Start with an inventory
A browser extension that changes your wallpaper would like to read every website you visit. An ambitious interior decorator.
Begin on your own desktop browser. Update it, reopen it if requested, and list three things that must still work: email, a routine sign-in, and a camera or microphone test if you use web calls. Avoid using a purchase or money transfer as a test.
Open the printable browser audit sheet. Record the old setting before each change. Leave passwords and browsing history out of it. Work or school policy may lock some settings; take those questions to the administrator instead of installing a workaround.
Give each extension a job interview
Open the browser’s extensions or add-ons manager. For every item, ask: Do I recognize the publisher? Do I still use it? Does its requested site access fit its job? Broad permission is a reason to investigate, not proof of malicious behavior.
In Firefox, use Menu → Add-ons and themes → Extensions. Disable one nonessential extension, reload your ordinary test pages, and check the result. Re-enable it if an essential feature depends on it. When you understand the dependency and no longer need the extension, remove it through the manager. Mozilla explains disabling and removal.
For Chrome, open Menu → Extensions → Manage extensions and inspect each extension’s Details, including site access. Google’s extension management reference covers these controls. Keep a password manager you rely on available until you have checked your sign-in route. Clearing out extensions should not become an impromptu account-recovery experiment.
Take back permissions you no longer use
Review notifications, location, camera, and microphone access. Revoke old permissions for sites you no longer use. Prefer granting access when a feature needs it, rather than leaving a long guest list.
In Chrome on desktop, open Settings → Privacy and security → Site settings. Review the permission categories or choose a particular site. The controls beside a site’s address also lead to its settings. Chrome’s permission reference describes the available options.
In Firefox, a Permissions icon appears beside the address when a site has special permissions. Clearing an entry restores its default behavior; Firefox’s permissions reference also explains the fuller Page Info panel.
After revoking camera or microphone permission, return to a service you intentionally use and check its preview. Grant access to that site if needed. A permission reset can produce a fresh prompt; that is a result to inspect, not a reason to allow everything again.
Check protection before adding another product
Firefox’s Standard Enhanced Tracking Protection is enabled by default. Its cookie isolation limits reuse of third-party cookies between sites; it does not hide your identity when you sign in. Start by understanding the existing protection rather than adding several overlapping privacy extensions.
If you choose to try Strict mode, make that one separate experiment. Reload your test pages and check logins, embedded content, and ordinary navigation. Return to Standard if the change breaks something you need. Mozilla documents the protection levels and compatibility tradeoffs. Record any site-specific exception and why you made it.
Do not disable browser security checks to repair a privacy-setting problem. Clearing every cookie is also a different action: it can sign you out and remove preferences. Save that for a deliberate decision with your account recovery routes ready.
Separate contexts, then verify the result
A separate browser profile for work or personal tasks can reduce accidental mixing of sessions and extensions. It does not make you anonymous, and signing into the same account still identifies you to that service. Private windows are temporary sessions, not invisibility equipment.
- Revisit the extension list. Confirm the intended item is disabled or removed.
- Reopen the relevant site permission and confirm its current value.
- Check your three baseline tasks. Record failures alongside successes.
- Undo the last change first if a failure appeared immediately afterward.
Next, review what a VPN changes. Browser permissions, account logins, and network routing solve different parts of the problem.