirely, while Brave includes strong defaults out of the box. Timezone changes require OS-level adjustment in all browsers, and Safari's language setting is controlled through macOS system preferences.

Key Privacy Settings

Firefox: Fingerprinting Protection

privacy.resistFingerprinting (RFP)

This is the most powerful anti-fingerprinting tool available, originally ported from the Tor Browser project. Enabling it applies dozens of protections instantly:

• Identity Masking: Reports a generic user agent string to hide your specific OS and browser version.
• Standardization: Fixes your timezone to UTC, spoofs your language to en-US, and limits reported CPU cores (hardwareConcurrency) to 2.
• Canvas & WebGL Noise: Blocks high-precision tracking by adding random noise to browser-based rendering.
• Letterboxing: Rounds your window resolution and adds gray borders to prevent websites from identifying you by your exact screen dimensions.

How to enable RFP:

1. Type about:config in the address bar and press Enter.
2. Click "Accept the Risk and Continue."
3. Search for privacy.resistFingerprinting.
4. Double-click to set it to true.

privacy.fingerprintingProtection (FPP)

A modern, "lighter" alternative to RFP designed for daily browsing without the breakage.

The Main Advantage: It protects against common tracking vectors (like fonts and canvas) but retains your local timezone and language, making it much more user-friendly for shopping and scheduling.

How to enable FPP (Recommended):

1. Click the Menu button (three horizontal lines) and select Settings.
2. Go to Privacy & Security on the left sidebar.
3. Under Enhanced Tracking Protection, select "Strict".
4. Click "Refresh all tabs" to apply.

Disable WebRTC (Stop VPN Leaks)

WebRTC (Web Real-Time Communication) is a browser technology used for video calls and P2P connections. The Problem: It can bypass your VPN tunnel and reveal your real IP address via STUN server requests — even if your VPN is active. This is one of the most common privacy vulnerabilities for users in the U.S.

How to fix it by browser:

• Firefox: The only major browser that allows a total shutdown. Go to about:config, search for media.peerconnection.enabled, and set it to false.
• Brave: Offers the best "out-of-the-box" protection. Go to Settings > Privacy and Security > WebRTC IP Handling Policy and select "Disable non-proxied UDP". This stops the leak while keeping most services functional.
• Chrome / Edge / Opera: These browsers do not allow you to fully disable WebRTC in standard settings. The Fix: Use an extension like uBlock Origin. In uBlock settings, check the box: "Prevent WebRTC from leaking local IP addresses."
• Safari: Apple restricts STUN requests by default, significantly reducing leak risks. Most users don't need manual configuration here.

Cookie Policies & Cross-Site Tracking

Third-party cookies are the primary engine behind the multi-billion dollar "surveillance advertising" industry. When you visit a site, cookies from networks like Google and Meta load in the background, allowing them to build a permanent profile of your browsing habits across millions of websites.

How to block them by browser:

• Firefox (Highly Recommended): Go to Settings > Privacy & Security and select "Strict" mode.

  The Bonus: Firefox includes Total Cookie Protection, which "walls off" cookies into separate containers. Even if a site drops a cookie, it cannot "talk" to cookies from other sites.

• Brave: Default Protection: Blocks all third-party cookies and tracking scripts out of the box. No configuration needed. It also automatically hides those annoying cookie consent banners.
• Safari: Go to Settings > Privacy and ensure "Prevent Cross-Site Tracking" is enabled (it should be by default). Safari uses machine learning (ITP) to actively identify and neutralize new tracking threats.
• Chrome (The "Privacy Sandbox" Trap): Go to Settings > Privacy and Security > Third-party cookies and select "Block third-party cookies."

  ⚠️ Warning: Google is replacing cookies with its own "Privacy Sandbox" (Topics API). While it sounds privacy-friendly, it actually moves the tracking from the cookie to the browser itself. We recommend disabling all "Ad Privacy" features in Chrome settings.

• Microsoft Edge: Go to Settings > Privacy, search, and services and switch Tracking Prevention to "Strict." The default "Balanced" setting still allows many advertising trackers to slip through.
• Samsung Internet (Mobile): Enable "Smart Anti-Tracking" in Privacy settings. For maximum protection, go to Site settings > Cookies and manually select "Block third-party cookies." Note: Samsung's protection is less robust than Firefox or Brave.

JavaScript: The "Nuclear Option"

JavaScript (JS) is the engine that makes the modern web work, but it is also the primary tool used for fingerprinting. Almost every tracking technique — canvas readback, WebGL rendering, font enumeration, and hardware queries — requires JavaScript to execute.

How to disable JS (Global):

• Firefox: Go to about:config, search for javascript.enabled, and set it to false.
• Chrome / Edge: Go to Settings > Privacy and Security > Site Settings > JavaScript and select "Don't allow sites to use JavaScript."
• Brave: Go to Settings > Privacy and security > Site and Shields Settings > JavaScript and select "Don't allow sites to use JavaScript." Alternatively, use the Shields panel (lion icon) to block scripts per site without a global setting.
• Safari: Go to Settings > Security and uncheck "Enable JavaScript."

The "Surgical" Approach with uBlock Origin (Highly Recommended)

Instead of a global shutdown that breaks the internet, use uBlock Origin for per-site control. This allows you to keep JS active for your trusted banking and work sites while killing it on suspicious or ad-heavy pages.

1. Click the uBlock Origin icon in your browser bar.
2. Click the </> icon (Selectively disable JavaScript) for the current site.

Pro Tip: Use "Hard Mode" in uBlock Origin to block all 3rd-party scripts by default, only enabling them for the specific domains you trust.

IPv6: The "Silent" VPN Leak

If your VPN only tunnels IPv4 traffic (which many still do), your device may bypass the VPN entirely and connect to websites directly over IPv6. The Result: Your real IP address is exposed to the world, even though your VPN says "Connected." This is a massive privacy hole in the U.S., where ISPs like Comcast, AT&T, and Verizon have some of the highest IPv6 adoption rates in the world.

How to fix it by browser:

• Firefox: The only major browser with a built-in "kill switch." Go to about:config, search for network.dns.disableIPv6, and set it to true.
• Chrome / Brave / Edge / Safari: These browsers lack internal IPv6 controls. To stay protected, you must disable IPv6 at the System Level (see below).

System-Level Fix (The "Nuclear" Solution):

• Windows (PowerShell): Open PowerShell as Administrator and run:

  Set-NetAdapterBinding -Name "*" -ComponentID ms_tcpip6 -Enabled $false

• macOS: Go to System Settings > Network, select your connection, click Details > TCP/IP, and set "Configure IPv6" to "Link-local only."

Match Your Timezone (Avoid "VPN Mismatch" Flags)

Websites can detect your local timezone via JavaScript (getTimezoneOffset). If your VPN is connected to a Los Angeles server (PST), but your computer reports New York time (EST), websites will immediately flag your connection as a proxy or "suspicious." This is a common reason why sites like Netflix or banking apps might block your access.

The Fix: Match your OS to your VPN location

To stay anonymous, your system clock must match your VPN server's location:

• Windows: Settings > Time & Language > Date & Time. Toggle "Set time zone automatically" to OFF and manually select the zone that matches your VPN server.
• macOS: System Settings > Date & Time. Uncheck "Set time zone automatically" and select the matching city from the map.
• Linux: Use the command: timedatectl set-timezone [Region/City] (e.g., America/Los_Angeles).

The "Set and Forget" Solution

If you don't want to change your clock every time you switch VPN servers, use Firefox. Enable privacy.resistFingerprinting: This forces your timezone to UTC+0 for all websites, regardless of your real location. To a tracker, you will simply appear as one of millions of users in the "neutral" UTC zone.

Browser Language: "Hiding in the Crowd"

Your browser's language setting is sent to every website via the Accept-Language header and is accessible through JavaScript (navigator.language). For users in the U.S., en-US is the gold standard for anonymity. Using a less common language (like cs-CZ, es-MX, or even en-GB) makes your browser fingerprint significantly more unique and easier to track.

How to set your language to en-US:

• Firefox: Go to Settings > General > Language. Click "Set Alternatives" and ensure English (United States) [en-US] is at the very top of the list.
• Chrome / Edge: Go to Settings > Languages. Move English (United States) to the top of the list.
• Brave: Go to Settings > Languages. Click "Add languages", select English (United States), and move it to the top. Pro Tip: Remove any other secondary languages to reduce your fingerprint's uniqueness.
• Safari: Safari uses your macOS system language. The Fix: Go to System Settings > General > Language & Region and ensure English (US) is your primary language.

The Firefox Shortcut: If you have privacy.resistFingerprinting enabled, Firefox will automatically spoof your language to en-US for all websites, regardless of your actual system settings.

HTTPS-Only Mode: Your First Line of Defense

HTTPS encrypts the connection between your browser and the website, preventing your ISP (Comcast, AT&T), network administrators, or attackers on public Wi-Fi from reading or modifying your data. Enabling HTTPS-Only Mode forces your browser to always use encrypted connections and blocks insecure, unencrypted HTTP traffic.

How to enable it:

• Firefox: Go to Settings > Privacy & Security, scroll to the bottom, and select "Enable HTTPS-Only Mode in all windows."
• Brave: This is enabled by default. Brave automatically upgrades all connections to HTTPS without any configuration.
• Chrome: Go to Settings > Privacy and Security > Security and toggle on "Always use secure connections."
• Edge: Type edge://settings/privacy in the address bar, scroll to Security, and enable "Automatically switch to a more secure connection with Microsoft Defender SmartScreen."
• Safari: Modern versions of Safari automatically attempt to upgrade all connections to HTTPS. No manual toggle is required.

Privacy vs. Usability Trade-off

Every privacy setting comes with a trade-off. Some are invisible to your daily browsing, while others will break websites you rely on. This scale shows where each setting falls.

Settings on the left side of the scale are safe to enable for everyone — they improve privacy with zero impact on daily browsing. As you move right, the privacy gains increase, but so does the likelihood of breaking websites you depend on. Most users should enable everything up to "Cookie Policies" and stop there unless they have specific privacy needs.

Quick Start Guide

Follow these four steps in order, starting with the easiest changes that provide the most benefit. You can stop at any step — each one adds meaningful protection on its own.

Each step builds on the previous one. Steps 1 and 2 are recommended for all users on any browser. Steps 3 and 4 are for Firefox users who want stronger protection and are willing to deal with occasional website issues.