Browser hardening in 20 minutes
The settings worth changing in Chrome, Edge, Firefox, Safari and Brave, which content blocker to use now that extension rules have changed, and how to keep extensions and profiles tidy.
Why the browser matters
Your browser is where you sign in to email, bank and shop, so it is also where most phishing pages, fake downloads and malicious ads try to reach you. A few settings changes, a good content blocker and a tidy set of extensions remove a lot of risk. For everyday habits, see safe browsing.
Settings that apply everywhere
- Automatic updates: browsers patch serious security holes every few weeks. Restart when prompted.
- HTTPS-only or "always use secure connections": warns you before loading an unencrypted site.
- Safe browsing protection: keep the built-in malicious-site warnings on.
- Site permissions: set camera, microphone, location and notifications to "ask", and review which sites you have already allowed. Notification spam is a common scam channel.
- Let your password manager fill passwords, and keep the browser's own password saving off if you use a separate manager, to avoid duplicates.
Settings per browser
| Browser | Where to look | Worth turning on |
|---|---|---|
| Chrome | Settings, Privacy and security | Enhanced protection (Safe Browsing), Always use secure connections, Safety Check |
| Edge | Settings, Privacy, search and services | Microsoft Defender SmartScreen, Block potentially unwanted apps, Tracking prevention set to Balanced or Strict |
| Firefox | Settings, Privacy and Security | Enhanced Tracking Protection (Strict if sites still work), HTTPS-Only Mode, Block dangerous downloads |
| Safari | Settings, Security and Privacy tabs | Warn when visiting a fraudulent website, Prevent cross-site tracking, Hide IP address from trackers |
| Brave | Settings, Shields and Privacy | Shields on by default, Upgrade connections to HTTPS, Block fingerprinting |
Menu names shift slightly between versions. Each browser's built-in search box in Settings will find the option quickly.
Content blockers and the uBlock Origin change
Malicious ads, often called malvertising, can push fake updates and scam pages even on legitimate websites. A content blocker removes most of them and makes pages faster.
uBlock Origin is a free, open-source blocker widely trusted by security professionals. Chrome moved to a new extension system called Manifest V3, which limits what blockers can do, and the classic uBlock Origin no longer runs in current Chrome. Its developer offers uBlock Origin Lite, built for the new system.
| Browser | Recommended blocker |
|---|---|
| Firefox (desktop and Android) | uBlock Origin (full version still supported) |
| Chrome and Edge | uBlock Origin Lite |
| Safari | uBlock Origin Lite or another App Store content blocker |
| Brave | Built-in Shields; extra extensions usually unnecessary |
Install blockers only from the official browser store, and check the developer name. Fake "ad blockers" with copied names have been used to spread adware and steal data.
Extension hygiene
Extensions can read and change the pages you visit, which can include passwords and banking pages. Popular extensions have been sold to new owners who pushed malicious updates.
- Keep only what you use. Most people need a password manager, a content blocker and little else.
- Check permissions. Be wary of any extension that wants to "read and change all your data on all websites" without a clear reason.
- Prefer well-known publishers with many users and recent updates.
- Review every few months and remove anything you do not recognize.
- Never install an extension because a pop-up or video player told you to.
Use profiles to separate risk
Browser profiles give you separate cookies, history, extensions and logins in one browser.
- A banking profile with no extensions except your password manager, used only for financial sites.
- A work profile linked to your work account, kept apart from personal browsing.
- A guest or private window for one-off sites or a borrowed computer.
Private or incognito mode does not hide you from websites, your employer or your internet provider. It only stops your own browser from saving history and cookies after you close the window.