You've done it. I've done it. Everyone has done it.

A website pops up with a cookie banner, and without even reading it, you click "Accept All" just to make it disappear. Then you open an incognito window and feel vaguely protected — like pulling a hood up in a rainstorm made of data.

Here's the thing though: incognito mode mostly just hides your history from other people using your device. Websites still see you. Trackers still follow you. And your internet provider? Absolutely still watching.

The good news is your browser already has tools to seriously limit all of that. They're just buried. Most people never find them.

Let's change that.

Why Your Default Settings Are Working Against You

Browsers ship configured for convenience, not privacy. That's not a conspiracy — it's a business model. Chrome is made by Google, a company whose core revenue is advertising. Safari is better, but Apple still has its own interests. Even Firefox, the most privacy-forward of the mainstream options, doesn't enable everything by default.

The result is a browser that feels private but quietly leaks a surprising amount about you — your location, your browsing habits, even a kind of digital fingerprint made from your screen size, installed fonts, and time zone that can identify you even without cookies.

You don't need to become a security researcher to fix this. You just need to know where to look.

The Settings Worth Turning On Today

1. DNS-over-HTTPS — Your Browsing Requests Are More Public Than You'd Guess

Every time you type a web address, your browser sends a request to a DNS server — basically a phonebook that translates "google.com" into a real IP address your computer can reach. By default, that request travels in plain text. Anyone between you and that server can read it: your ISP, your coffee shop's Wi-Fi router, whoever.

DNS-over-HTTPS (DoH) encrypts those requests so they can't be snooped on.

To turn it on:

  • Chrome: Settings → Privacy and Security → Security → Use secure DNS
  • Firefox: Settings → Privacy & Security → scroll to DNS over HTTPS
  • Edge: Settings → Privacy, search, and services → Security → Use secure DNS

Pick Cloudflare (1.1.1.1) or NextDNS as your provider. Both are fast and privacy-respecting.

2. HTTPS-Only Mode — Because Not Every Site Plays It Safe

You've probably noticed the little padlock icon in your browser's address bar. That means the connection to that site is encrypted via HTTPS. Without it, anything you type — passwords, form data — can be intercepted.

HTTPS-Only Mode forces your browser to always use the encrypted version of a site when one exists. If it doesn't exist, your browser warns you before loading anything.

Find it under Privacy or Security settings in every major browser. Turn it on. Leave it on.

3. Global Privacy Control — A Better "Do Not Track"

You might remember "Do Not Track" — a browser setting from years ago that politely asked websites not to follow you around the internet. Websites mostly ignored it because there was no legal obligation to comply.

Global Privacy Control (GPC) is its more serious successor. In several U.S. states and across the EU, it carries actual legal weight — websites receiving the GPC signal are required by law to honor it as an opt-out of data sales.

Firefox has it built in. Chrome users can add it via the DuckDuckGo Privacy Essentials extension.

4. The Permissions You Forgot You Gave

Think about every site you've visited in the last year. How many of them asked for your location? Your microphone? Permission to send notifications?

Some of those you probably approved without thinking. And they're still approved right now.

Every browser lets you audit and revoke these under Settings → Privacy → Site Permissions (or similar). Spend two minutes there. You'll almost certainly find something surprising — a random news site with microphone access, a shopping app that still knows your location.

Revoke anything that doesn't make immediate sense.

This one's a bit more technical sounding but stick with me.

Normally, tracking cookies can follow you across websites — a tracker on a recipe blog can recognize you when you visit a shoe store. These two features prevent that by essentially sandboxing each site's cookies so they can only be seen by the site that created them.

Firefox enables Total Cookie Protection by default in its standard mode. In Chrome, search chrome://flags for "Strict Origin Isolation" and enable it.

Your 10-Minute Privacy Audit

Here's the actual to-do list, because we've covered enough theory:

  1. Enable DNS-over-HTTPS with Cloudflare or NextDNS
  2. Turn on HTTPS-Only Mode
  3. Audit and revoke stale site permissions
  4. Enable or install Global Privacy Control
  5. Confirm Total Cookie Protection or Strict Site Isolation is active

That's it. Seriously.

None of this requires a computer science degree. It doesn't mean installing sketchy software or giving up websites you love. It's just five settings most people skip because nobody told them they existed.

Now you know. Ten minutes, and your browser works for you instead of around you.