← Back to House

Browser Security Hardening

House of Shield - Defend Your Digital Gateway

Browser Security Checklist

0%
Complete these essential steps to harden your browser security. Click each item to mark it as complete and track your progress.

Enable HTTPS-Only Mode

Force all connections to use encrypted HTTPS protocol. This prevents your data from being transmitted in plain text and protects against man-in-the-middle attacks.

Block Third-Party Cookies

Prevent advertisers and trackers from following you across the web. Third-party cookies enable cross-site tracking and compromise your privacy.

Disable JavaScript on Sensitive Sites

Use extensions like NoScript to control JavaScript execution. While this may break some functionality, it significantly reduces attack surface on high-risk sites.

Install Content Blockers

Use uBlock Origin or similar tools to block malicious scripts, ads, and tracking pixels. These tools prevent many common web-based attacks before they reach your browser.

Clear Browsing Data Regularly

Schedule regular clearing of cookies, cache, and browsing history. This limits the data available to attackers and reduces your digital footprint.

Verify Site Certificates

Always check the padlock icon before entering sensitive information. Click it to view certificate details and ensure the connection is legitimately encrypted.

Disable Browser Password Autofill

Turn off autofill for passwords and use a dedicated password manager instead. Browser autofill is vulnerable to form-grabbing attacks.

Enable Enhanced Tracking Protection

Activate your browser's built-in tracking protection (Strict mode recommended). This blocks known trackers, cryptominers, and fingerprinting scripts.

Keep Browser Updated

Enable automatic updates and ensure you're running the latest version. Security patches are critical for protecting against newly discovered vulnerabilities.

Use DNS-over-HTTPS (DoH)

Encrypt your DNS queries to prevent ISPs and attackers from seeing which sites you visit. Configure DoH in your browser's network settings.

Disable WebRTC

WebRTC can leak your real IP address even when using a VPN. Disable it if you don't use video calling features in your browser.

Review and Remove Unnecessary Extensions

Audit your extensions monthly. Each extension increases attack surface and may have access to sensitive data. Only keep what you actively use.

SSL/TLS Certificate Verification

Understanding Certificate Chains: When you visit a secure website, your browser verifies a chain of trust from the site's certificate up to a trusted root certificate authority (CA).

Certificate Chain Simulator

Root CA
Trusted Authority
→
Intermediate CA
Verified Issuer
→
Website Cert
example.com
✓ Valid Certificate Chain

This certificate is properly signed by a trusted certificate authority, is not expired, and matches the domain name. Your connection is secure.

Common Certificate Errors:
  • NET::ERR_CERT_DATE_INVALID - Certificate has expired or is not yet valid
  • NET::ERR_CERT_COMMON_NAME_INVALID - Certificate domain doesn't match the website
  • NET::ERR_CERT_AUTHORITY_INVALID - Certificate issued by untrusted authority
  • NET::ERR_CERT_REVOKED - Certificate has been revoked by the issuer
Best Practices:
  • Never proceed past certificate warnings on financial or sensitive sites
  • Click the padlock icon to view certificate details before entering credentials
  • Look for Extended Validation (EV) certificates on banking sites
  • Be wary of certificate errors on familiar sites (possible MITM attack)

Password Manager Guide

Why Use a Password Manager?
Password managers generate, store, and autofill strong unique passwords for every account. This eliminates password reuse (the #1 cause of account compromises) and makes it practical to use complex passwords you can't remember.

Password Manager Comparison

Browser Built-In

Pros:
  • Free and built-in
  • Seamless integration
  • Cross-device sync
  • Easy to use
Cons:
  • Limited features
  • Security varies by browser
  • No secure notes/files
  • Browser-locked

Bitwarden

Pros:
  • Open source
  • Free tier robust
  • Cross-platform
  • Self-hosting option
Cons:
  • UI less polished
  • Fewer premium features
  • Smaller team

1Password

Pros:
  • Excellent UX
  • Travel mode
  • Watchtower alerts
  • Family sharing
Cons:
  • Subscription required
  • Not open source
  • Higher cost

KeePassXC

Pros:
  • Fully offline
  • 100% free
  • Open source
  • Maximum control
Cons:
  • Manual sync required
  • Steeper learning curve
  • No official cloud sync

Master Password Best Practices

Your master password is the key to everything. Follow these rules:
  • Length over complexity: Use 5-7 random words (passphrase) rather than complex gibberish
  • Example: "correct horse battery staple autumn" (5 words = ~65 bits of entropy)
  • Never reuse: Your master password should be unique and never used anywhere else
  • Memorize it: Never write it down digitally. Practice typing it until it's muscle memory
  • Enable 2FA: Add two-factor authentication to your password manager account
  • Set up recovery: Configure emergency access or recovery codes (store offline)
Migration Tips: Moving to a password manager is easier than you think. Start by importing existing passwords, then gradually update them to strong unique passwords. Use the password generator for all new accounts. Within a month, you'll wonder how you ever managed without it.

Browser Privacy Settings Guide

Each browser has unique privacy controls. Click any browser below to see recommended settings for maximum privacy and security.
Google Chrome
Click to expand settings

Recommended Settings:

  • Settings → Privacy and Security → Cookies: Block third-party cookies
  • Privacy and Security → Security: Enable "Always use secure connections"
  • Privacy and Security → Privacy: Send "Do Not Track" request
  • Privacy and Security → Site Settings: Block pop-ups and redirects
  • Privacy and Security → Site Settings → Location: Set to "Ask before accessing"
  • Privacy and Security → Site Settings → Camera/Microphone: Block by default
  • Advanced → Clear browsing data: Set to clear on exit
Note: Chrome is developed by Google, an advertising company. For maximum privacy, consider Firefox or Brave.
Mozilla Firefox
Click to expand settings

Recommended Settings:

  • Settings → Privacy & Security → Enhanced Tracking Protection: Set to "Strict"
  • Privacy & Security → Cookies and Site Data: Delete cookies when Firefox closes
  • Privacy & Security → Logins and Passwords: Use primary password
  • Privacy & Security → Permissions: Block new requests for location, camera, microphone
  • Privacy & Security → Firefox Data Collection: Disable all telemetry
  • Privacy & Security → Security: Enable HTTPS-Only Mode in all windows
  • Privacy & Security → DNS over HTTPS: Enable with Max Protection
Best for Privacy: Firefox is open-source and privacy-focused with excellent default protections.
Microsoft Edge
Click to expand settings

Recommended Settings:

  • Settings → Privacy, search, and services: Set tracking prevention to "Strict"
  • Privacy → Tracking prevention: Block trackers from sites you haven't visited
  • Privacy → Clear browsing data: Choose what to clear on close
  • Privacy → Security: Enable Microsoft Defender SmartScreen
  • Cookies and site permissions: Manage and delete cookies regularly
  • Site permissions: Set camera, microphone, location to "Ask"
  • Use secure DNS: Enable DNS over HTTPS
Note: Edge is Chromium-based with additional Microsoft tracking. Configure privacy settings carefully.
Safari
Click to expand settings

Recommended Settings:

  • Safari → Preferences → Privacy: Enable "Prevent cross-site tracking"
  • Privacy: Block all cookies (or allow from current website only)
  • Privacy: Enable "Hide IP address from trackers"
  • General: Disable "Open 'safe' files after downloading"
  • Security: Enable "Warn when visiting fraudulent website"
  • Websites → Camera/Microphone: Set to "Deny" by default
  • Advanced: Show full website address
  • Advanced: Enable "Show Develop menu" for additional controls
Apple Privacy: Safari has strong default privacy protections and Intelligent Tracking Prevention (ITP).

Universal Privacy Recommendations

Regardless of browser, always:
  • Use private/incognito mode for sensitive browsing (banking on public computers)
  • Regularly clear cookies and site data
  • Review and revoke unnecessary site permissions monthly
  • Disable autofill for forms and passwords (use a password manager instead)
  • Consider using containers or profiles to separate different browsing contexts
  • Install privacy-focused extensions (uBlock Origin, Privacy Badger)

Common Browser Threats

Understanding threats is the first step in defending against them. Learn to recognize and protect against these common browser-based attacks.

Phishing Attacks

CRITICAL

What it is: Fraudulent websites that mimic legitimate sites to steal credentials.

How it works: Attackers send emails or messages with links to fake login pages that look identical to real services.

Defense:

  • Always check URL before entering credentials
  • Look for HTTPS and valid certificates
  • Never click links in suspicious emails
  • Use password manager (won't autofill on wrong domain)
  • Enable 2FA on all accounts

Drive-by Downloads

HIGH

What it is: Malware automatically downloaded to your system without your knowledge or consent.

How it works: Compromised or malicious websites exploit browser vulnerabilities to install software silently.

Defense:

  • Keep browser and plugins updated
  • Use script blockers (uBlock Origin, NoScript)
  • Disable auto-download features
  • Avoid untrusted or sketchy websites
  • Run antivirus with real-time protection

Cross-Site Scripting (XSS)

HIGH

What it is: Injection of malicious scripts into trusted websites viewed by other users.

How it works: Attackers inject JavaScript into web pages that executes in victims' browsers, stealing data or hijacking sessions.

Defense:

  • Enable Content Security Policy (CSP) if available
  • Use NoScript or similar extensions
  • Keep browser updated (XSS filters built-in)
  • Log out of sensitive sites when done
  • Use browser extensions cautiously

Man-in-the-Middle (MITM)

CRITICAL

What it is: Interception of communications between your browser and websites you visit.

How it works: Attackers position themselves between you and the server, reading or modifying traffic (especially on public WiFi).

Defense:

  • Only use HTTPS (enable HTTPS-Only mode)
  • Never ignore certificate warnings
  • Avoid public WiFi for sensitive activities
  • Use VPN on untrusted networks
  • Install HTTPS Everywhere extension

Cookie/Session Hijacking

HIGH

What it is: Theft of session cookies to impersonate you on websites where you're logged in.

How it works: Attackers steal your session cookies through XSS, network sniffing, or malware and use them to access your accounts.

Defense:

  • Log out of accounts when finished
  • Use HTTPS everywhere
  • Clear cookies regularly
  • Enable cookie protection in browser
  • Use separate browsers for sensitive tasks

Browser Fingerprinting

MEDIUM

What it is: Tracking technique that identifies you based on unique browser configuration without cookies.

How it works: Websites collect information about your browser, OS, plugins, fonts, and settings to create a unique "fingerprint."

Defense:

  • Use privacy-focused browsers (Firefox, Brave)
  • Minimize installed extensions
  • Disable WebGL and Canvas fingerprinting
  • Use fingerprint protection extensions
  • Regularly change browser configurations
Layered Defense is Key: No single security measure is perfect. Combine multiple defenses (updated browser + extensions + good habits + 2FA + password manager) to create robust protection against browser-based threats.

Browser Extension Security

Extensions are powerful but risky. Every extension you install can access your browsing data, modify web pages, and potentially compromise your security. Choose carefully and audit regularly.

Safe Extension Practices

Research Before Installing

Check the developer, read reviews, verify permissions, and search for any security incidents. Look for extensions with many users and positive ratings over time.

Review Permissions Carefully

Extensions requesting "Read and change all your data on all websites" have complete access to everything you do. Only grant broad permissions if absolutely necessary.

Minimize Extension Count

Each extension increases attack surface and performance overhead. Audit monthly and remove anything you don't actively use. Aim for fewer than 5 extensions.

Prefer Open Source Extensions

Open source extensions can be audited by security researchers. Examples: uBlock Origin, Privacy Badger, HTTPS Everywhere, Bitwarden.

Keep Extensions Updated

Enable automatic updates and check periodically. Outdated extensions may contain known vulnerabilities that attackers can exploit.

Avoid Extension Clones

Malicious developers create fake versions of popular extensions. Always install from official sources and verify the developer name matches the legitimate version.

Monitor Extension Behavior

Watch for unusual activity: unexpected ads, redirects, slow performance, or modified search results. These may indicate a compromised or malicious extension.

Use Site-Specific Permissions

When possible, restrict extensions to specific sites rather than granting access to all websites. Right-click the extension icon to manage site access.

Recommended Security-Focused Extensions

uBlock Origin

Purpose: Wide-spectrum content blocker (ads, trackers, malware)

Why it's safe: Open source, efficient, highly configurable, privacy-respecting, no acceptable ads program.

Privacy Badger

Purpose: Automatically learns to block invisible trackers

Why it's safe: Created by EFF, open source, doesn't use blocklists (learns from behavior), minimal permissions.

HTTPS Everywhere

Purpose: Automatically upgrades connections to HTTPS

Why it's safe: EFF project, open source, simple functionality, no data collection, now built into most browsers.

Bitwarden

Purpose: Password manager browser extension

Why it's safe: Open source, audited encryption, minimal permissions, reputable company, self-hosting option.

Extension Audit Checklist: Monthly review - Open your extensions page, remove unused extensions, check for updates, review permissions, research any unfamiliar extensions, verify developers haven't changed.

Browser Security Quiz

Score: 0 / 10
Answer all questions to see your final score