app.normandy.api_url = ""
app.normandy.enabled = false
app.shield.optoutstudies.enabled = false
app.update.auto = false [OS except Windows]
app.update.background.scheduling.enabled = false [Windows]
beacon.enabled = false
breakpad.reportURL = ""
browser.cache.disk.enable = false
browser.contentblocking.category = "strict"
browser.discovery.enabled = false
browser.display.use_system_colors = false
browser.download.manager.addToRecentDocs = false
browser.download.useDownloadDir = false
browser.fixup.alternate.enabled = false
browser.formfill.enable = false
browser.helperApps.deleteTempFileOnExit = true
browser.newtab.preload = false
browser.newtabpage.activity-stream.default.sites = ""
browser.newtabpage.activity-stream.feeds.discoverystreamfeed = false
browser.newtabpage.activity-stream.feeds.section.topstories = false
browser.newtabpage.activity-stream.feeds.snippets = false
browser.newtabpage.activity-stream.feeds.telemetry = false
browser.newtabpage.activity-stream.section.highlights.includePocket = false
browser.newtabpage.activity-stream.showSponsored = false
browser.newtabpage.activity-stream.showSponsoredTopSites = false
browser.newtabpage.activity-stream.telemetry = false
browser.newtabpage.enabled = false
browser.pagethumbnails.capturing_disabled = true*
browser.ping-centre.telemetry = false
browser.privatebrowsing.forceMediaMemoryCache = true
browser.region.network.url = ""
browser.region.update.enabled = false
browser.safebrowsing.allowOverride = false
browser.safebrowsing.blockedURIs.enabled = false
browser.safebrowsing.downloads.enabled = false
browser.safebrowsing.downloads.remote.block_potentially_unwanted = false
browser.safebrowsing.downloads.remote.block_uncommon = false
browser.safebrowsing.downloads.remote.enabled = false
browser.safebrowsing.downloads.remote.url = ""
browser.safebrowsing.malware.enabled = false
browser.safebrowsing.phishing.enabled = false
browser.safebrowsing.provider.google.gethashURL = ""
browser.safebrowsing.provider.google.updateURL = ""
browser.safebrowsing.provider.google4.dataSharingURL = ""
browser.safebrowsing.provider.google4.gethashURL = ""
browser.safebrowsing.provider.google4.updateURL = ""
browser.search.suggest.enabled = false
browser.sessionstore.privacy_level = 2
browser.sessionstore.resume_from_crash = false
browser.shell.shortcutFavicons = false
browser.startup.blankWindow = false
browser.tabs.crashReporting.sendReport = false
browser.urlbar.quicksuggest.enabled = false
browser.urlbar.quicksuggest.scenario = "history"
browser.urlbar.speculativeConnect.enabled = false
browser.urlbar.suggest.quicksuggest.nonsponsored = false
browser.urlbar.suggest.quicksuggest.sponsored = false
browser.urlbar.suggest.searches = false
browser.urlbar.trimURLs = false
browser.xul.error_pages.expert_bad_cert = true
captivedetect.canonicalURL = ""
datareporting.healthreport.uploadEnabled = false
datareporting.policy.dataSubmissionEnabled = false
dom.battery.enabled = false
dom.disable_open_during_load = true
dom.popup_allowed_events = click dblclick mousedown pointerdown
dom.security.https_only_mode = true
dom.security.https_only_mode_ever_enabled = true
dom.security.https_only_mode_send_http_background_request = false
extensions.Screenshots.disabled = true
extensions.enabledScopes = 5*
extensions.formautofill.addresses.enabled = false
extensions.formautofill.available = "off"
extensions.formautofill.creditCards.available = false
extensions.formautofill.creditCards.enabled = false
extensions.formautofill.heuristics.enabled = false
extensions.getAddons.showPane = false*
extensions.htmlaboutaddons.recommendations.enabled = false
extensions.pocket.enabled = false
extensions.postDownloadThirdPartyPrompt = false
extensions.webextensions.restrictedDomains = ""
fission.autostart = true
geo.enabled = false
geo.provider.ms-windows-location = false
geo.provider.network.url = "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"
geo.provider.use_corelocation = false [macOS]
geo.provider.use_geoclue = false [Linux]
geo.provider.use_gpsd = false [Linux]
gfx.webrender.all = true
intl.accept_languages = "en-US, en"
javascript.options.baselinejit = false
javascript.options.blinterp = false
javascript.options.ion = false
javascript.options.wasm_baselinejit = false
javascript.use_us_english_locale = true*
media.autoplay.default = 5
media.eme.enabled = false
media.peerconnection.enabled = false
media.peerconnection.ice.default_address_only = true
media.peerconnection.ice.no_host = true
media.peerconnection.ice.proxy_only_if_behind_proxy = true
network.IDN_show_punycode = true
network.auth.subresource-http-auth-allow = 1
network.captive-portal-service.enabled = false
network.connectivity-service.enabled = false
network.cookie.cookieBehavior = 1
network.dns.disableIPv6 = true
network.dns.disablePrefetch = true
network.dns.disablePrefetchFromHTTPS = true
network.dns.echconfig.enabled = true
network.dns.http3_echconfig.enabled = true
network.dns.use_https_rr_as_altsvc = true
network.file.disable_unc_paths = true*
network.gio.supported-protocols = ""*
network.http.http3.enable = true
network.http.referer.XOriginPolicy = 2
network.http.referer.XOriginTrimmingPolicy = 2
network.http.referer.spoofSource = true
network.http.referer.trimmingPolicy = 2
network.http.sendRefererHeader = 0
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
breaks some sites as requests without referrers are often considered bots
network.http.speculative-parallel-limit = 0
network.predictor.enable-prefetch = false
network.predictor.enabled = false
network.prefetch-next = false
network.trr.mode = 3
network.trr.uri = https://mozilla.cloudflare-dns.com/dns-query
network.trr.useGET = true
pdfjs.enableScripting = false
permissions.manager.defaultsUrl = ""
privacy.donottrackheader.enabled = true
privacy.firstparty.isolate = true
privacy.partition.always_partition_third_party_non_cookie_storage = true
privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage = true
privacy.partition.serviceWorkers = true
privacy.query_stripping.enabled = true
privacy.resistFingerprinting = true
privacy.resistFingerprinting.block_mozAddonManager = true*
privacy.socialtracking.block_cookies.enabled = true
privacy.spoof_english = 2
privacy.trackingprotection.cryptomining.enabled = true
privacy.trackingprotection.enabled = true
privacy.trackingprotection.fingerprinting.enabled = true
privacy.trackingprotection.socialtracking.enabled = true
privacy.userContext.enabled = true
privacy.userContext.ui.enabled = true
privacy.window.maxInnerHeight = 900
privacy.window.maxInnerWidth = 1600
security.OCSP.enabled = 0
security.OCSP.require = true
security.cert_pinning.enforcement_level = 2
security.pki.crlite_mode = 2
security.pki.sha1_enforcement_level = 1
security.remote_settings.crlite_filters.enabled = true
security.sandbox.content.shadow-stack.enabled = true
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
often breaks sites
security.sandbox.content.win32k-disable = true
security.sandbox.gmp.shadow-stack.enabled = true
security.sandbox.gmp.win32k-disable = true
security.sandbox.gpu.level = 1
security.sandbox.gpu.shadow-stack.enabled = true
security.ssl3.dhe_rsa_aes_128_sha = false
security.ssl3.dhe_rsa_aes_256_sha = false
security.ssl3.ecdhe_ecdsa_aes_128_sha = false
security.ssl3.ecdhe_ecdsa_aes_256_sha = false
security.ssl3.ecdhe_rsa_aes_128_sha = false
security.ssl3.ecdhe_rsa_aes_256_sha = false
security.ssl3.rsa_aes_128_gcm_sha256 = false
security.ssl3.rsa_aes_128_sha = false
security.ssl3.rsa_aes_256_gcm_sha384 = false
security.ssl3.rsa_aes_256_sha = false
security.tls.ech.grease_http3 = true
security.tls.enable_0rtt_data = false
security.tls.enable_delegated_credentials = true
security.tls.version.min = 3
signon.autofillForms = false
signon.formlessCapture.enabled = false
signon.rememberSignons = false
toolkit.coverage.endpoint.base = ""
toolkit.coverage.opt-out = true*
toolkit.telemetry.archive.enabled = false
toolkit.telemetry.bhrPing.enabled = false
toolkit.telemetry.coverage.opt-out = true*
toolkit.telemetry.enabled = false
toolkit.telemetry.firstShutdownPing.enabled = false
toolkit.telemetry.newProfilePing.enabled = false
toolkit.telemetry.server = "data:,"
toolkit.telemetry.shutdownPingSender.enabled = false
toolkit.telemetry.unified = false
toolkit.telemetry.updatePing.enabled = false
webgl.disabled = true
The value with * means you need to create the config as it is hidden from about:config.
In
user.jsformat (excludingnetwork.http.sendRefererHeaderandsecurity.sandbox.content.shadow-stack.enabled: