user.js

// Any comment. You must start the file with a comment!
user_pref("storage.nfs_filesystem", true);
//disable Captive Portal detection https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy
user_pref("network.captive-portal-service.enabled",false);
user_pref("captivedetect.canonicalURL", "");
//disable Network Connectivity checks
user_pref("network.connectivity-service.enabled", false);

// Don't show WhatsNew on first run after every update
user_pref("browser.startup.homepage_override.mstone","ignore");

//disable slowStartup Notification
user_pref("browser.slowStartup.notificationDisabled", true);
user_pref("browser.slowStartup.maxSamples", 0);
user_pref("browser.slowStartup.samples", 0);
user_pref("browser.rights.3.shown", true);
user_pref("startup.homepage_welcome_url", "");
user_pref("startup.homepage_welcome_url.additional", "");
user_pref("startup.homepage_override_url", "");
user_pref("browser.laterrun.enabled", false);
//disable default browser check
user_pref("browser.shell.checkDefaultBrowser", false);

//FPP use system fonts
user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!");

//disable daily pings to Mozilla about extensions and recent startup
user_pref("extensions.getAddons.cache.enabled", false);

//disable sending the URL of the website where a plugin crashed
user_pref("dom.ipc.plugins.reportCrashURL", false);

//disable auto update for extensions
user_pref("extensions.update.autoUpdateDefault", false);

//disable about:addons' Get Add-ons panel (uses Google-Analytics)
user_pref("extensions.getAddons.showPane", false); // hidden user_pref
user_pref("extensions.webservice.discoverURL", "");

// Set default homepage - users can change
// Requires a complex user_preference
user_pref("browser.startup.homepage","");

// Don't ask to install the Flash plugin
user_pref("plugins.notifyMissingFlash", false);

// Disable upload of health reports
user_pref("datareporting.healthreport.uploadEnabled", false);
//disable about:healthreport page (which connects to Mozilla for locale/css+js+json)
user_pref("datareporting.healthreport.about.reportUrl", "data:text/plain,");

// Disable all data upload (Telemetry and FHR)
user_pref("toolkit.telemetry.unified", false);
user_pref("toolkit.telemetry.enabled", false);
user_pref("toolkit.telemetry.server", "");
user_pref("toolkit.telemetry.newProfilePing.enabled", false);
user_pref("toolkit.telemetry.shutdownPingSender.enabled", false);
user_pref("toolkit.telemetry.updatePing.enabled", false);
user_pref("toolkit.telemetry.bhrPing.enabled", false);
user_pref("toolkit.telemetry.firstShutdownPing.enabled", false);
user_pref("toolkit.telemetry.cachedClientID", "");
user_pref("toolkit.telemetry.archive.enabled", false);
user_pref("datareporting.policy.dataSubmissionEnabled", false);
user_pref("browser.ping-centre.telemetry", false);

//disable "Snippets" (Mozilla content shown on about:home screen)
user_pref("browser.aboutHomeSnippets.updateUrl", "https://127.0.0.1"); //test

//disable experiments https://wiki.mozilla.org/Telemetry/Experiments
user_pref("experiments.enabled", false);
user_pref("experiments.manifest.uri", "");
user_pref("experiments.supported", false);
user_pref("experiments.activeExperiment", false);
// disable Mozilla permission to silently opt you into tests
user_pref("network.allow-experiments", false);

/* 0206: disable geographically specific results/search engines e.g. "browser.search.*.US"
 * i.e. ignore all of Mozilla's various search engines in multiple locales ***/
user_pref("browser.search.geoSpecificDefaults", false);
user_pref("browser.search.geoSpecificDefaults.url", "");

// 0202: disable using the OS's geolocation service
user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
user_pref("geo.provider.use_corelocation", false); // [MAC]
user_pref("geo.provider.use_gpsd", false); // [LINUX]

/* 0503: disable Normandy/Shield [FF60+]
 * Shield is an telemetry system (including Heartbeat) that can also push and test "recipes"
 * [1] https://wiki.mozilla.org/Firefox/Shield
 * [2] https://github.com/mozilla/normandy ***/
user_pref("app.normandy.enabled", false);
user_pref("app.normandy.api_url", "");
user_pref("app.shield.optoutstudies.enabled", false);

/* 0601: disable link user_prefetching
 * [1] https://developer.mozilla.org/docs/Web/HTTP/Link_user_prefetching_FAQ ***/
user_pref("network.user_prefetch-next", false);
/* 0602: disable DNS user_prefetching
 * [1] https://www.ghacks.net/2013/04/27/firefox-user_prefetching-what-you-need-to-know/
 * [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
user_pref("network.dns.disablePrefetch", true);
user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF ESR] [DEFAULT: true FF70+]
/* 0603: disable predictor / user_prefetching ***/
user_pref("network.predictor.enabled", false);
user_pref("network.predictor.enable-user_prefetch", false); // [FF48+]

//https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6)
user_pref("network.dns.disableIPv6", true);

/* 0320: disable about:addons' Recommendations pane (uses Google Analytics) ***/
user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
//disable personalized Extension Recommendations in about:addons
user_pref("browser.discovery.enabled", false);

//disable pocket
user_pref("extensions.pocket.enabled", false);

//disable flyweb https://flyweb.github.io/
user_pref("dom.flyweb.enabled", false);

//disable Shield https://wiki.mozilla.org/Firefox/Shield
user_pref("extensions.shield-recipe-client.enabled", false);
user_pref("extensions.shield-recipe-client.api_url", "");

//disable Follow on Search and Activity Stream
user_pref("browser.newtabpage.activity-stream.enabled", false);
user_pref("browser.library.activity-stream.enabled", false);
//Activity Stream is the default homepage/newtab based on metadata and browsing behavior
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
user_pref("browser.newtabpage.activity-stream.showSponsored", false);
user_pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false);
user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false);

//disable link-mouseover opening connection to linked server
user_pref("network.http.speculative-parallel-limit", 0);
//disable mousedown speculative connections on bookmarks and history
user_pref("browser.places.speculativeConnect.enabled", false);

//disable pings (but enforce same host in case)
user_pref("browser.send_pings", false);
user_pref("browser.send_pings.require_same_host", true);

/* disable GIO as a potential proxy bypass vector
 * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer,
 * dav, cdda, gphoto2, trash, etc. By default only sftp is accepted (FF87+)
 * [1] https://bugzilla.mozilla.org/1433507
 * [2] https://en.wikipedia.org/wiki/GVfs
 * [3] https://en.wikipedia.org/wiki/GIO_(software) ***/
user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF]

//disable location bar using search - PRIVACY
user_pref("keyword.enabled", false);
/* 0802: disable location bar domain guessing
 * domain guessing intercepts DNS "hostname not found errors" and resends a
 * request (e.g. by adding www or .com). This is inconsistent use (e.g. FQDNs), does not work
 * via Proxy Servers (different error), is a flawed use of DNS (TLDs: why treat .com
 * as the 411 for DNS errors?), privacy issues (why connect to sites you didn't
 * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack),
 * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/
user_pref("browser.fixup.alternate.enabled", false);

/* 0806: disable location bar leaking single words to a DNS provider **after searching** [FF78+]
 * 0=never resolve single words, 1=heuristic (default), 2=always resolve
 * [1] https://bugzilla.mozilla.org/1642623 ***/
user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);

/* 0807: disable location bar contextual suggestions [FF92+]
 * [SETTING] Privacy & Security>Address Bar>Suggestions from...
 * [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/
user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+]
user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false);

//disable location bar domain guessing - PRIVACY/SECURITY
user_pref("browser.fixup.alternate.enabled", false);

//display all parts of the url in the location bar - helps SECURITY
user_pref("browser.urlbar.trimURLs", false);

//disable location bar making speculative connections (FF56+)
user_pref("browser.urlbar.speculativeConnect.enabled", false);

//disable SSL session tracking test
user_pref("security.ssl.disable_session_identifiers", true);

//disable SSL Error Reporting
user_pref("security.ssl.errorReporting.automatic", false);
user_pref("security.ssl.errorReporting.enabled", false);
user_pref("security.ssl.errorReporting.url", "");

//disable the DNT HTTP header, which is essentially USELESS
user_pref("privacy.donottrackheader.enabled", false);

//set max popups from a single non-click event - default is 20!
user_pref("dom.popup_maximum", 3);

//limit events that can cause a popup default is "change click dblclick mouseup pointerup notificationclick reset submit touchend"
user_pref("dom.popup_allowed_events", "click dblclick");

//enable Firefox's built-in PDF reader
user_pref("pdfjs.disabled", false);

//session restore save time
user_pref("browser.sessionstore.interval",150000);

//enable legacy extensions
user_pref("extensions.legacy.enabled",true);

//disable firefox refresh request
user_pref("browser.disableResetPrompt",true);

//disable translation popups
defaultPref("browser.translations.automaticallyPopup",false);