Firefox Is Leaking Your Data — These about:config Tweaks Fix It

Which about:config Tweaks Actually Make Firefox Private?

The most effective firefox privacy about config tweaks disable telemetry reporting, block WebRTC IP leaks, enable fingerprinting resistance, enforce DNS-over-HTTPS, tighten referrer policies, and kill crash-report uploads. Out of the box, Firefox phones home to Mozilla on nearly every session — about:config lets you cut every one of those channels. Below you’ll find 30+ specific keys, the exact values to set, why each matters, and a drop-in user.js template you can deploy in seconds.

How to Open about:config (and Why Firefox Warns You)

Type about:config in the Firefox address bar and press Enter. Firefox shows a “Proceed with Caution” warning — click Accept the Risk and Continue. This page exposes every internal preference Firefox uses, hundreds of which control privacy behavior that the regular Settings panel never surfaces. Changing a value here takes effect immediately (some require a browser restart).

Use the search bar at the top to locate each key below. If a preference doesn’t exist yet, right-click → New → Boolean/Integer/String to create it. To reset any change, right-click the preference and choose Reset.

Category 1 — Telemetry and Data Collection

Firefox collects usage statistics, health reports, and experiment data by default. These preferences shut all of it down.

Preference Key	Set To	What It Does
toolkit.telemetry.enabled	false	Master switch for Firefox telemetry — disables all usage-statistic pings sent to Mozilla.
toolkit.telemetry.unified	false	Disables the unified telemetry system that aggregates and batches pings.
toolkit.telemetry.archive.enabled	false	Stops Firefox from archiving telemetry pings locally before upload.
toolkit.telemetry.server	(empty string)	Removes the server URL telemetry would be sent to — a belt-and-suspenders failsafe.
datareporting.healthreport.uploadEnabled	false	Blocks Firefox Health Report uploads to Mozilla.
datareporting.policy.dataSubmissionEnabled	false	Kills the top-level policy that authorizes any data submission.

Disabling telemetry doesn’t affect Firefox’s ability to receive security updates. Updates travel through a separate channel (app.update preferences) and remain fully functional.

Category 2 — WebRTC Leak Prevention

WebRTC can expose your real local and public IP addresses even when you’re behind a VPN or proxy. This is one of the most critical leaks to close, especially if you practice anonymous browsing.

Preference Key	Set To	What It Does
media.peerconnection.enabled	false	Disables WebRTC entirely. Breaks video calling in-browser (Google Meet, Jitsi) but eliminates all IP leak vectors.
media.peerconnection.ice.default_address_only	true	If you keep WebRTC enabled, this restricts ICE candidates to your default network interface only — hiding additional IPs from multi-homed systems.
media.peerconnection.ice.no_host	true	Prevents WebRTC from disclosing your local/host IP address in ICE candidate exchange.
media.peerconnection.ice.proxy_only_if_behind_proxy	true	Forces WebRTC to only use the proxy connection when one is configured, preventing bypass.

If you rely on browser-based video calls, keep media.peerconnection.enabled at true but set all three ICE preferences. This limits exposure without killing functionality. Test your changes at https://browserleaks.com/webrtc — you should see “No leak” or only your VPN/proxy IP.

Category 3 — Fingerprinting Resistance

Firefox includes a built-in fingerprinting resistance mode (RFP) that normalizes dozens of browser properties websites use to identify you. Understanding browser fingerprinting is critical before toggling these — RFP changes visible behaviors like timezone reporting and font enumeration.

Preference Key	Set To	What It Does
privacy.resistFingerprinting	true	Enables Resist Fingerprinting (RFP). Spoofs timezone to UTC, limits font enumeration, normalizes screen dimensions, randomizes canvas readback, and more. The single most impactful anti-fingerprinting toggle.
privacy.resistFingerprinting.letterboxing	true	Adds padding around page content so the visible viewport has a standard, common size — prevents dimension-based fingerprinting even on unusual monitor resolutions.
webgl.disabled	true	Disables WebGL, which exposes GPU renderer strings and can generate hardware-unique canvas hashes. Breaks some 3D content and games.
privacy.trackingprotection.fingerprinting.enabled	true	Enables Firefox’s tracker-level fingerprinting protection, blocking known fingerprinting scripts from third-party domains.
browser.display.use_document_fonts	0	Prevents websites from loading custom fonts, eliminating font-enumeration fingerprinting. Some sites may look different.

Heads up: privacy.resistFingerprinting forces your reported timezone to UTC regardless of your actual location. If you operate accounts tied to specific regions, this mismatch can itself look suspicious. Tools designed for multi-account work handle per-profile timezone spoofing without this trade-off — more on that later.

Category 4 — DNS Privacy

By default, Firefox sends DNS queries in plain text to your ISP’s resolver — meaning your ISP sees every domain you visit. DNS-over-HTTPS (DoH) encrypts those queries.

Preference Key	Set To	What It Does
network.trr.mode	3	Forces all DNS through Trusted Recursive Resolver (DoH). Mode 2 = DoH-first with fallback; Mode 3 = DoH-only, no fallback. Use Mode 3 for maximum privacy.
network.trr.uri	https://dns.quad9.net/dns-query	Sets the DoH resolver. Quad9 blocks malware domains and doesn’t log queries. Alternatives: Cloudflare (https://cloudflare-dns.com/dns-query), Mullvad (https://dns.mullvad.net/dns-query).
network.dns.disablePrefetch	true	Stops Firefox from pre-resolving domains linked on a page. Prefetch reveals browsing patterns to the DNS resolver.
network.dns.disableIPv6	true	Disables IPv6 DNS lookups. Many VPNs still leak on IPv6 — disabling it avoids a common de-anonymization vector.

After setting these, visit https://dnsleaktest.com and run the extended test. You should see only your chosen DoH resolver, not your ISP. For more foundational privacy strategies, see our safe browsing guide.

Category 5 — Referrer Policy

HTTP referrer headers tell every site you visit which page sent you there. Tightening the referrer policy limits cross-site tracking.

Preference Key	Set To	What It Does
network.http.referer.XOriginPolicy	2	Sends referrer only when the base domain matches. Cross-origin navigations get no referrer, stopping third-party sites from seeing where you came from. (0 = always send, 1 = send for same-eTLD+1, 2 = send only on exact host match.)
network.http.referer.XOriginTrimmingPolicy	2	When a referrer is sent cross-origin, trims it to just the scheme+host+port — the full path is stripped. (0 = full URL, 1 = strip query, 2 = scheme+host+port only.)
network.http.sendRefererHeader	1	Sends referrer only on link clicks, not on image/resource loads. Reduces incidental referrer leaks. (0 = never, 1 = clicks only, 2 = clicks + images.)

Some login flows and payment gateways rely on the referrer header. If a site breaks after applying these, temporarily switch XOriginPolicy back to 1 for that session.

Category 6 — Enhanced Tracking Protection

Firefox’s built-in tracking protection has multiple layers you can max out via about:config.

Preference Key	Set To	What It Does
privacy.trackingprotection.enabled	true	Enables tracking protection in all windows (not just private browsing).
privacy.trackingprotection.socialtracking.enabled	true	Blocks social media trackers (Facebook Pixel, Twitter widgets, LinkedIn Insight Tag).
privacy.trackingprotection.cryptomining.enabled	true	Blocks known cryptomining scripts that hijack your CPU.
network.cookie.cookieBehavior	5	Enables Total Cookie Protection (dFPI) — each website gets its own isolated cookie jar, preventing cross-site tracking via cookies. This is the strictest option and the default in Firefox 103+, but older installs may not have it.
privacy.partition.network_state	true	Partitions network state (caches, connections, authentication) per first-party domain. Prevents cache-based tracking and supercookies.

Total Cookie Protection (cookieBehavior = 5) is the most impactful setting in this category. It achieves session isolation at the cookie level — each site thinks your browser is brand new with no cross-site history.

Category 7 — Experiments and Studies

Mozilla runs A/B experiments (Shield Studies) on Firefox users by default, sometimes deploying code changes remotely. Opting out prevents unexpected behavior modifications.

Preference Key	Set To	What It Does
app.shield.optoutstudies.enabled	false	Opts out of all Shield Studies. No remote experiment code will be deployed to your browser.
app.normandy.enabled	false	Disables the Normandy system entirely — the mechanism through which Mozilla pushes studies, preference rollouts, and add-on installs remotely.
app.normandy.api_url	(empty string)	Removes the Normandy API endpoint as a failsafe.
messaging-system.rsexperimentloader.enabled	false	Disables the remote-settings experiment loader that can fetch and run new experiment configurations silently.

Category 8 — Crash Reports and Diagnostics

Crash reports can contain memory dumps with session data, tokens, and browsing content. Disabling automatic submission keeps this data local.

Preference Key	Set To	What It Does
browser.crashReports.unsubmittedCheck.autoSubmit2	false	Prevents automatic submission of crash reports without user interaction.
browser.tabs.crashReporting.sendReport	false	Disables the “Send crash report” checkbox that appears on tab crash pages.
breakpad.reportURL	(empty string)	Removes the crash-report submission URL — reports stay local even if other prefs are toggled back on.

Bonus Tweaks — Network and Prefetch

These additional settings reduce data leakage through speculative connections and prefetching.

Preference Key	Set To	What It Does
network.prefetch-next	false	Stops Firefox from prefetching linked pages. Prefetching reveals your likely next navigation to the server and any intermediary.
network.predictor.enabled	false	Disables the network predictor that pre-connects to servers you might visit.
browser.urlbar.speculativeConnect.enabled	false	Prevents Firefox from opening speculative connections as you type in the address bar.
dom.battery.enabled	false	Disables the Battery Status API, which leaks your device’s charge level and charging state — used in some fingerprinting vectors.

The Complete user.js Template

Instead of changing each preference manually, you can drop a user.js file into your Firefox profile folder. Firefox reads this file on every startup and applies the preferences automatically. Here’s the complete template with every tweak from above:

// ============================================================
// Firefox Privacy Hardening — user.js
// Drop this file into your Firefox profile directory.
// Find it: about:support → Profile Folder → Open Folder
// ============================================================

// --- TELEMETRY ---
user_pref("toolkit.telemetry.enabled", false);
user_pref("toolkit.telemetry.unified", false);
user_pref("toolkit.telemetry.archive.enabled", false);
user_pref("toolkit.telemetry.server", "");
user_pref("datareporting.healthreport.uploadEnabled", false);
user_pref("datareporting.policy.dataSubmissionEnabled", false);

// --- WEBRTC LEAK PREVENTION ---
user_pref("media.peerconnection.enabled", false);
user_pref("media.peerconnection.ice.default_address_only", true);
user_pref("media.peerconnection.ice.no_host", true);
user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true);

// --- FINGERPRINTING RESISTANCE ---
user_pref("privacy.resistFingerprinting", true);
user_pref("privacy.resistFingerprinting.letterboxing", true);
user_pref("webgl.disabled", true);
user_pref("privacy.trackingprotection.fingerprinting.enabled", true);
user_pref("browser.display.use_document_fonts", 0);

// --- DNS PRIVACY ---
user_pref("network.trr.mode", 3);
user_pref("network.trr.uri", "https://dns.quad9.net/dns-query");
user_pref("network.dns.disablePrefetch", true);
user_pref("network.dns.disableIPv6", true);

// --- REFERRER POLICY ---
user_pref("network.http.referer.XOriginPolicy", 2);
user_pref("network.http.referer.XOriginTrimmingPolicy", 2);
user_pref("network.http.sendRefererHeader", 1);

// --- TRACKING PROTECTION ---
user_pref("privacy.trackingprotection.enabled", true);
user_pref("privacy.trackingprotection.socialtracking.enabled", true);
user_pref("privacy.trackingprotection.cryptomining.enabled", true);
user_pref("network.cookie.cookieBehavior", 5);
user_pref("privacy.partition.network_state", true);

// --- EXPERIMENTS AND STUDIES ---
user_pref("app.shield.optoutstudies.enabled", false);
user_pref("app.normandy.enabled", false);
user_pref("app.normandy.api_url", "");
user_pref("messaging-system.rsexperimentloader.enabled", false);

// --- CRASH REPORTS ---
user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false);
user_pref("browser.tabs.crashReporting.sendReport", false);
user_pref("breakpad.reportURL", "");

// --- NETWORK AND PREFETCH ---
user_pref("network.prefetch-next", false);
user_pref("network.predictor.enabled", false);
user_pref("browser.urlbar.speculativeConnect.enabled", false);
user_pref("dom.battery.enabled", false);

How to Deploy the user.js File

1. Open Firefox and type about:support in the address bar.
2. Find the Profile Folder row and click Open Folder.
3. Save the template above as user.js (plain text, not user.js.txt) in that folder.
4. Close Firefox completely — not just the window, quit the process.
5. Relaunch Firefox. The preferences are now applied.

Important: user.js is read on every startup. If you change a preference via about:config during a session, the user.js value will overwrite it on the next launch. To stop enforcing a preference, remove its line from the file.

Testing Your Changes

After applying tweaks — whether manually or via user.js — verify them with these free testing tools:

1. WebRTC Leak Test

Visit https://browserleaks.com/webrtc. If WebRTC is disabled, you’ll see “WebRTC: false.” If you kept it enabled with the ICE restrictions, verify no local IP appears in the candidate list.

2. DNS Leak Test

Go to https://dnsleaktest.com and run the Extended test. All results should point to your chosen DoH resolver (Quad9, Cloudflare, etc.) — never your ISP’s DNS servers.

3. Fingerprint Uniqueness

Check https://coveryourtracks.eff.org (EFF’s Cover Your Tracks). With RFP enabled, you should see “Your browser has a non-unique fingerprint” — that’s the goal. A unique fingerprint means something is still leaking identifiable information.

4. General Privacy Audit

Visit https://privacytests.org for a comprehensive comparison of browser privacy features. Run the test in your hardened Firefox and compare results against defaults.

5. Referrer Check

Navigate to any external link from a website and inspect the request headers in DevTools (F12 → Network tab). The Referer header should be absent for cross-origin requests or trimmed to the origin only.

What Breaks — and How to Fix It

Hardening Firefox this aggressively will break some sites. Here’s what to expect and how to handle it:

Symptom	Cause	Fix
Video calls don’t work (Meet, Zoom web, Jitsi)	media.peerconnection.enabled = false	Re-enable WebRTC (true) and rely on the three ICE restrictions instead.
Some sites show wrong time/timezone	privacy.resistFingerprinting forces UTC	Accept the trade-off, or disable RFP for specific sites using a container extension.
Fonts look generic or broken layouts	browser.display.use_document_fonts = 0	Set to 1 if visual fidelity matters more than font fingerprinting.
CAPTCHA loops or “unusual activity” blocks	Multiple anti-fingerprinting flags make your traffic pattern unusual	Often caused by combining a VPN with RFP. Try switching VPN server or using a residential proxy.
Login redirects fail	Strict referrer policy	Temporarily set XOriginPolicy to 1 for the session.
3D content or WebGL-based apps won’t load	webgl.disabled = true	Re-enable WebGL if you need the content. Use webgl.enable-debug-renderer-info = false to still hide GPU info.

When Firefox Hardening Isn’t Enough

All the firefox privacy about config tweaks above apply to a single browser profile. That’s fine for personal browsing — but it falls apart fast when you need to manage multiple accounts.

Here’s the fundamental problem: Firefox’s about:config is profile-global. Every tab, every window shares the same fingerprint, cookies, and network settings. If you log into two accounts on the same platform — even in separate tabs — the site sees identical browser characteristics tied to the same session. Cross-account linking becomes trivial.

The Multi-Account Challenge

• Shared fingerprint: RFP normalizes your fingerprint, but it normalizes it to the same fingerprint across every tab. Two accounts showing identical RFP-spoofed values from the same IP is a red flag.
• Cookie bleed: Total Cookie Protection isolates cookies per domain, but it doesn’t isolate them per identity. Both accounts on the same domain share the same cookie jar.
• Timezone lock: RFP forces UTC for everything — you can’t assign one account to New York time and another to London.
• Proxy per-tab: Firefox supports one proxy configuration globally. You can’t route different tabs through different exit IPs.

How Send.win Helps With Firefox Privacy About Config Tweaks

Send.win is an antidetect browser built for exactly this kind of work — every profile is a clean, isolated identity:

• Isolated profiles – unique fingerprint, separate cookies and storage per profile
• Stealth engine – canvas, WebGL, fonts, and audio spoofed at the engine level
• Desktop app + cloud sessions – native app for Windows, macOS, and Linux, or run profiles in the cloud with no install
• Built-in residential proxies – with automatic timezone, locale, and WebRTC matching
• Team features – share logged-in profiles with teammates without sharing passwords

Try the instant cloud browser demo — no install, no signup — or download the desktop app. The 30-day free trial needs no credit card, and paid plans start at $6.99/month billed annually (see pricing).

Firefox Containers (Multi-Account Containers extension) partially address cookie separation but don’t touch fingerprint, proxy routing, or timezone assignment per container. For serious account isolation, you need per-profile control over every variable sites use to link sessions.

How Send.win Solves This

Send.win’s Sendwin Browser creates completely isolated browser profiles — each with its own fingerprint, cookies, proxy, timezone, language, and screen resolution. Unlike about:config tweaks applied across a single Firefox profile, each Sendwin Browser profile operates as if it’s a different device on a different network.

• Per-profile fingerprints: Canvas hash, WebGL renderer, audio context, font list — all independently configurable per profile, not just normalized to one shared value.
• Per-profile proxies: Assign a different residential or datacenter proxy to each profile. Each account exits through its own IP.
• Per-profile timezones: Match the timezone to the proxy’s geographic location automatically — no UTC-everywhere trade-off.
• Complete cookie isolation: Each profile maintains its own cookie store, localStorage, and IndexedDB — not just per-domain partitioning, but per-identity separation.

The Sendwin Browser desktop app runs on Windows, macOS, and Linux. Pro plans start at $6.99/month (annual) with 150 profiles and Automation API access for Selenium, Puppeteer, and Playwright. For teams, cloud browser sessions let you run profiles without installing anything locally.

Frequently Asked Questions

Does changing about:config preferences void Firefox support or warranty?

No. There is no warranty to void — Firefox is open-source software. Mozilla explicitly provides about:config as an advanced configuration interface. Changing preferences won’t prevent you from receiving security updates or using Firefox normally. You can always reset any preference to its default by right-clicking it and selecting Reset.

Will these tweaks slow down Firefox?

Most tweaks have zero performance impact — they simply disable network calls (telemetry, prefetching) or change how headers are sent. Disabling WebGL may actually improve memory usage. The only setting with a noticeable effect is privacy.resistFingerprinting, which can add minor layout overhead due to letterboxing and canvas randomization, but it’s imperceptible on modern hardware.

What’s the difference between user.js and about:config changes?

Changes made in about:config are stored in prefs.js in your profile folder and persist across sessions. A user.js file overrides prefs.js on every startup — it’s declarative and portable. You can copy one user.js file across machines to replicate your setup instantly. The downside is that about:config changes made during a session get overwritten on restart if the user.js specifies the same key.

Should I use these tweaks together with the Arkenfox user.js project?

Arkenfox is a community-maintained user.js template with hundreds of preferences and detailed documentation. The tweaks in this article overlap with a subset of Arkenfox’s settings. If you want comprehensive, actively-maintained hardening, Arkenfox is the more thorough option — but it’s also more aggressive and breaks more sites. The template above represents a practical balance between privacy and usability.

Do I still need a VPN if I apply all these tweaks?

Yes, for IP-level privacy. About:config tweaks address browser-level data leaks — telemetry, fingerprinting, referrer headers. They don’t hide your IP address from websites. A VPN or proxy masks your IP; about:config tweaks mask everything else. Use both for comprehensive protection.

Can I apply different about:config settings per Firefox profile?

Yes — each Firefox profile has its own prefs.js and can have its own user.js. Create separate profiles via about:profiles and place different user.js files in each profile folder. However, Firefox profiles don’t support per-profile proxy assignment, timezone spoofing, or independent fingerprint parameters — they share the same browser binary and many system-level properties.

Will privacy.resistFingerprinting make websites think I’m using a different browser?

RFP doesn’t change your User-Agent string — sites still see Firefox. What it does is normalize the fingerprint signals (canvas, fonts, screen size, timezone) so you blend in with other RFP users. The goal isn’t to look like Chrome; it’s to look like every other Firefox user with RFP enabled, making individual identification harder.

How often should I update my user.js file?

Review it whenever Firefox releases a major version (roughly every 4 weeks). New versions may introduce new telemetry preferences, deprecate old ones, or change default behaviors. If you’re tracking Arkenfox, their releases align with Firefox versions. For the template in this article, check back periodically — preferences like network.cookie.cookieBehavior values have changed meaning across versions.

Related Products & Resources

• Download
• Pricing
• Proxy Browser Setup Browser Isolation Guide 2026
• Web Browsing Security Privacy Security Guide 2026
• Firefox Containers Complete Guide 2026