Mozilla Firefox is a popular, extensible, open source (mostly) web browser that is highly configurable and easy to use. Somewhat bare out of the box however, its functionality is easily extended with add-ons, or ‘extensions’ if you prefer, of which there are many thousands.
With so many “free” add-ons, the casual user might be tempted to install lots of them, however i would strongly suggest installing only those you really like or need since the potential to break things and compromise browser security and your privacy increases with every add-on you install.
Another problem is unethical developers who may include unwanted and unnecessary functionality which is not relevant to the primary purpose of the add-on. Often this results in data collection, tracking your web activities or worse, all of which i categorize as malware. The problem of malware in Mozilla’s add-on repository (AMO) has grown exponentially as a result of an automated review process and the company’s move to the WebExtension API which made it easy for unethical developers who have infected the Google Chrome Store to port their garbage to Firefox. Although the WebExtension API is greatly limited in its capabilities as opposed to the older XUL/XPCOM extensions, user tracking and advertising are permitted and, on occasion, far more dangerous add-ons escape detection.
Add-on selection guidelines
- You’ve been warned. Many extensions will be accompanied by a warning on their AMO pages which indicates that the extension is not monitored by Mozilla and therefore is more risky to install. While monitored extensions are likely to be more trustworthy in general, there are many others which are perfectly fine to install as long as you trust the developer or review the code yourself.
- Be very wary of any tool-bar add-ons. Almost all of these contain 3rd party spyware/malware components for monetization purposes.
- Read the add-on permissions. The Mozilla add-on website lists the permissions that add-ons require, though there seems to be major problems at this time in that all permissions used by an add-on may not be listed, or permissions which the add-on does not use may be listed, so don’t trust this completely. That said, look for permissions that seem unnecessary given the described functionality of the add-on.
- Don’t install newly released add-ons. Mozilla uses a deeply flawed automated system to evaluate add-ons, so wait a while until others have had a chance to review it or flag it as abusive. If the add-on quickly disappears or gets poor reviews, be thankful you didn’t install it.
- Check the license. Be wary of developers who use a restrictive license, such as ‘All Rights Reserved’. Most ethical developers will use a liberal, open source license, such as the General Public License (GPL) or the Mozilla Public License (MPL).
- Does the developer offer support? Be wary of developers that makes it difficult or impossible to contact them or submit bug reports.
- Read the user reviews. Always read the user reviews to see how well an add-on is liked and be wary if it is rated 3 stars or less, or not rated at all, or was rated highly by only a few people. Sometimes the developer of the add-on will be the first to “review” it, giving it 5 stars. Regardless of the rating however, always check the comments of the people that gave it the lowest rating to see if their gripes seem legitimate. Don’t depend on ratings alone however as there are many add-ons that have been highly rated by hundreds or thousands of people that contain malware.
- Check the developers profile. Always check to see what other add-ons the developer has created and how those are rated. Be wary when the developer is named as a company and not an individual, or when the name used is anonymous, such as “Firefox user” followed by a random string of numbers.
- Visit the developers website. See what kind of content is on the developers website if they link to one and look for marketing hype.
- Be wary of very popular add-ons. Many developers of hugely popular add-ons have been contacted by malware distributing 3rd parties wanting to buy their add-on or make a deal with them. Adblock Plus by Eyeo GmbH (Wladimir Palant), which currently lists over 8 million users, is a glaring example where a developer created a hugely popular ad blocking extension which allows ads by default. The company charges advertisers 30% of their revenue from ad blocking users. Giorgio Maone, the developer of the very popular NoScript add-on, engaged in similar chicanery a while back.
It was always very important for me to be honest and fair to the users. I had very good offers to sell the extension, but I didn’t want to see that AiOS turn into adware or spyware.
CSP: The non-bug bug crisis
There’s a few things you can do to minimize the problem: 1), don’t install more extensions than necessary, 2), disable any unneeded CSP related options in an extension, 3), check if an extension uses CSP prior to installing it with the Extension source viewer add-on (you can do this by searching the code using
!content-security-policy), 4), when starting Firefox, go immediately to the add-on page (about:addons) and disable any critical extensions that use CSP and then re-enable them. For example, the most important add-ons to me are uBlock Origin and uMatrix, so when i start Firefox, i disable both and then re-enable uBlock first and uMatrix last. The last extension that you enable is the one that will have priority regarding CSP header modification.
To learn how you can disable unnecessary CSP related options in some of the add-ons listed here, see the Extensions section of the ‘ghacks’ user.js wiki.
For more, see the sticky: unofficial: the extension csp header modification game issue on the ‘ghacks’ user.js repository. Also please vote for the following issues on Bugzilla: 1421725 – finalize how changing headers should work and 1477696 – webExtension: webRequest.onHeadersReceived: accidentally overwriting header from other extensions. You can also gripe to Mozilla about this without having to create an account.
Add-ons are tagged with either [enhancement] or [privacy/security] in order to identify their primary role.
0T Reverse Image Search by ZcnS [enhancement]
0T Reverse Image Search is a privacy friendly add-on used to find different versions of a given image using 3rd party services such as TinEye. Reverse image searching is a great way to find higher resolution versions of an image or to find when an image may have first been published to the web, the latter of which can be beneficial for researchers.
CanvasBlocker by kkapsner [privacy/security]
Caveats: For advanced users. Will likely break some sites until settings are adjusted.
ClearURLs by Kevin R. [privacy/security]
ClearURLs replaces Neat URL as my preferred link cleaner. ClearURLs removes many tracking parameters from links you click, such as the Google
utm_* garbage which is used to track where you go on the web. Unlike all of the other link cleaners i’ve seen and used, ClearURLs doesn’t include a static list of parameters, nor does it have any options or whitelist that you need to mess with. This neat little extension pulls a file from the developers GitLab repository which negates having to update the extension when there’s a change to the list of parameters. Though i was sure i was going to miss the ability to whitelist certain domains, i have yet to see anything break because of this extension.
CSS Exfil Protection by Mike Gualtieri [privacy/security]
CSS Exfil Protection prevents a certain CSS exploit that can be used to steal data from webpages.
Caveats: Could potentially break some websites, though it is easy to disable the add-on from its toolbar icon.
Dark Background and Light Text by Mikhail Khvoinitsky [enhancement]
Dark Background and Light Text replaces Dark Reader as my preferred add-on for darkening the entire web. These ‘darkify’ add-ons, of which there are many, change the colors used by all websites to a darker theme and this one seems to be the best of them.
Caveats: All of these dark web add-ons fail miserably in at least some cases and this one is no exception, however it seems to work better than all of the others i’ve tested and it offers a few different styles that can be assigned to specific websites when the default style fails.
Decentraleyes by Thomas Rientjes [privacy/security]
Caveats: Could potentially break some websites, though it is easy to white-list affected domains.
Disable Tab Detach by Matt Hensman [enhancement]
Disable Tab Detach simply prevents moving a tab to a new Firefox window if you accidentally drag it downward from the tab bar. I find this behavior incredibly annoying and the lack of a built-in Firefox option to disable it is just stupid. Disable Tab Detach is kind of hacky in the way it works, but it gets the job done.
ETag Stoppa by claustromaniac [privacy/security]
ETag Stoppa is a simple install-it-and-forget-it extension that prevents Firefox from storing entity tags and thus it helps to prevent tracking.
Extension source viewer by Rob W [enhancement]
Extension source viewer is a handy and well thought out utility to quickly view the source code of a Firefox extension right from the Mozilla add-ons website without having to download and unpack it manually. The extension has the ability to search the contents of the files in the source code by prefixing the search with ‘
Caveats: For advanced users.
Feed Preview by Guido Berhörster [enhancement]
Feed Preview simply displays a formatted version of news feeds, a capability that was built-in to Firefox before the geniuses at Mozilla decided to remove it.
FireMonkey by erosman [enhancement]
Caveats: For advanced users. Installing user scripts is a security and/or privacy risk. While this holds true for extensions as well, user scripts are generally not scrutinized to the degree that extensions are when they are download from Mozilla.
First Party Isolation by freddyb [privacy/security]
First Party Isolation simply toggles the
privacy.firstparty.isolate preference. First Party Isolation, or FPI, is a Firefox privacy feature which plays a very important role in preventing browser tracking and fingerprinting.
Caveats: Could potentially break some websites, though it can be quickly toggled off by clicking its toolbar button.
Flagfox by Dave G [enhancement]
Flagfox is a neat utility that adds an icon to the address bar which represents the flag of the country in which the web server is located. When the icon is right-clicked, a context menu is revealed with many more tools, such as a WHOIS lookup, URL shortening services and more. You can also add your own services.
Caveats: If you choose to display the menu icons, they are not stored locally and have to be fetched the first time you open the menu which some might see as a privacy issue.
HTTPZ by claustromaniac [privacy/security]
HTTPZ is a very simple install-it-and-forget-it add-on that attempts to redirect all all HTTP (insecure) traffic to HTTPS (secure).
Invidition by Booteille [privacy/security]
Invidition redirects links to YouTube videos and replaces embedded YouTube video code using one of the Invidious instances which act as a privacy enhanced front-end/proxy for YouTube. It also redirects Twitter links to Nitter, a privacy enhanced Twitter front-end/proxy.
Caveats: Invidious is not perfect. Sometimes an instance may be overloaded or simply refuse to play a video that would otherwise play fine on youtube.com, however such issues don’t happen too frequently and Invidious is still under heavy development.
Link Text and Location Copier by William Groenendijk [enhancement]
Link Text and Location Copier allows to copy formatted text and a link for a webpage in various ways, plus you can define your own templates. You can also paste content as Rich Text, meaning you can paste the title of a page and its link directly into the visual WordPress editor for example.
Mark-It by Matt [enhancement]
Mark-It is a simple and handy add-on that replaces your new tab page with one that allows you to write notes in markup format.
Maximize All Windows (Minimalist Version) by ericchase [enhancement]
Maximize All Windows (Minimalist Version) does one thing and does it well, and that is to make sure the Firefox window starts in a maximized state. If you typically maximize Firefox and you have
privacy.firstparty.isolate enabled, you may be annoyed when it fails to remember its state after restart. This add-on solves the problem, but know that Firefox may be greatly more vulnerable to fingerprinting as a result.
mozlz4-edit by Siarhei Kuzeyeu [enhancement]
mozlz4-edit allows one to edit, format and otherwise manipulate several types of compressed files including the
search.json.mozlz4 file which is where Firefox stores all of its search engine plugins.
Caveats: For advanced users.
Privacy Oriented Origin Policy by claustromaniac [privacy/security]
Privacy Oriented Origin Policy (POOP) helps protect your privacy by preventing Firefox from sending Origin headers, though how it works is configurable.
Caveats: For advanced users. May break some websites, though it is easily disabled and sites can be whitelisted. There is a lengthy discussion about what led to the development of this add-on on GitHub if you’re interested.
Redirector by Einar Egilsson [enhancement]
Redirector automatically redirects selected pages, links and more to another resource of your choosing.
Scroll Up Folder by Bruce Bujon [enhancement]
Scroll Up Folder adds an icon in the address bar that, when clicked, opens a list of the segments of the current document address. Clicking the list items makes it really easy to navigate up to a higher level of the address without having to manually edit it.
Site Bleacher by wooque [privacy/security]
Site Bleacher automatically removes cookies, local storage, IndexedDB storage and service workers. It is not perfect, but given the limitations of the Web Extension API and Mozilla’s foot-dragging in fixing its problems, it is the only add-on at this time that automatically cleans IndexedDB and Service Workers storage automatically on a tab by tab basis.
Caveats: May break some websites, however the add-on includes a whitelist.
Skip Redirect by Sebastian Blask [privacy/security]
Redirects sometimes happen when you click on a hyperlink expecting to go directly to the destination and, instead, your request is passed through an intermediary. Redirects are often used to track your browsing history or display ads before you are forwarded to the target domain. Skip Redirect simply tries to bypass this annoying behavior. I would suggest keeping the notification enabled when Skip Redirect does its thing as this makes it easy to troubleshoot a problem.
Caveats: May break the functionality of some websites in which case they can be added to a whitelist.
Smart RSS Reader by zakius [enhancement]
Smart RSS Reader is a 3-pane news feed reader and a pretty good one at that. It hasn’t been around long and so there’s some little niggles with it and it’s missing some non-trivial features, but it functions quite well as a basic reader. The developer is very friendly and open to suggestions.
Stylus by Armin Sebastian [enhancement]
Stylus is used to write, store and apply custom CSS styles to websites, or even the entire web if you wish. Though you can use FireMonkey for this, working with Stylus is much nicer. Note: Do not use Stylish, a similar add-on.
Toggle Fonts by Manuel Reimer [enhancement]
Toggle Fonts provides a simple toggle switch that forces all websites to use your preferred font settings as set in Firefox preferences.
Caveats: May occasionally break how a website is looks, but the add-on is easily disabled by clicking its toolbar icon. Only dictates what fonts a webpage can use; it does not prevent the downloading of fonts.
uBlock Origin by Raymond Hill [privacy/security]
uBlock Origin is a superior content filter (or firewall, if you like) that can replace several other content/ad blockers including Adblock Plus/Edge, NoScript, etc.. It is capable of using the same filter lists as Adblock Plus/Edge as well as many more that they cannot. Two of the most welcome differences with uBlock Origin is that it does not slow page loading to any noticeable degree and it uses less memory then the Adblock derivatives. Another major advantage is that it can block both 1st and 3rd party requests for images, scripts and frames. See my Firefox Configuration Guide for Privacy Freaks and Performance Buffs article for more information regarding uBlock Origin. Lastly, note that there are two versions of uBlock; uBlock and uBlock Origin. You absolutely need to use the latter which is written by the original developer, Raymond Hill.
Caveats: For advanced users. As with any content filtering extension, uBlock Origin has the potential to break website functionality until it is configured correctly.
uMatrix by Raymond Hill [privacy/security]
uMatrix is another powerful content blocker by Raymond Hill and though it is similar to uBlock Origin, it offers more granular control over blocking various resources including cookies, CSS, images, plug-ins, scripts, XHR, frames and more. You can use uMatrix and uBlock Origin together. See my guide, Firefox Configuration Guide for Privacy Freaks and Performance Buffs, for further information.
Caveats: For advanced users. As with any content filtering extension, uMatrix has the potential to break website functionality until it is configured correctly.
Web Archives by Armin Sebastian [enhancement]
Web Archives makes it easy to find archived version of webpages. It is fairly configurable, though it does not have an option to add your own archive resources, nor does it have an option to send a webpage to an archive, however i find the latter unnecessary since the archive sites i use allow you easily archive a page if one isn’t isn’t found.
Listing removed add-ons
While i’m sure there’s a more geeky way of listing extensions which one has removed, this one works for me: In your Firefox profile folder, navigate to
/extensions/staged and there should be folders with the names of the removed extensions. You can delete this folder if you like.
Doing it without an add-on
The fewer add-ons you install, the better, and there’s a lot of things you can do to customize Firefox without add-ons.
Enhancing privacy and security
If you like an add-on, or any other free and open source software, please donate to the developer. Trust me when i tell you that most developers of free software usually receive little or nothing for all their hours of hard work and support they provide. Developers are usually very appreciative of a donation regardless of how small it may be.
This list contains only the most recent changes
- replaced Search by Image with 0T Reverse Image Search
- changed order of add-on list and added tags to identify primary category of add-ons
- corrected description of Toggle Fonts add-on
- minor edits