Browser Privacy and Security Settings Guide: The Chrome, Edge, Safari and Firefox Settings That Matter

Most people never open their browser's privacy and security settings, yet a handful of switches there decide how well the browser warns you about scam sites, who can follow you across the web and which sites can use your camera, location or notifications. Browser privacy and security settings are the built-in controls in Chrome, Edge, Safari and Firefox that govern dangerous-site warnings, tracking and cookies, saved passwords, encrypted connections and site permissions. This guide explains, in plain English, what each important setting does, where to find it and which level suits most people. It is written for home users and for anyone helping family or colleagues tidy up their browsers. Browsers are listed alphabetically by maker's product name where they are compared, and the order is not a ranking. Organisations that manage browsers centrally should also read the Browser Security Hardening Guide.

Key takeaways

• Dangerous-site warnings come first. Keep Safe Browsing (Chrome), SmartScreen (Edge), the fraudulent website warning (Safari) or Firefox's deceptive content protection switched on; turning them off removes your main defence against phishing pages and harmful downloads.
• Tracking protection has levels, not just on and off. Edge offers Basic, Balanced and Strict, Firefox offers Standard, Strict and Custom; the default middle level suits most people, and the stricter level trades some site breakage for more privacy.
• Site permissions deserve a regular review. Camera, microphone, location and notification permissions are granted one click at a time and quietly pile up; a five-minute review removes most of the risk.
• Saved passwords are only as safe as the device and account behind them. A browser's built-in password manager is reasonable on your own devices with a screen lock and two-step verification on the browser account, but not on a shared computer.
• Private windows are not invisible. Incognito and InPrivate stop the browser keeping history on your device; they do not hide you from websites you sign into, your employer or your internet provider.

What it is

Every modern browser has a privacy and security area in its settings. In Chrome it is Settings > Privacy and security; in Edge it is edge://settings/privacy; in Firefox it is Settings > Privacy & Security; in Safari on a Mac it is split between Safari > Settings > Privacy and Safari > Settings > Security. The names differ, but the same five groups of controls appear in all four browsers:

• Dangerous-site and download protection: checks the pages you visit and the files you download against lists of known phishing and malware sites, and warns you before you continue.
• Tracking protection and cookies: limits how advertising and analytics companies follow you from one website to another using cookies, hidden scripts and fingerprinting.
• Passwords and autofill: stores your passwords and card details, fills them in, and in some browsers warns when a saved password has appeared in a data breach.
• Connection security: encrypted web connections (HTTPS) and encrypted look-ups of website addresses (secure DNS).
• Site permissions: what each website is allowed to do on your device, such as use the camera, read your location or send notifications.

The settings side by side

Menu wording changes between browser versions and between desktop and mobile, so treat the paths as a guide and use the settings search box if a name has moved.

How it works

Dangerous-site protection

Google's help pages describe three Safe Browsing levels in Chrome. Standard protection, the default, warns about sites, downloads and extensions already known to be dangerous. It sends an obfuscated part of each address through privacy servers, so that neither Google nor the server operator sees both the address and your IP address, and sends full addresses only when a site behaves suspiciously. Enhanced protection sends more: the address, a small sample of page content, extension activity and system information, with deeper scans of suspicious downloads. In return it can warn about threats Google has not seen before and warns if you use a password found in a data breach. No protection switches all of this off, and Google marks it as not recommended. Safari's equivalent is Warn when visiting a fraudulent website in the Security pane.

Which level to choose: Standard is a sound default. Enhanced makes sense for people who are often targeted by scams or who click links in messages a lot, provided they are comfortable with more browsing data going to Google for security checks. Never choose No protection.

Tracking protection and cookies

Microsoft's documentation explains Edge's three tracking prevention levels. Basic blocks only harmful trackers such as fingerprinters and cryptominers. Balanced, the default, also blocks trackers from sites you have never engaged with, aiming for fewer personalised adverts without breaking sites. Strict blocks most trackers across all categories and can break some sites. By default InPrivate windows use the same level as normal windows, but you can turn on Always use "Strict" tracking prevention when browsing InPrivate.

Mozilla describes Firefox's Standard mode as blocking social media trackers, cryptominers, fingerprinters and cross-site tracking cookies, with Total Cookie Protection on by default, which keeps each cookie confined to the site that created it. Strict blocks all cross-site cookies and tracking content in every window and adds bounce tracking protection, at the cost of more breakage in logins, payments, comments and videos. The shield icon to the left of the address bar shows what was blocked on the current page and lets you relax protection for one site.

Apple's Prevent cross-site tracking setting in Safari deletes a third-party content provider's cookies and website data unless you visit and interact with that provider directly. Safari also presents a simplified version of your system configuration to websites so your Mac looks more like everyone else's, which makes fingerprinting harder. The Privacy Report lists the known trackers Safari has blocked.

Encrypted connections

HTTPS encrypts the page between the website and your browser. Firefox's HTTPS-Only Mode upgrades plain http:// addresses to HTTPS and, if a site has no secure version, shows a "Secure Site Not Available" page so you can choose whether to continue. Chrome has a matching Always use secure connections option, and Safari can warn before connecting to a website over HTTP.

Secure DNS encrypts the look-up that turns a website name into an address. Google's help explains that in Chrome's automatic mode the browser falls back to an unencrypted look-up if the encrypted one fails, while choosing a custom provider removes that fallback. Secure DNS is unavailable on managed devices or when parental controls are on, because those rely on seeing the look-ups.

Site permissions

In Chrome, Settings > Privacy and security > Site settings lists every permission: location, camera, microphone, notifications, pop-ups and redirects, automatic downloads, clipboard, file editing, USB, Bluetooth, payment handlers and more. View permissions and data stored across sites shows each site's grants, and for a single site the icon to the left of the address opens its settings and a Reset permissions button. Google says Chrome now removes permissions from sites you have not used recently, and Safety Check also removes notification permission from sites Safe Browsing finds deceptive.

Passwords and autofill

All four browsers can save passwords. Chrome's Safety Check looks for compromised, reused and weak passwords in Google Password Manager, and Apple's Passwords app shows similar security recommendations. The UK National Cyber Security Centre (NCSC) says a browser's built-in password manager is fine on your own devices but should not be used on shared or public computers. Protect the account that syncs the passwords with a strong password and two-step verification, and keep a screen lock on every device. See the Password Managers Explained for Everyone Guide for choosing between a browser's manager and a separate app.

A ten-minute tidy-up

1. Update the browser, then restart it.
2. Check dangerous-site protection is on (Standard or Enhanced in Chrome).
3. Leave tracking protection at the default level, or move to Strict and relax it per site if something breaks.
4. Turn on HTTPS-only or Always use secure connections.
5. Run the password check and change any breached or reused password, starting with email and banking.
6. Open site permissions, remove notification, location, camera and microphone grants you do not recognise.
7. Review extensions and remove any you no longer use.

How to tell it is working: the browser shows a red warning page on a known phishing test site, the password check reports zero compromised passwords, the notification permission list contains only sites you chose, and you no longer see unexpected "virus alert" pop-ups.

Why it matters

The browser is where most scams land: a text message or email links to a fake bank, delivery or tax page, and the browser is the last point where a warning can stop you entering details. Dangerous-site protection blocks many of these pages before they load. Notification spam is a common route to tech-support scams, because a single accidental "Allow" lets a site show alerts that look like they come from your computer. Saved passwords that were exposed in a breach are the starting point for account takeover, and password checks find them. Tracking protection matters for privacy rather than for stopping theft: it limits the profile that advertising networks and data brokers can build about your interests, health worries and location. Extensions sit on top of all of this and can read every page; the Browser Extension Security Guide covers them in depth.

Common misconceptions

• "Private browsing makes me anonymous." Google's help is explicit that Incognito does not hide your activity from websites you sign into, your employer or school, or your internet provider. It only stops history and cookies being kept on your device after you close the window.
• "Strict tracking protection is always better." It gives more privacy but can break logins, payment pages and embedded videos. Start with the default and switch up if you are comfortable relaxing protection for individual sites.
• "Enhanced protection means Google sees everything." It does send more data, including addresses and samples of page content, but Google states the data is used for security purposes. Standard protection sends far less and is still a sound choice.
• "Clearing cookies is a privacy fix." It removes existing trackers but also signs you out of every site, and tracking resumes as you browse. Tracking protection settings do more, continuously.
• "The padlock means the site is safe." HTTPS means the connection is encrypted, not that the site is honest. Phishing sites routinely use HTTPS.
• "Secure DNS hides my browsing." It encrypts the name look-up only; the websites themselves, and your internet provider through other signals, can still see where you connect.

Related concepts

• Browser extensions: add-ons that can read and change pages. See the Browser Extension Security Guide.
• Privacy-focused browsers and search engines: alternatives that change the defaults. See the Privacy-Respecting Browsers and Search Guide.
• Two-step verification: protects the account that syncs your passwords and history. See the Two-Factor Authentication for Everyone Guide.
• Password managers: setting one up properly, including moving passwords out of the browser. See the Password Manager Setup Guide.
• Phishing: recognising the messages that lead to fake pages. See the How to Spot a Phishing Email Guide.
• Managed browsers at work: policies pushed by an employer override many of these settings. See the Browser Security Hardening Guide.

Practitioner checklist

• Browser updated and set to update automatically.
• Dangerous-site protection on in every browser on the device (never "No protection").
• Tracking protection at the default level or stricter; Strict in private windows where offered.
• HTTPS-only or Always use secure connections switched on.
• Password check run, and every breached or reused password changed.
• Browser sync account protected with two-step verification; saved passwords not used on shared computers.
• Notification, location, camera and microphone permissions reviewed and trimmed.
• Unused extensions removed.

Standards and references

• Google Chrome Help: Choose your Safe Browsing protection level
• Google Chrome Help: Change site settings permissions
• Google Chrome Help: Manage Chrome safety and security
• Microsoft Learn: Tracking prevention in Microsoft Edge
• Mozilla Support: Enhanced Tracking Protection in Firefox for desktop
• Mozilla Support: HTTPS-Only Mode in Firefox
• Apple Support: Prevent cross-site tracking in Safari on Mac
• NCSC: Password managers

Related NHI Mgmt Group resources: Browser Extension Security Guide · Privacy-Respecting Browsers and Search Guide · Password Manager Setup Guide · Browser Security Hardening Guide