Browser Security Settings That Actually Matter (Chrome, Firefox, Safari, Edge)

The browser settings that actually matter are the ones controlling tracking protection, HTTPS enforcement, encrypted DNS, third-party cookies, phishing and malware warnings, and extension site access. Each of Chrome, Firefox, Safari and Edge exposes those in a slightly different place, and this guide gives the exact path for every one, what it protects against and the sites it may break.

How to think about a settings page

A modern browser's settings page has hundreds of items. Most of them are either already secure by default, purely cosmetic, or about sync and appearance. The honest way to prioritise is to ask, for each setting, what attack or leak it stops. Under that test the list shrinks to a handful per browser: the ones that stop a network attacker rewriting a page, stop a third party recognising you across sites, stop a hostname lookup being observed, stop a known-bad page loading, and limit what an extension can read.

The recommendations below assume you want a browser that is secure and private by default with the smallest number of sites broken. Where a setting has a real cost, it is stated, because a setting you turn off again in frustration protects nobody. If you want to verify that a change took effect rather than trust the toggle, the browser check reports the observable result for cookies, WebRTC, fingerprint and policy enforcement.

Firefox

Firefox has the most complete set of user-facing privacy controls of the four, and most of them are in one place: Settings > Privacy & Security.

1. Enhanced Tracking Protection: Strict. Standard already isolates third-party cookies with Total Cookie Protection. Strict adds blocking of known trackers in all windows, cryptominers, known fingerprinters and, importantly, turns on fingerprinting protection that alters the canvas and a few other outputs. Cost: some embedded logins and payment widgets break; Firefox shows a shield icon you can click to relax protection per site.
2. HTTPS-Only Mode: Enable in all windows. Firefox will refuse to load a page over plain HTTP without asking you first. Cost: a small number of legacy sites need a one-click exception. The full reasoning is in HTTPS-Only Mode explained.
3. DNS over HTTPS: Increased or Max Protection. Default Protection lets Firefox fall back to plain DNS on networks that object; Max Protection refuses to. Pick a provider you are happy to trust with your lookups. The trade-offs are in secure DNS explained.
4. Passwords: Use a Primary Password. Without it, saved logins are stored in a way any process running as your user can decrypt. With it, the store is encrypted under a password only you know.
5. Permissions: review Location, Camera, Microphone, Notifications. Tick Block new requests for notifications unless you rely on them; notification permission is the most abused prompt on the web.
6. Advanced, only if you accept breakage: in about:config, privacy.resistFingerprinting set to true applies Tor Browser's uniform fingerprint, and media.peerconnection.enabled set to false disables WebRTC entirely.

Chrome

Chrome's security settings are concentrated at chrome://settings/security; its privacy settings are spread across a few pages.

1. Safe Browsing: Standard or Enhanced. Standard checks URLs against a locally cached list of known-bad sites and downloads. Enhanced sends URLs to Google in real time and catches newer pages at the cost of sharing more of your browsing with Google. Either is far better than No protection.
2. Always use secure connections: On. This is Chrome's HTTPS-First Mode. Recent versions distinguish between warning on all sites and warning only on public sites; the latter avoids prompts for printers and routers on your local network while still refusing plain HTTP on the internet. Google has said it intends to make the public-sites warning the default.
3. Use secure DNS: On. With your current service provider upgrades to DNS over HTTPS only if your resolver supports it; choosing a named provider guarantees encryption.
4. Third-party cookies: Block, at chrome://settings/cookies. Chrome abandoned its plan to remove third-party cookies, so in normal windows they are allowed unless you change this. Incognito blocks them by default. Cost: some embedded content asks for permission.
5. Ad privacy: Off, at chrome://settings/adPrivacy. Ad topics, site-suggested ads and ad measurement are Chrome's replacement signals for advertisers. Turning them off costs nothing.
6. Site settings: Notifications and Location to Ask or Block. At chrome://settings/content. Chrome also lets you disable the V8 optimiser per site, which removes a class of JIT exploits for sites you distrust; it is a niche control but a real one.
7. Extensions: site access. At chrome://extensions, open each extension's Details and set Site access to On click or On specific sites wherever the extension does not genuinely need every page.

Safari

Safari's controls are in Safari > Settings on macOS and in Settings > Apps > Safari on iOS. Safari makes good choices by default; the changes below tighten the two areas where it still asks you.

1. Privacy: Prevent cross-site tracking. On by default. This is Intelligent Tracking Prevention, which blocks all third-party cookies and limits what first-party scripts can store. Leave it on.
2. Privacy: Hide IP address from Trackers, or from Trackers and Websites if you subscribe to iCloud+ and Private Relay. This routes requests to known trackers through Apple's relay so they see a regional address rather than yours.
3. Advanced: Use advanced tracking and fingerprinting protection, in all browsing. The default applies only in Private Browsing. Switching to all browsing removes tracking parameters from links and reduces the entropy scripts can read. Cost: occasional layout differences on sites that fingerprint aggressively.
4. Security: Warn when visiting a fraudulent website. On by default; confirm it.
5. General: Open "safe" files after downloading, Off. This is the one Safari default worth reversing. It auto-opens archives, images and PDFs, which is exactly the behaviour a malicious download hopes for.
6. Websites: Notifications and Location. Set Deny for notifications from all sites unless you need them.

Safari has no HTTPS-only switch; it upgrades to HTTPS automatically where it knows a site supports it. It also has no encrypted-DNS setting because it uses the system resolver; encrypted DNS on Apple platforms is configured at the OS level with a DNS profile or app.

Edge

Edge shares Chrome's engine and adds a few controls of its own, almost all at edge://settings/privacy.

1. Tracking prevention: Strict. Balanced blocks trackers from sites you have not visited; Strict blocks most trackers everywhere and, in practice, blocks third-party cookies from tracking domains. Cost: more embedded content asks for exceptions; the shield icon in the address bar relaxes it per site.
2. Enhance your security on the web: Balanced or Strict. This disables the JavaScript just-in-time compiler on unfamiliar sites, removing the most common class of browser exploits at a small speed cost on heavy web apps. It is a genuinely useful control that has no direct equivalent in Chrome's UI.
3. Microsoft Defender SmartScreen: On. Edge's equivalent of Safe Browsing for URLs and downloads. Also keep Block potentially unwanted apps on.
4. Automatically switch to more secure connections with Automatic HTTPS: On, with Always switch from HTTP to HTTPS if you are willing to click through the occasional legacy site.
5. Use secure DNS: On, with a chosen provider.
6. Extensions: site access at edge://extensions, exactly as in Chrome.

The same settings side by side

What to leave alone

Some settings are frequently recommended and rarely worth it. Sending Do Not Track changes nothing, because sites are not obliged to honour it; sending Global Privacy Control is worth enabling where offered because some jurisdictions give it legal force, and our scanner reports both as Do Not Track and Global Privacy Control so you can see what is actually being sent. Disabling JavaScript globally, disabling all cookies, or clearing everything on exit tend to be reverted within a week; the targeted version, automatically deleting cookies except for chosen sites, is a better fit and is covered in cookies explained.

Finally, no setting compensates for an old browser. Check the About page before you check anything else, and then work through the rest of the browser security hub.