The fix, in one snippet
Rare fonts, unusual screen sizes, many extensions and
anti-fingerprinting hacks all make you MORE identifiable.
A stock browser in a large crowd is the goal.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
In JavaScript we collect a fixed set of signals: user agent and Client Hints, language list, screen size, colour depth and pixel ratio, timezone, installed fonts (measured by rendering text in about sixty candidate fonts and comparing widths), a canvas hash, WebGL vendor and renderer, an AudioContext output hash, CPU core count, device memory, touch support and the PDF viewer flag. Each value is hashed in the browser and the combined hash is compared against the anonymised set of fingerprints from previous Scan.now visits. We report an estimate of identifying information in bits, using the same idea as EFF's Cover Your Tracks (the rarer a value is in the sample, the more bits it carries), and whether the combination is unique in our sample.
Limits: our sample is smaller than a tracking network's and skewed toward security-conscious visitors, so "unique among Scan.now visitors" is an estimate, not a statement about the whole web. Raw values are not stored, only hashes.
Why it matters
A fingerprint is a stateless identifier. It survives clearing cookies and private windows, and it works on every site that embeds the same fingerprinting script. EFF's 2010 Panopticlick study by Peter Eckersley found roughly 84% of browsers in its sample had a unique fingerprint, and the signal set has grown since. A realistic scenario: you sign in to a shop, an unrelated news site embeds the same measurement script, and the two visits are joined into one profile with your name on it.
Unusual configurations stand out most: rare fonts, uncommon screen sizes, Linux desktops, custom browser builds and spoofing extensions that make the values inconsistent. Customising to be unusual makes you more recognisable, not less.
How to fix it
Aim to look common rather than special. Firefox: Enhanced Tracking Protection in Strict mode blocks known fingerprinting scripts, and privacy.resistFingerprinting in about:config standardises many values at the cost of some site breakage. Brave: randomises canvas, WebGL and audio output per site by default. Safari: limits font enumeration to the built-in set and offers Advanced Tracking and Fingerprinting Protection under Settings > Advanced. Chrome and Edge: have no built-in randomisation; a blocker such as Privacy Badger or uBlock Origin stops known fingerprinting scripts from loading. Tor Browser gives every user the same fingerprint, which is the strongest option.
Avoid user-agent spoofers and extensions that alter page content: both are detectable and add uniqueness. Related checks: canvas fingerprinting and WebGL exposure. Guides: browser fingerprinting explained and what private browsing does not hide.
Where this fits
Browser fingerprint uniqueness is check 6 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Browser enforces X-Frame-Options (medium), where your browser displayed a page inside a frame even though that page was served with X-Frame-Options: DENY, so the clickjacking protection sites rely on is not being enforced. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Browser fingerprint uniqueness closes one route in. Immediately below it: Third-party cookies allowed, where your browser accepts cookies set by third-party domains embedded in other sites, which is the basic mechanism of cross-site tracking; Browser defaults cookies to SameSite=Lax, where your browser sent a cookie that has no SameSite attribute on a cross-site request, so it does not apply the Lax default that limits cross-site request forgery; Canvas fingerprinting exposure, where your browser renders a hidden test image identically every time and lets scripts read the pixels back, so the result can serve as a stable tracking signal.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Browser fingerprint uniqueness (medium severity)
Scanner check id: fingerprint-uniquenessThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
7 min read · Updated Sep 02, 2026
Browser Fingerprinting Explained: How Sites Identify You Without Cookies
Browser fingerprinting combines dozens of small facts about your browser and device into an identifier that survives cookie deletion and...
Read the guide
7 min read · Updated Sep 15, 2026
What Private Browsing Does and Does Not Hide
Incognito and private windows delete local history, but they do not hide you from websites, your network or your fingerprint. This guide...
Read the guide