Browser Privacy Settings That Actually Do Something
Below are the settings that carry real weight, for the four major browsers. All of them are in each browser’s settings page; paths are given for each.
1. Cookie and tracking protection: from “basic” to “strict”
Every browser now has a tracking-protection setting that ships on “Standard” or “Balanced”, which blocks the easy trackers and waves through most of the ad industry. Raise it:
| Browser | Where | Set it to |
|---|---|---|
| Chrome | Settings → Privacy and security → Third-party cookies | Block third-party cookies |
| Edge | Settings → Cookies and site permissions | Strict tracking prevention |
| Firefox | Settings → Privacy & Security → Enhanced Tracking Protection | Strict |
| Safari | Settings → Privacy | Prevent cross-site tracking (on by default); check it |
Yes, some sites will nag you to disable your blocker or show broken cookie banners. That’s the ad industry reacting, not you doing something wrong.
2. Turn on HTTPS-Only mode
This setting makes the browser refuse to load a site over plain, unencrypted HTTP and upgrade everything to HTTPS. Without it, on hostile WiFi, an attacker can rewrite pages on the fly. With it, the browser simply won’t go there.
- Firefox: Settings → Privacy & Security → HTTPS-Only Mode → Enable in all windows.
- Chrome/Edge: Settings → Privacy and security → Security → “Always use secure connections” (Chrome) / the equivalent toggle in Edge security settings.
- Safari: handled automatically in recent versions; consider the “HTTPS-Only” extension for older versions.
3. Send “Do Not Track”? The honest answer
The DNT flag is a polite request that sites are free to ignore, and most do. Enable it if you like, but don’t count it as protection. The settings above are enforcement; DNT is a suggestion.
4. Ditch the data-hoovering default search engine
Your default search engine sees every question you type. The big default logs searches against your account history. Options that keep less:
- DuckDuckGo: doesn’t log searches or build a profile per user.
- Startpage: fetches Google results without passing your identity along.
- Brave Search: independent index, no profiling.
Change it in the browser’s search engine settings, one click, and it applies to the address bar too.
5. The padlock: what it does and doesn’t mean
HTTPS (the padlock) means the connection to that site is encrypted. It does not mean the site is honest; plenty of phishing sites use HTTPS and show a padlock. It means nobody between you and the site can read or alter the traffic. Treat the padlock as a floor, not a stamp of approval. Our phishing guide shows what else to check before trusting a page.
6. Private browsing windows: useful, misunderstood
Incognito/private windows stop your browsing history landing in the browser on your device. They don’t hide your activity from the sites you visit, your employer’s network or your ISP. Useful for gift shopping on a shared computer; not a privacy tool in the broader sense.
7. Occasional cleanup
Once in a while (a few times a year, or when something feels sticky): clear cookies and site data. In every browser it’s under Privacy → Clear browsing data. Keep “Passwords” and “Autofill” unchecked so you don’t nuke your own saved logins, and clear “Cookies and site data” plus “Cached images and files”.
If the machine belongs to your employer, corporate policies and monitoring may override some of these settings, and that’s normal for company machines. For personal devices, everything above is yours to set.
For businesses, browser settings are best managed centrally rather than hoping every machine is configured by hand. That’s part of the proactive maintenance in our managed IT support: devices kept updated, configured and secure.
Want this set properly across the whole office?
ARTRIBE Tech’s managed IT support keeps browsers, devices and security settings configured correctly across your team, month after month.
Ask about managed IT support →