Your browser is secure if it is on the current release, enforces the web's security policies, sends little through WebRTC and fingerprinting, blocks third-party cookies, refuses plain HTTP, and runs only extensions whose permissions you have read. Each of those is testable in minutes, and this checklist gives you the test for every item along with what a failing result means.
Why "secure browser" needs a checklist, not a brand
People ask which browser is most secure as though the answer were a product name. It is not. An up-to-date Chrome with two audited extensions is far safer than a hardened Firefox that has not been restarted since March. Every major browser now ships a sandboxed, multi-process engine with site isolation, Safe Browsing or an equivalent, and automatic updates. The differences that matter are in configuration and habits, and those are yours to control.
The checklist below is ordered by how much each item changes your real exposure. Do the first three even if you do nothing else. Each item links to the check our browser check runs so you can confirm the result rather than trust that a setting took effect.
The checklist
- Is the browser current? Open the About page (
chrome://settings/help,edge://settings/help, Firefox Help > About Firefox, or Software Update on macOS and iOS for Safari). If it says an update is pending, relaunch now. An outdated engine is reported as browser version out of date, and it outranks everything else because a remote-code-execution bug ignores all other settings. Why updates are so urgent is covered in why browser updates matter. - Does it enforce security policies? A site can send
Content-Security-Policy,X-Frame-OptionsandX-Content-Type-Options: nosniff, but they only work if the browser obeys them. Mainstream browsers do; some in-app browsers, old WebViews and stripped-down forks do not. Our checks for CSP enforcement, X-Frame-Options enforcement and nosniff enforcement load a small test page and see whether the protection holds, the same approach BrowserAudit takes. - Does WebRTC reveal your address? If you use a VPN, this is the one that undoes it. Run the WebRTC leak test with the VPN on. A public address that differs from your VPN exit, or an IPv6 address the VPN is not tunnelling, is a fail and is reported as WebRTC IP address leak. The fix per browser is in the WebRTC guide.
- Are third-party cookies blocked or partitioned? Firefox and Safari do this by default; Chrome and Edge do not in normal windows. Chrome users:
chrome://settings/cookies, choose Block third-party cookies. Edge users:edge://settings/privacy, set tracking prevention to Strict or block third-party cookies under site permissions. The scanner confirms it as third-party cookies allowed. - How unique is your fingerprint? Note the uniqueness estimate from the scanner. A very high estimate on a desktop is normal and is not by itself a security problem, but it means cookie clearing buys you little privacy. The detail is in browser fingerprinting explained.
- Does it refuse plain HTTP? Turn on HTTPS-Only Mode in Firefox, Always use secure connections in Chrome, or Automatic HTTPS set to always in Edge. Safari upgrades opportunistically and has no strict switch. This closes the window in which a coffee-shop network can rewrite a page before the site's HSTS header has been seen.
- Is DNS encrypted? Check the Use secure DNS setting in Chrome and Edge, and the DNS over HTTPS level in Firefox. Without it, every hostname you resolve is visible to the local network and your ISP in plain text.
- Which extensions have all-sites access? Open the extensions page and, for each one, read the site access setting. Anything with access to all sites can read every page you view and every form you fill. Keep those to a minimum you actively trust, and change the rest to On click. Unknown packages can be checked with our extension analyzer; the reasoning is in are browser extensions safe.
- Is Safe Browsing or SmartScreen on? Chrome:
chrome://settings/security, at least Standard protection. Edge: Microsoft Defender SmartScreen underedge://settings/privacy. Firefox: Block dangerous and deceptive content under Privacy & Security. Safari: Warn when visiting a fraudulent website under Security. These stop a large share of drive-by download and phishing pages before they load. - Do you know what the password manager protects? A built-in manager is fine if the device is locked and, for Firefox, a primary password is set. A manager that fills only on the exact domain it saved is your strongest defence against lookalike phishing pages.
Reading the results
A scan is a list of findings with severities, and it is tempting to try to turn every line green. Resist that. Here is how we would triage a typical desktop result.
| Finding | Severity | What to do |
|---|---|---|
| Browser version out of date | High | Update and relaunch today. Nothing else on the list matters until this is fixed. |
| CSP not enforced | High | You are probably in an in-app browser or an unusual build. Open the link in your main browser instead. |
| WebRTC IP leak while on a VPN | High | Apply the per-browser fix, or accept that the VPN does not hide you from sites that use WebRTC. |
| Third-party cookies allowed | Medium | One setting change. Expect a small number of embedded widgets to ask you to allow them. |
| Fingerprint highly unique | Medium | Enable your browser's fingerprinting protection if it has one; otherwise treat it as information. |
| Full referrer sent cross-site | Low | Modern defaults send only the origin; if you see this, a setting or extension has changed the referrer policy. |
| Do Not Track / GPC not sent | Info / Low | Turn on Global Privacy Control where your browser offers it; DNT is largely ignored. |
Two of these deserve a comment. Referrer leakage looks trivial and is usually the sign of something else: an extension that rewrites headers, or a corporate proxy. And a unique fingerprint is a privacy fact rather than a vulnerability; you cannot be exploited through it, only recognised. Do not spend an afternoon on it before you have spent five minutes on the update.
Things that do not make a browser more secure
Several popular pieces of advice do nothing or make things worse, and they are worth naming so you can stop worrying about them.
- Installing a second antivirus that injects into the browser. Security products that hook into the browser process weaken the sandbox and have themselves been the source of remotely exploitable bugs. The browser's own sandbox plus the operating system's built-in protection is the stronger configuration.
- Disabling JavaScript everywhere. It removes a class of attacks and breaks most of the web; people then re-enable it per site until the exception list is longer than the block list. Selective blocking of third-party scripts is the version of this that survives contact with real use.
- Stacking privacy extensions. Three tracker blockers do not block three times as much. Each one is a process with all-sites access, each adds a fingerprinting signal, and each is a supply chain you now depend on. One well-maintained blocker is enough.
- Spoofing the User-Agent. It does not hide the engine, it confuses sites, and it makes your fingerprint rarer.
A worked example: one laptop, ten minutes
To show what this looks like in practice, here is a real-shaped sequence for a Chrome user on macOS.
1. chrome://settings/help -> "Nearly up to date, relaunch" -> Relaunch
2. chrome://settings/cookies -> Block third-party cookies
3. chrome://settings/security -> Safe Browsing: Standard (already on)
-> Always use secure connections: ON
-> Use secure DNS: With current provider
4. chrome://extensions -> 7 installed; 4 with "On all sites"
-> 2 unused: remove
-> 2 kept: set Site access to "On click"
5. /browser-scanner -> version current, CSP/XFO/nosniff enforced,
3P cookies blocked, WebRTC: no leak
(no VPN), fingerprint: highly uniqueThe whole pass took under ten minutes. The remaining finding, fingerprint uniqueness, is a property of using Chrome on a Mac with a normal font set and is not something to chase further inside Chrome. That is a reasonable place to stop.
What a passing result does not prove
A clean scan is evidence about the browser, not about everything the browser touches. It says nothing about the operating system underneath, which has its own update cadence and its own exploitable bugs. It says nothing about the network you are on: a corporate proxy that terminates TLS, or a home router with a years-old firmware, sits outside anything a page can observe. And it says nothing about you, in the sense that the most reliable way into a well-configured browser is still to persuade its owner to type a password into a page that is not what it appears to be. A browser that passes every check will faithfully submit your credentials to a convincing fake.
The scan also cannot see extensions' behaviour, only their presence and permissions from your side of the extensions page. An extension with all-sites access that behaves well today can be sold tomorrow, and the browser will install the new version automatically. That is why the audit step above is a habit rather than a one-time task, and why the number of extensions matters as much as their quality.
Treat the checklist, then, as the floor: the set of things that are cheap to verify and expensive to get wrong. Above the floor, the protections that matter most are a current operating system, a password manager that fills only on the right domain, a second factor on the accounts you cannot afford to lose, and the habit of reading a URL before typing into the page it leads to. None of those show up in a browser scan, and all of them are covered elsewhere on this site.
How often to repeat it
Once a quarter is plenty for the full list; the update check is worth doing whenever the browser shows its update badge. Settings rarely revert themselves, but extensions change hands, browsers add new toggles, and a new laptop starts from defaults. If you keep one habit from this guide, make it the relaunch-when-prompted habit, because that is the one that closes actively exploited holes. Everything else is covered in depth in the browser security hub and in its settings walkthrough for Chrome, Firefox, Safari and Edge.
