{ "user": { "Safe Browsing": { "description": "Google Safe Browsing warns users about dangerous websites and downloads.", "preferences": { "browser.safebrowsing.downloads.remote.enabled": { "value": false, "title": "Disable remote verification for downloads", "description": "Prevents sending file info (name, origin, hash) to Google for executable verification", "requireUserOptIn": true } } }, "Telemetry": { "description": "Disable telemetry, studies, and related data collection", "preferences": { "app.shield.optoutstudies.enabled": { "value": false, "title": "Disable Shield studies", "locked": true, "enforceOnStartup": true }, "app.normandy.enabled": { "value": false, "title": "Disable Normandy", "locked": true }, "app.normandy.api_url": { "value": "", "title": "Clear Normandy API URL", "locked": true }, "app.normandy.run_interval_seconds": { "value": 0, "title": "Disable experiment fetch scheduling", "locked": true, "enforceOnStartup": true }, "datareporting.policy.dataSubmissionEnabled": { "value": false, "title": "Disable data submission", "locked": true, "enforceOnStartup": true }, "datareporting.healthreport.uploadEnabled": { "value": false, "title": "Disable health report upload", "locked": true, "enforceOnStartup": true }, "datareporting.usage.uploadEnabled": { "value": false, "title": "Disable daily usage ping", "description": "Daily activity ping", "locked": true, "enforceOnStartup": true }, "datareporting.dau.cachedUsageProfileID": { "value": "00000000-0000-0000-0000-000000000000", "title": "Spoof daily usage profile ID", "description": "Replaces the stored DAU profile identifier with a fixed dummy value", "enforceOnStartup": true }, "datareporting.dau.cachedUsageProfileGroupID": { "value": "00000000-0000-0000-0000-000000000000", "title": "Spoof daily usage profile group ID", "description": "Replaces the stored DAU profile group identifier with a fixed dummy value", "enforceOnStartup": true }, "toolkit.telemetry.enabled": { "value": false, "title": "Disable telemetry", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.unified": { "value": false, "title": "Disable unified telemetry", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.archive.enabled": { "value": false, "title": "Disable telemetry archive", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.server": { "value": "data;", "title": "Block telemetry endpoint", "description": "Uses the data: URI scheme so accidental telemetry posts have no real network destination", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.cachedClientID": { "value": "00000000-0000-0000-0000-000000000000", "title": "Spoof telemetry client ID", "description": "Replaces the stored client ID with a fixed dummy value" }, "toolkit.telemetry.initDelay": { "value": 2147483647, "title": "Delay telemetry initialization indefinitely", "locked": true, "enforceOnStartup": true }, "telemetry.fog.test.localhost_port": { "value": 70000, "title": "Force telemetry to invalid port", "description": "Fallback Glean traffic is redirected to an invalid localhost port", "locked": true, "enforceOnStartup": true }, "telemetry.fog.artifact_build": { "value": false, "title": "Disable artifact-build telemetry registration", "description": "Prevents JOG-style runtime metric registration in artifact-style configurations", "locked": true, "enforceOnStartup": true }, "telemetry.fog.test.activity_limit": { "value": -1, "title": "Disable activity-based Glean submissions", "locked": true, "enforceOnStartup": true }, "telemetry.fog.test.inactivity_limit": { "value": -1, "title": "Disable inactivity-based Glean submissions", "locked": true, "enforceOnStartup": true }, "telemetry.fog.init_on_shutdown": { "value": false, "title": "Prevent Glean initialization during shutdown", "locked": true, "enforceOnStartup": true }, "telemetry.glean.internal.finalInactive": { "value": false, "title": "Disable final inactive Glean ping", "locked": true, "enforceOnStartup": true }, "nimbus.profilesdatastoreservice.enabled": { "value": false, "title": "Disable Nimbus experiment database", "locked": true, "enforceOnStartup": true }, "nimbus.profilesdatastoreservice.read.enabled": { "value": false, "title": "Block reading experiment data", "locked": true, "enforceOnStartup": true }, "nimbus.profilesdatastoreservice.sync.enabled": { "value": false, "title": "Block syncing experiment data", "locked": true, "enforceOnStartup": true }, "nimbus.rollouts.enabled": { "value": false, "title": "Disable Nimbus rollouts", "locked": true, "enforceOnStartup": true }, "nimbus.telemetry.targetingContextEnabled": { "value": false, "title": "Disable Nimbus targeting-context telemetry", "locked": true, "enforceOnStartup": true }, "captchadetection.actor.enabled": { "value": false, "title": "Disable CAPTCHA detection pings", "description": "Prevents CAPTCHA detection measurements from being collected", "locked": true, "enforceOnStartup": true }, "captchadetection.hasUnsubmittedData": { "value": false, "title": "Clear pending CAPTCHA detection data", "locked": true, "enforceOnStartup": true }, "captchadetection.loglevel": { "value": "Off", "title": "Disable CAPTCHA detection logging", "enforceOnStartup": true }, "extensions.dataCollectionPermissions.enabled": { "value": false, "title": "Disable extension data collection", "locked": true }, "extensions.gleanPingAddons.daily.interval": { "value": 2147483647, "title": "Disable add-on daily Glean scheduler", "locked": true, "enforceOnStartup": true }, "extensions.gleanPingAddons.updated.delay": { "value": 2147483647, "title": "Disable add-on update Glean delay", "locked": true, "enforceOnStartup": true }, "extensions.gleanPingAddons.updated.idleTimeout": { "value": 2147483647, "title": "Disable add-on update idle telemetry", "locked": true, "enforceOnStartup": true }, "extensions.gleanPingAddons.updated.testing": { "value": false, "title": "Disable add-on update testing telemetry", "locked": true, "enforceOnStartup": true }, "extensions.telemetry.EnvironmentAddonBuilder": { "value": false, "title": "Disable add-on environment telemetry builder", "locked": true, "enforceOnStartup": true }, "network.trr.confirmation_telemetry_enabled": { "value": false, "title": "Disable DoH confirmation telemetry", "enforceOnStartup": true }, "network.traffic_analyzer.enabled": { "value": false, "title": "Disable network traffic analyzer", "description": "Prevents the internal traffic analyzer from collecting extra network diagnostics", "locked": true, "enforceOnStartup": true }, "privacy.trackingprotection.emailtracking.data_collection.enabled": { "value": false, "title": "Disable email tracking protection telemetry", "locked": true, "enforceOnStartup": true }, "browser.safebrowsing.features.emailtracking.datacollection.update": { "value": false, "title": "Disable Safe Browsing email-tracking data updates", "locked": true, "enforceOnStartup": true }, "urlclassifier.features.emailtracking.datacollection.allowlistTables": { "value": "", "title": "Clear email-tracking telemetry allowlist tables", "locked": true, "enforceOnStartup": true }, "urlclassifier.features.emailtracking.datacollection.blocklistTables": { "value": "", "title": "Clear email-tracking telemetry blocklist tables", "locked": true, "enforceOnStartup": true }, "dom.security.unexpected_system_load_telemetry_enabled": { "value": false, "title": "Disable unexpected system load telemetry", "locked": true, "enforceOnStartup": true }, "telemetry.number_of_site_origin.min_interval": { "value": 2147483647, "title": "Disable site-origin telemetry scheduling", "locked": true, "enforceOnStartup": true }, "toolkit.coverage.enabled": { "value": false, "title": "Disable coverage ping", "locked": true, "enforceOnStartup": true }, "toolkit.coverage.endpoint.base": { "value": "", "title": "Clear coverage endpoint", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.bhrPing.enabled": { "value": false, "title": "Disable background hang report ping", "description": "Prevents background hang reports from being sent", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.cachedProfileGroupID": { "value": "decafdec-afde-cafd-ecaf-decafdecafde", "title": "Spoof telemetry profile group ID", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.collectInterval": { "value": 2147483647, "title": "Disable telemetry collection interval", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap_enabled": { "value": false, "title": "Disable Distributed Aggregation Protocol", "description": "Prevents DAP-based telemetry collection", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap.helper.hpke": { "value": "", "title": "Clear DAP helper HPKE config", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap.helper.url": { "value": "", "title": "Clear DAP helper URL", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap.leader.hpke": { "value": "", "title": "Clear DAP leader HPKE config", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap.leader.url": { "value": "", "title": "Clear DAP leader URL", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap.logLevel": { "value": "Off", "title": "Disable DAP logging", "enforceOnStartup": true }, "toolkit.telemetry.dap_task1_enabled": { "value": false, "title": "Disable DAP task 1", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap_task1_taskid": { "value": "", "title": "Clear DAP task 1 identifier", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap_visit_counting_enabled": { "value": false, "title": "Disable DAP visit counting", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.dap_visit_counting_experiment_list": { "value": "[]", "title": "Clear DAP visit-counting experiments", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.debugSlowSql": { "value": false, "title": "Disable slow SQL telemetry debugging", "enforceOnStartup": true }, "toolkit.telemetry.eventping.maximumFrequency": { "value": 2147483647, "title": "Disable event ping maximum frequency", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.eventping.minimumFrequency": { "value": 2147483647, "title": "Disable event ping minimum frequency", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.newProfilePing.enabled": { "value": false, "title": "Disable new profile ping", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.newProfilePing.delay": { "value": 2147483647, "title": "Disable new profile ping delay scheduling", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.updatePing.enabled": { "value": false, "title": "Disable update ping", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.firstShutdownPing.enabled": { "value": false, "title": "Disable first shutdown ping", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.healthping.enabled": { "value": false, "title": "Disable health ping", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.log.dump": { "value": false, "title": "Disable telemetry log dumping", "enforceOnStartup": true }, "toolkit.telemetry.log.level": { "value": "Fatal", "title": "Restrict telemetry logging to fatal level", "enforceOnStartup": true }, "toolkit.telemetry.minSubsessionLength": { "value": 2147483647, "title": "Disable subsession telemetry scheduling", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.overrideUpdateChannel": { "value": "release", "title": "Normalize telemetry update channel", "description": "Always reports the release channel to reduce telemetry variability", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.previousBuildID": { "value": "", "title": "Clear previous telemetry build ID", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.reportingpolicy.firstRun": { "value": false, "title": "Disable telemetry first-run reporting policy", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.scheduler.idleTickInterval": { "value": 2147483647, "title": "Disable telemetry idle tick scheduler", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.scheduler.tickInterval": { "value": 2147483647, "title": "Disable telemetry tick scheduler", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.send.overrideOfficialCheck": { "value": false, "title": "Disable telemetry official-build override", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.server_owner": { "value": "", "title": "Clear telemetry server owner", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.shutdownPingSender.backgroundtask.enabled": { "value": false, "title": "Disable background telemetry shutdown sender", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.shutdownPingSender.enabled": { "value": false, "title": "Disable telemetry shutdown sender", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.shutdownPingSender.enabledFirstSession": { "value": false, "title": "Disable telemetry first-session shutdown sender", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.testing.disableFuzzingDelay": { "value": false, "title": "Disable telemetry fuzzing-delay override", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.testing.overridePreRelease": { "value": false, "title": "Disable telemetry prerelease override", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.testing.overrideProductsCheck": { "value": false, "title": "Disable telemetry products-check override", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.testing.suppressPingsender": { "value": true, "title": "Suppress telemetry ping sender", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.translations.logLevel": { "value": "Off", "title": "Disable translations telemetry logging", "enforceOnStartup": true }, "toolkit.telemetry.untrustedModulesPing.frequency": { "value": 2147483647, "title": "Disable untrusted modules ping scheduling", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.user_characteristics_ping.current_version": { "value": 0, "title": "Reset user-characteristics ping version", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.user_characteristics_ping.last_version_sent": { "value": 0, "title": "Reset last sent user-characteristics version", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.user_characteristics_ping.logLevel": { "value": "Off", "title": "Disable user-characteristics ping logging", "enforceOnStartup": true }, "toolkit.telemetry.user_characteristics_ping.opt-out": { "value": true, "title": "Opt out of user-characteristics ping", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.user_characteristics_ping.send-once": { "value": false, "title": "Disable one-time user-characteristics ping", "locked": true, "enforceOnStartup": true }, "toolkit.telemetry.user_characteristics_ping.uuid": { "value": "", "title": "Clear user-characteristics ping UUID", "locked": true, "enforceOnStartup": true }, "telemetry.glean.internal.maxPingsPerMinute": { "value": 0, "title": "Block all Glean pings", "description": "Prevents Glean from sending any telemetry pings", "locked": true, "enforceOnStartup": true } } }, "Crash Reporting": { "description": "Disable crash uploads and suppress crash-report prompts", "preferences": { "breakpad.reportURL": { "value": "", "title": "Clear crash report URL", "locked": true, "enforceOnStartup": true }, "browser.crashReports.crashPull": { "value": false, "title": "Disable remote crash report requests", "description": "Prevents remote settings from requesting background-process crash reports", "locked": true, "enforceOnStartup": true }, "browser.crashReports.onDemand": { "value": false, "title": "Disable on-demand crash report requests", "locked": true, "enforceOnStartup": true }, "browser.crashReports.requestedNeverShowAgain": { "value": true, "title": "Never prompt for background crash reports", "locked": true, "enforceOnStartup": true }, "browser.tabs.crashReporting.sendReport": { "value": false, "title": "Disable crashed-tab report sending", "locked": true }, "browser.crashReports.unsubmittedCheck.autoSubmit2": { "value": false, "title": "Disable auto-submit of crash reports", "locked": true }, "toolkit.crashreporter.include_context_heap": { "value": false, "title": "Exclude heap context from crash reports", "locked": true, "enforceOnStartup": true } } }, "Block Implicit Outbound": { "description": "Control background or automatic network activity that was not explicitly user-initiated", "preferences": { "network.prefetch-next": { "value": false, "title": "Disable link prefetching", "enforceOnStartup": true }, "network.dns.disablePrefetch": { "value": true, "title": "Disable DNS prefetching", "enforceOnStartup": true }, "network.dns.disablePrefetchFromHTTPS": { "value": true, "title": "Disable HTTPS DNS prefetching" }, "network.predictor.enabled": { "value": false, "title": "Disable prefetching predictor", "locked": true, "enforceOnStartup": true }, "network.http.speculative-parallel-limit": { "value": 0, "title": "Disable speculative connections on link hover", "enforceOnStartup": true }, "network.preconnect": { "value": false, "title": "Disable automatic connections to third-party domains" }, "network.early-hints.enabled": { "value": false, "title": "Disable Early Hints", "description": "Prevents servers from sending early responses before the main response", "enforceOnStartup": true }, "network.early-hints.preconnect.enabled": { "value": false, "title": "Disable Early Hints preconnect", "description": "Prevents Early Hints from triggering preconnect operations", "enforceOnStartup": true }, "network.http.basic_http_auth.enabled": { "value": false, "title": "Disable Basic HTTP authentication", "description": "Basic auth sends credentials in plaintext; only use with HTTPS", "requireUserOptIn": true }, "browser.send_pings": { "value": false, "title": "Disable hyperlink auditing (ping tracking)", "enforceOnStartup": true }, "network.http.network_error_logging.enabled": { "value": false, "title": "Disable Network Error Logging (NEL)", "description": "NEL is used for analytics by design and can be used for fingerprinting" }, "security.csp.reporting.enabled": { "value": false, "title": "Disable CSP reporting", "description": "Prevents CSP violation reports from being sent to third-party servers" } } }, "DNS": { "description": "Harden DNS resolution and reduce proxy bypass risks", "preferences": { "network.dns.native_https_query": { "value": true, "title": "Enable native HTTPS DNS record lookups", "description": "Allows HTTPS DNS resource-record queries used during connection setup; separate from DNS over HTTPS", "enforceOnStartup": true }, "network.proxy.socks_remote_dns": { "value": true, "title": "Resolve DNS remotely when using SOCKS", "description": "For example with Tor, this keeps your local DNS resolver from seeing the destination hostname" }, "network.file.disable_unc_paths": { "value": true, "title": "Disable using UNC (Uniform Naming Convention) paths", "description": "Warning: Can break extensions for profiles on network shares", "requireUserOptIn": true }, "network.gio.supported-protocols": { "value": "", "title": "Disable GIO as a potential proxy bypass vector" }, "network.dns.localDomains": { "value": "250analytics.com,a.omappapi.com,activity-stream-icons.services.mozilla.com,ads.allizom.org,ads.mozilla.org,ads.nonprod.webservices.mozgcp.net,ads.prod.webservices.mozgcp.net,ads-img.mozilla.org,analytics.getpocket.com,analytics.google.com,analytics.withgoogle.com,anf1.fuzzing.mozilla.org,anonymco.com,api.divviup.org,asan-nightly-frontend-elb-1348905149.us-east-2.elb.amazonaws.com,braze.com,contile.services.mozilla.com,contile-images.services.mozilla.com,classify-client.nonprod.webservices.mozgcp.net,classify-client.prod.webservices.mozgcp.net,classify-client.services.mozilla.com,crash-reports.allizom.org,crash-reports.mozilla.com,crash-reports-xpsp2.mozilla.com,crash-stacks.mozilla.com,crash-stats.allizom.org,crash-stats.mozilla.com,crash-stats.mozilla.org,dap.services.mozilla.com,dap.nonprod.webservices.mozgcp.net,dap.prod.webservices.mozgcp.net,dap-09-3.api.divviup.org,data.mozilla.com,data-ingestion.prod.dataops.mozgcp.net,dataops.mozgcp.net,dataservices.mozgcp.net,debug-ping-preview.firebaseapp.com,discovery.addons.allizom.org,discovery.addons.mozilla.org,discovery.addons-dev.allizom.org,divviup.org,download-stats.mozilla.org,download-stats.r53-2.services.mozilla.com,experimenter.services.mozilla.com,experimenter.nonprod.webservices.mozgcp.net,experimenter.prod.webservices.mozgcp.net,fhr.data.mozilla.com,fhr.r53-2.services.mozilla.com,firefox-android-home-recommendations.getpocket.com,firefox-dns-perf-test.net,fuzzing.mozilla.org,google-analytics.com,google-analytics-cn.com,googleanalytics.com,googlesyndication.com,googlesyndication-cn.com,googletagmanager.com,googletagmanager-cn.com,googletagservices.com,googletagservices-cn.com,improving.duckduckgo.com,incoming.glean.example.com,incoming.telemetry.mozilla.org,incoming.thunderbird.net,incoming-telemetry.thunderbird.net,ingestion-edge.prod.dataops.mozgcp.net,location.services.mozilla.com,locprod1-elb-eu-west-1.prod.mozaws.net,locprod2-elb-us-west-2.prod.mozaws.net,metrics-content.duckduckgo.com,new-sentry.gitlab.net,nonprod.classify-client.nonprod.webservices.mozgcp.net,normandy.cdn.mozilla.net,normandy.nonprod.cloudops.mozgcp.net,normandy.prod.cloudops.mozgcp.net,normandy-cdn.services.mozilla.com,omappapi.com,pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com,prod.ads.prod.webservices.mozgcp.net,prod.classify-client.prod.webservices.mozgcp.net,prod.dap.prod.webservices.mozgcp.net,prod.data-ingestion.prod.dataops.mozgcp.net,prod.dataops.mozgcp.net,prod.experimenter.prod.webservices.mozgcp.net,prod.ingestion-edge.prod.dataops.mozgcp.net,prod.sentry.prod.cloudops.mozgcp.net,prod-classifyclient.normandy.prod.cloudops.mozgcp.net,profile.accounts.firefox.com,sdk.iad-05.braze.com,search.r53-2.services.mozilla.com,search.services.mozilla.com,self-repair.mozilla.org,self-repair.r53-2.services.mozilla.com,sentry.gitlab.net,sentry.io,sentry.nonprod.cloudops.mozgcp.net,sentry.prod.cloudops.mozgcp.net,sentry.prod.mozaws.net,sitereview.zscaler.com,snippets.allizom.org,snippets.cdn.mozilla.net,snippets.mozilla.com,snippets-prod.frankfurt.moz.works,snippets-prod.moz.works,snippets-prod.oregon-b.moz.works,snippets-stage.moz.works,snippets-stage.oregon-b.moz.works,snowplow.trx.gitlab.net,snowplowalb-1011729428.us-east-1.elb.amazonaws.com,snowplowprd.trx.gitlab.net,snowplowprdnlb-1490493263.us-east-2.elb.amazonaws.com,socorro.nonprod.webservices.mozgcp.net,socorro.prod.webservices.mozgcp.net,socorro-collector.services.mozilla.com,socorro-webapp-allizom.stage.mozaws.net,socorro-webapp.services.mozilla.com,spocs.getpocket.com,spocs.getpocket.dev,spocs.mozilla.net,ssl.google-analytics.com,ssl-google-analytics.l.google.com,stage.sentry.nonprod.cloudops.mozgcp.net,start.fedoraproject.org,start.thunderbird.net,start.ubuntu.com,start-stage.thunderbird.net,survey.mozilla.com,tagmanager.google.com,talkback.mozilla.org,talkback-public.mozilla.org,talkback-reports.mozilla.org,telemetry-coverage.mozilla.org,telemetry-coverage.r53-2.services.mozilla.com,telemetry-experiment.cdn.mozilla.net,telemetry-incoming.r53-2.services.mozilla.com,telemetry-incoming-a.r53-2.services.mozilla.com,telemetry-incoming-b.r53-2.services.mozilla.com,telemetry-prod-1054754349.us-east-1.elb.amazonaws.com,tiles-cdn.prod.ads.prod.webservices.mozgcp.net,updates.thunderbird.net,updates-stage.thunderbird.net,use-application-dns.net,vf.startpage.com,widgets.getpocket.com,www.250analytics.com,www.anonymco.com,www.google-analytics.com,www.google-analytics-cn.com,www.googleanalytics.com,www.googlesyndication.com,www.googlesyndication-cn.com,www.googletagmanager.com,www.googletagmanager-cn.com,www.googletagservices.com,www.googletagservices-cn.com,www.sentry.io,www-google-analytics.l.google.com,www-googletagmanager.l.google.com", "title": "Resolve tracking domains to localhost", "description": "Redirects known telemetry, analytics, and ad domains to localhost to prevent connections" }, "network.proxy.type": { "value": 0, "title": "Bypass system proxy configuration", "description": "Lets WebLibre control proxying instead of inheriting Android's system proxy settings" }, "network.ohttp.configURL": { "value": "", "title": "Disable OHTTP config URL", "description": "Prevents fetching Oblivious HTTP configuration for telemetry", "locked": true, "enforceOnStartup": true }, "network.ohttp.relayURL": { "value": "", "title": "Disable OHTTP relay URL", "description": "Prevents using Oblivious HTTP relay for telemetry", "locked": true, "enforceOnStartup": true }, "network.android_doh.autoselect_enabled": { "value": false, "title": "Disable Android DoH autoselect", "description": "Prevents Android from automatically selecting a DoH provider", "locked": true, "enforceOnStartup": true } } }, "Certificate Revocation": { "description": "Use CRLite instead of OCSP for certificate revocation checks", "preferences": { "security.OCSP.enabled": { "value": 0, "title": "Disable OCSP fetches", "description": "CRLite provides faster and more private certificate revocation checking than OCSP" }, "security.OCSP.require": { "value": false, "title": "Disable OCSP hard-fail", "enforceOnStartup": true }, "security.pki.crlite_mode": { "value": 2, "title": "Enforce CRLite revocation checks", "enforceOnStartup": true }, "security.remote_settings.crlite_filters.enabled": { "value": true, "title": "Enable CRLite filters", "enforceOnStartup": true }, "security.pki.certificate_transparency.mode": { "value": 2, "title": "Enforce Certificate Transparency (CT)", "description": "Rejects publicly trusted certificates that violate CT policy" }, "security.certerrors.mitm.auto_enable_enterprise_roots": { "value": false, "title": "Disable auto-enabling enterprise root certificates", "description": "Prevents Firefox from automatically trusting system-installed root certificates", "enforceOnStartup": true } } }, "Secure Connections": { "description": "Harden TLS, certificate validation, and HTTPS upgrade behavior", "preferences": { "security.ssl.require_safe_negotiation": { "value": true, "title": "Require safe negotiation", "description": "Blocks connections to servers that don't support RFC 5746 as they're potentially vulnerable to a MiTM attack." }, "security.tls.enable_0rtt_data": { "value": false, "title": "Disable TLS1.3 0-RTT (round-trip time)", "description": "This data is not forward secret, as it is encrypted solely under keys derived using the offered PSK. There are no guarantees of non-replay between connections." }, "security.cert_pinning.enforcement_level": { "value": 2, "title": "Enforce strict certificate pinning" }, "security.tls.enable_kyber": { "value": true, "title": "Enable Post-Quantum Kyber TLS" }, "network.http.http3.enable_kyber": { "value": true, "title": "Enable HTTP3 Post-Quantum Kyber TLS" }, "security.ssl.treat_unsafe_negotiation_as_broken": { "value": true, "title": "Display warning on the padlock for 'broken security'" }, "browser.xul.error_pages.expert_bad_cert": { "value": true, "title": "Show advanced certificate error details" }, "dom.security.https_first": { "value": true, "title": "Use HTTPS-First mode", "enforceOnStartup": true }, "security.mixed_content.upgrade_display_content": { "value": true, "title": "Upgrade mixed display content to HTTPS", "description": "Automatically upgrades insecure HTTP content to HTTPS when possible", "requireUserOptIn": true }, "network.http.http3.enable_0rtt": { "value": false, "title": "Disable HTTP/3 0-RTT", "description": "0-RTT data is not forward secret as it is encrypted solely under keys derived using the offered PSK. There are no guarantees of non-replay between connections." }, "security.ssl.disable_session_identifiers": { "value": true, "title": "Disable TLS session identifiers", "description": "Prevents TLS session resumption from session tickets for tracking purposes" } } }, "Privacy": { "description": "Reduce cross-site leakage and strengthen built-in tracking protections", "preferences": { "network.http.referer.XOriginPolicy": { "value": 2, "title": "Only send cross-origin referer if host matches" }, "network.http.referer.XOriginTrimmingPolicy": { "value": 2, "title": "Trim cross-origin referrers", "description": "Trims down referrers to just the scheme, hostname and port" }, "network.http.referer.disallowCrossSiteRelaxingDefault": { "value": true, "title": "Enforce strict cross-site referrer policy", "enforceOnStartup": true }, "network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation": { "value": true, "title": "Enforce strict referrer policy on top-level navigation", "enforceOnStartup": true }, "general.useragent.updates.enabled": { "value": false, "title": "Disable User-Agent string updates", "description": "Prevents the browser from automatically updating its User-Agent identifier" }, "dom.private-attribution.submission.enabled": { "value": false, "title": "Disable Privacy-Preserving Attribution", "description": "Mozilla's ad measurement API that allows privacy-preserving conversion tracking", "locked": true, "enforceOnStartup": true }, "privacy.trackingprotection.enabled": { "value": true, "title": "Enable Tracking Protection" }, "privacy.trackingprotection.pbmode.enabled": { "value": true, "title": "Enable Tracking Protection (Private browsing)" }, "privacy.trackingprotection.socialtracking.enabled": { "value": true, "title": "Enable Social Tracking Protection", "enforceOnStartup": true }, "privacy.trackingprotection.cryptomining.enabled": { "value": true, "title": "Enable Cryptomining Protection", "enforceOnStartup": true }, "privacy.trackingprotection.fingerprinting.enabled": { "value": true, "title": "Enable fingerprinting tracker protection", "enforceOnStartup": true }, "network.cookie.maxageCap": { "value": 15552000, "title": "Limit maximum cookie lifetime to 180 days" }, "dom.storage_access.auto_grants": { "value": false, "title": "Disable automatic storage access grants", "description": "Prevents websites from automatically gaining storage access through heuristics", "requireUserOptIn": true }, "privacy.restrict3rdpartystorage.heuristic.navigation": { "value": false, "title": "Disable navigation-based storage access heuristic", "requireUserOptIn": true }, "privacy.restrict3rdpartystorage.heuristic.redirect": { "value": false, "title": "Disable redirect-based storage access heuristic", "requireUserOptIn": true }, "privacy.restrict3rdpartystorage.heuristic.window_open": { "value": false, "title": "Disable window-open-based storage access heuristic", "requireUserOptIn": true }, "dom.security.framebusting_intervention.enabled": { "value": true, "title": "Block third-party redirects" } } }, "Resist Fingerprinting": { "description": "Enable stronger anti-fingerprinting defenses. Some sites may break, especially without the Privacy protections above.", "preferences": { "privacy.fingerprintingProtection": { "value": true, "title": "Enable fingerprinting protection", "enforceOnStartup": true }, "privacy.fingerprintingProtection.pbmode": { "value": true, "title": "Enable fingerprinting protection in Private Browsing", "enforceOnStartup": true }, "privacy.reduceTimerPrecision": { "value": true, "title": "Reduce timer precision", "enforceOnStartup": true }, "privacy.partition.network_state.ocsp_cache": { "value": true, "title": "Partition the OCSP cache", "enforceOnStartup": true }, "privacy.partition.network_state.ocsp_cache.pbmode": { "value": true, "title": "Partition the OCSP cache in Private Browsing", "enforceOnStartup": true }, "gfx.bundled-fonts.activate": { "value": 1, "title": "Prefer bundled fonts over system fonts" }, "privacy.resistFingerprinting.randomization.daily_reset.enabled": { "value": true, "title": "Reset fingerprinting randomization key daily", "description": "Resets the fingerprinting randomization key daily in addition to per-session", "enforceOnStartup": true }, "privacy.resistFingerprinting.randomization.daily_reset.private.enabled": { "value": true, "title": "Reset fingerprinting randomization key daily in Private Browsing", "enforceOnStartup": true }, "media.devices.enumerate.legacy.enabled": { "value": false, "title": "Disable legacy media device enumeration", "description": "Prevents enumeration of media devices which can be used for fingerprinting" } } }, "WebGL": { "description": "Keep WebGL available while spoofing identifying renderer details where possible", "preferences": { "webgl.disabled": { "value": false, "title": "Keep WebGL enabled", "locked": true }, "webgl.enable-renderer-query": { "value": false, "title": "Disable WebGL renderer debug queries" }, "webgl.override-unmasked-renderer": { "value": "Mozilla", "title": "Spoof WebGL renderer as Mozilla" }, "webgl.override-unmasked-vendor": { "value": "Mozilla", "title": "Spoof WebGL vendor as Mozilla" }, "webgl.sanitize-unmasked-renderer": { "value": false, "title": "Disable built-in WebGL renderer sanitization", "description": "The fixed vendor and renderer strings above are used instead" }, "webgl.disable-fail-if-major-performance-caveat": { "value": true, "title": "Ignore major-performance-caveat blocking", "description": "Avoids disabling WebGL on devices Gecko marks as slow or unstable", "enforceOnStartup": true } } }, "WebRTC": { "description": "Keep WebRTC available with IP-leak mitigations and stricter routing behavior", "preferences": { "media.peerconnection.enabled": { "value": true, "title": "Enable WebRTC", "description": "Required for voice calls, video calls, and similar realtime features" }, "media.peerconnection.ice.obfuscate_host_addresses": { "value": true, "title": "Obfuscate local IPs with mDNS" }, "media.peerconnection.ice.default_address_only": { "value": true, "title": "Limit ICE candidates to the default route" }, "media.peerconnection.ice.proxy_only_if_behind_proxy": { "value": true, "title": "Prefer proxy-compatible ICE when a proxy is set" }, "media.peerconnection.mtransport_process": { "value": true, "title": "Isolate WebRTC media transport in separate process", "enforceOnStartup": true }, "media.peerconnection.ice.no_host": { "value": true, "title": "Never expose host candidates", "description": "May break some video calls", "requireUserOptIn": true }, "media.peerconnection.ice.relay_only": { "value": true, "title": "Relay-only mode (no direct P2P)", "description": "Routes all traffic through relay servers, breaks direct peer-to-peer", "requireUserOptIn": true } } }, "Attack Surface Reduction": { "description": "Reduce attack surface by disabling potentially dangerous features", "preferences": { "pdfjs.enableScripting": { "value": false, "title": "Disable PDF.js scripting" }, "pdfjs.enableXfa": { "value": false, "title": "Disable PDF.js XFA forms", "description": "XFA forms in PDFs can execute code and have been vectors for exploits" }, "mathml.disabled": { "value": true, "title": "Disable MathML (Mathematical Markup Language)", "description": "MathML has been a source of browser exploits with limited legitimate use" }, "gfx.font_rendering.graphite.enabled": { "value": false, "title": "Disable Graphite font rendering", "description": "Graphite font rendering has had multiple security vulnerabilities" }, "javascript.options.ion": { "value": false, "title": "Disable IonMonkey JIT compiler", "description": "Severe performance impact - disables JS optimization", "requireUserOptIn": true }, "javascript.options.baselinejit": { "value": false, "title": "Disable Baseline JIT compiler", "description": "Severe performance impact - disables JS optimization", "requireUserOptIn": true }, "javascript.options.jit_trustedprincipals": { "value": false, "title": "Disable JIT for privileged code" }, "javascript.options.asmjs": { "value": false, "title": "Disable asm.js" }, "accessibility.force_disabled": { "value": 1, "title": "Disable accessibility service integration", "description": "Prevents other apps from accessing browser content via accessibility APIs, reducing attack surface" }, "gfx.font_rendering.opentype_svg.enabled": { "value": false, "title": "Disable SVG OpenType fonts", "requireUserOptIn": true }, "dom.postMessage.sharedArrayBuffer.withCOOP_COEP": { "value": false, "title": "Disable SAB even with COOP/COEP", "requireUserOptIn": true }, "dom.webshare.enabled": { "value": false, "title": "Disable Web Share API", "requireUserOptIn": true }, "dom.sitepermsaddon-provider.enabled": { "value": false, "title": "Disable site-specific permission add-ons" }, "permissions.default.midi": { "value": 2, "title": "Block WebMIDI", "requireUserOptIn": true }, "javascript.options.wasm_optimizingjit": { "value": false, "title": "Disable WebAssembly optimizing JIT", "description": "Disables WASM-Ion (BaldrMonkey) JIT while keeping WebAssembly functional" }, "javascript.options.native_regexp": { "value": false, "title": "Disable native regexp JIT", "description": "Disables irregexp JIT for regex evaluation, reducing attack surface from regex exploits" }, "javascript.options.jithints": { "value": false, "title": "Disable JIT hints optimization", "description": "Disables eager baseline hints to reduce JIT attack surface" } } }, "Extension Security": { "description": "Control extension behavior and prevent fingerprinting via extensions", "preferences": { "extensions.getAddons.cache.enabled": { "value": false, "title": "Disable add-on metadata cache updates", "description": "Reduces background refreshes of extension metadata" }, "extensions.postDownloadThirdPartyPrompt": { "value": false, "title": "Never bypass extension install prompts", "locked": true, "enforceOnStartup": true }, "extensions.webextensions.restrictedDomains": { "value": "", "title": "Remove restricted domain privileges" }, "extensions.quarantinedDomains.enabled": { "value": true, "title": "Enable quarantined domains for extensions", "enforceOnStartup": true }, "extensions.userContextIsolation.enabled": { "value": true, "title": "Enable container isolation for extensions", "description": "Allows extensions to be isolated per container, enabling per-container extension control" } } }, "Geolocation": { "description": "Configure geolocation and region services to protect privacy", "preferences": { "geo.provider.network.url": { "value": "https://api.beacondb.net/v1/geolocate", "title": "Use BeaconDB for network geolocation", "description": "Replaces Google's geolocation service with the privacy-respecting BeaconDB" }, "browser.region.network.url": { "value": "", "title": "Disable Mozilla GeoIP/Region Service", "description": "Prevents Firefox from monitoring the user's region/general location" } } }, "API Restrictions": { "description": "Disable privacy-invasive and fingerprintable APIs", "preferences": { "dom.battery.enabled": { "value": false, "title": "Disable Battery API", "description": "The Battery Status API can be used to fingerprint devices" }, "dom.reporting.enabled": { "value": false, "title": "Disable Reporting API", "enforceOnStartup": true }, "dom.events.testing.asyncClipboard": { "value": false, "title": "Disable async Clipboard API", "locked": true, "enforceOnStartup": true }, "dom.webgpu.enabled": { "value": false, "title": "Disable WebGPU" } } }, "Disk Avoidance": { "description": "Control what data to persist to disk", "preferences": { "browser.cache.disk.enable": { "value": false, "title": "Disable disk cache", "description": "Don't cache data to disk. Might impact performance negatively", "requireUserOptIn": true }, "browser.privatebrowsing.forceMediaMemoryCache": { "value": true, "title": "Keep media cache in memory for Private Browsing" }, "media.memory_cache_max_size": { "value": 65536, "title": "Increase the in-memory media cache size" }, "browser.sessionstore.privacy_level": { "value": 2, "title": "Disable storing extra session data", "description": "Extra session data such as form content, cookies and POST data" } } }, "PDFJS": { "description": "Control built-in PDF viewer behavior and document restrictions", "preferences": { "pdfjs.enableSignatureEditor": { "value": true, "title": "Enable PDF signature editor" }, "pdfjs.enablePermissions": { "value": false, "title": "Never allow documents to prevent copying text", "enforceOnStartup": true }, "pdfjs.externalLinkTarget": { "value": 2, "title": "Open PDF links in new tabs" }, "pdfjs.sidebarViewOnLoad": { "value": 2, "title": "Show sidebar by default when viewing PDFs" } } }, "Miscellaneous": { "description": "Miscellaneous hardening and usability preferences", "preferences": { "permissions.manager.defaultsUrl": { "value": "", "title": "Remove default special permissions for Mozilla domains" }, "network.IDN_show_punycode": { "value": true, "title": "Use Punycode in Internationalized Domain Names to eliminate possible spoofing", "description": "Prevents domain spoofing attacks using lookalike Unicode characters (e.g. xn--pypal-4ve.com vs paypal.com)" }, "layout.css.visited_links_enabled": { "value": false, "title": "Disable coloring of visited links", "requireUserOptIn": true }, "media.autoplay.default": { "value": 5, "title": "Block media autoplay by default", "description": "Blocks both audio and video autoplay" } } } } }