Firefox Privacy Layers: What Each Setting Actually Stops (Tested)

Most "privacy guides" give you a hardening checklist without telling you what each setting actually does to your measurable privacy. Let me do something different: test what Firefox actually leaks by default, and what each protection actually stops.

What We're Measuring

Using Cover Your Tracks (EFF's fingerprinting test), BrowserLeaks, and DNS leak tests, I'll walk through Firefox's default state and then what each protection adds.

Default Firefox: What It Leaks

Canvas fingerprint: Detectable. By default, Firefox doesn't restrict canvas fingerprinting. Your GPU + font rendering produces a unique signature.

WebGL fingerprint: Detectable. WebGL exposes GPU info, driver version, and rendering characteristics.

AudioContext fingerprint: Detectable. Your audio hardware produces measurable variations.

Fonts: Firefox restricts the font list exposed to JavaScript in Private Browsing mode. In regular mode, more fonts are visible.

Timezone: Fully exposed — your timezone is sent to any site running JavaScript.

Screen resolution: Fully exposed.

User-Agent string: Firefox's default UA string identifies Firefox version, OS, and architecture. Very specific.

DNS: By default, Firefox uses your OS DNS resolver. If your ISP's DNS, they see all your DNS queries.

This is Firefox default — already better than Chrome defaults, but not private.

Layer 1: HTTPS-Only Mode

What it stops: Man-in-the-middle attacks and passive eavesdropping on HTTP connections.

What it doesn't stop: Any fingerprinting. HTTPS protects the content of your communication, not whether you're identified.

Enable: Settings → Privacy → HTTPS-Only Mode → Enable in all windows.

Layer 2: Enhanced Tracking Protection (Strict)

Settings → Privacy → Enhanced Tracking Protection → Strict

What strict ETP stops:

• Social media trackers (Facebook pixel, Twitter pixel, etc.)
• Cross-site tracking cookies
• Fingerprinting scripts (blocks known fingerprinting libraries)
• Cryptominers
• Tracking content in all windows (default only blocks in Private Browsing)

Test with EFF's Cover Your Tracks: With Standard ETP, you'll see "Your browser has a unique fingerprint" but the tracking protection is partial. With Strict ETP, the fingerprinting scripts are blocked more aggressively.

What it doesn't stop: First-party fingerprinting (the site itself fingerprinting you, not third parties), timezone, screen resolution, all built-in browser characteristics.

Layer 3: DNS over HTTPS (DoH)

Settings → General → Network → Enable DNS over HTTPS

What it stops: Your ISP seeing your DNS queries. Without DoH, your ISP knows every domain you resolve (even on HTTPS sites, DNS is visible).

What it doesn't stop: The DoH provider sees your DNS queries instead of your ISP. Choose a provider you trust (NextDNS, Quad9, or Cloudflare 1.1.1.1).

Verify it works: about:networking → DNS tab shows current resolver.

Extra: Enable "Only use DNS over HTTPS" to prevent DNS fallback to plain DNS.

Layer 4: uBlock Origin

Install from AMO (addons.mozilla.org).

What uBlock Origin adds beyond ETP:

• Blocks ads (ETP doesn't block all ads, only tracking-adjacent ones)
• Blocks more third-party scripts
• Allows custom filter lists (including anti-fingerprinting lists)
• Blocks more third-party frames

Custom filters for fingerprinting: Add these filter lists in uBlock:

• EasyPrivacy
• Fanboy's Enhanced Tracking List
• Peter Lowe's Ad and tracking server list

After adding these, Cover Your Tracks will show more blocked scripts.

What uBlock doesn't stop: First-party fingerprinting (the site directly fingerprinting you without loading third-party scripts).

Layer 5: Firefox's resistFingerprinting

In about:config: set privacy.resistFingerprinting = true

What resistFingerprinting changes:

• Timezone reported as UTC (not your real timezone)
• Canvas fingerprint noise added (randomized per session)
• WebGL fingerprint restricted
• Font list restricted
• Screen size reported as a generic value
• User-Agent simplified
• Hardware info generalized

Test result with resistFingerprinting: Cover Your Tracks shows "Your browser has a randomized fingerprint" — you look like a large pool of other Firefox users with the same setting.

What it breaks:

• Sites that use timezone for functionality (calendars, scheduling)
• Some captchas
• Canvas-based apps
• Occasionally payment forms

This is the right setting for private browsing sessions but may be too disruptive for daily use.

Layer 6: Private Browsing Mode

Ctrl+Shift+P opens a Private Window.

What Private Browsing adds:

• No history stored locally
• No cookies kept after window closes
• No caching
• In Private Browsing, more fingerprinting protections are enabled by default (before resistFingerprinting)

What Private Browsing doesn't stop:

• Your ISP still sees your connections
• Sites still fingerprint you in the session (just can't track you across sessions)
• Nothing about network-level identity

Summary: What Each Layer Stops

Recommended Configuration

For everyday privacy (minimal breakage):

1. HTTPS-Only Mode: ON
2. ETP: Strict
3. DoH: Enabled (NextDNS or Quad9)
4. uBlock Origin: Installed with default + EasyPrivacy lists

For sensitive browsing (in Private Window):

1. All of the above
2. privacy.resistFingerprinting = true
3. Or: Use Tor Browser for maximum anonymity

The default Firefox is a reasonable starting point. With these four changes (HTTPS-only, strict ETP, DoH, uBlock), you significantly reduce your trackable footprint without breaking most websites.