How to make sure that a Firefox plugin never activates (again)

The web is moving away from plugins which is a good thing as it reduces the risk of falling pray to security attacks that target old versions of plugins or use 0-days to attack even the latest versions. Some plugins do cling on however despite the move to HTML5 and JavaScript. Especially Java and Flash need to be mentioned here, but chance is that your browser picked up quite a few plugins along the way.

Firefox is still picking up plugins that get installed on the system automatically which can be quite problematic if you do not want the browser to do so. Say, you are installing Google Chrome on your computer. Firefox will pick up the Google Update plugin no matter what unless you have configured the browser to block some plugin locations Firefox scans or the installation of all new add-ons or plugins.

With Firefox 22 came a change to how the browser is handling plugin status information. While it is still enabling new plugins that it discovers out of the box, it provides users of the browser with a new option to keep those plugins in check.

Managing plugins

Before I start to explain how you can configure Firefox plugins to remain disabled, or active at all times, I'd like to provide you with a quick overview of how you can manage plugins in the browser. This is important as it provides you with an overview of the plugins that are currently installed in the browser.

1. about:addons

When you open that internal page and switch to plugins on it, you are presented with a list of installed plugins. Each plugin can be set to one of the following states:

1. Never activate means it is disabled.
2. Always activate means it is enabled.
3. Ask to activate enables click to play.

2. about:plugins

This internal page provides you with detailed information about the plugins that Firefox has picked up. While it does not reveal if a plugin is enabled or not, it lists the full path of the plugin and all files that are associated with it.

This can be really useful to find out why two Adobe Flash Player plugins got picked up, or from where a plugin got picked up that suddenly turned up in the browser.

A permanent state

You can set permanent states for plugins. This can be useful if you want plugins never to be enabled again in the browser. A simple scenario where this may come in handy is the following: you want to make sure that Google Update is not enabled in Firefox. If you uninstall Google Chrome and install it again at a later time, it may get picked up by Firefox again and activated as a consequence even if you do not want that to happen.

Here is what you need to do:

1. Type about:config in the browser's address bar and hit the enter key.
2. Confirm that you will be careful if this is the first time you are opening the page.
3. Filter for plugin.state using the search box.

You see a list of plugins here. They may have a value of 0, 1 or 2, or no value.

• 0 means it is disabled.
• 1 means click to play is active
• 2 means it is enabled
• no value means it has not been configured yet

If you see a value of 0, 1 or 2 here right-click the preference and select reset. This sets it to the default value. Now, double-click the value and change it to the one of the values, e.g. 0 to disable it.

If you go to about:addons afterwards and try to change the plugins state here, you will notice that it blocks that from happening.

Closing Words

If you want to make sure that plugins never reactivate in Firefox, use the process outlined above to make sure of that. It provides you with a second option - the other is to block plugin scans in select directories directly so that plugins that you do not want to work with are not even picked up initially by Firefox.

Advertisement