How to make sure that a Firefox plugin never activates (again) - gHacks Tech News

How to make sure that a Firefox plugin never activates (again)

The web is moving away from plugins which is a good thing as it reduces the risk of falling pray to security attacks that target old versions of plugins or use 0-days to attack even the latest versions. Some plugins do cling on however despite the move to HTML5 and JavaScript. Especially Java and Flash need to be mentioned here, but chance is that your browser picked up quite a few plugins along the way.

Firefox is still picking up plugins that get installed on the system automatically which can be quite problematic if you do not want the browser to do so. Say, you are installing Google Chrome on your computer. Firefox will pick up the Google Update plugin no matter what unless you have configured the browser to block some plugin locations Firefox scans or the installation of all new add-ons or plugins.

With Firefox 22 came a change to how the browser is handling plugin status information. While it is still enabling new plugins that it discovers out of the box, it provides users of the browser with a new option to keep those plugins in check.

Managing plugins

Before I start to explain how you can configure Firefox plugins to remain disabled, or active at all times, I'd like to provide you with a quick overview of how you can manage plugins in the browser. This is important as it provides you with an overview of the plugins that are currently installed in the browser.

1. about:addons

firefox plugins

When you open that internal page and switch to plugins on it, you are presented with a list of installed plugins. Each plugin can be set to one of the following states:

  1. Never activate means it is disabled.
  2. Always activate means it is enabled.
  3. Ask to activate enables click to play.

2. about:plugins

installed plugins

This internal page provides you with detailed information about the plugins that Firefox has picked up. While it does not reveal if a plugin is enabled or not, it lists the full path of the plugin and all files that are associated with it.

This can be really useful to find out why two Adobe Flash Player plugins got picked up, or from where a plugin got picked up that suddenly turned up in the browser.

A permanent state

You can set permanent states for plugins. This can be useful if you want plugins never to be enabled again in the browser. A simple scenario where this may come in handy is the following: you want to make sure that Google Update is not enabled in Firefox. If you uninstall Google Chrome and install it again at a later time, it may get picked up by Firefox again and activated as a consequence even if you do not want that to happen.

Here is what you need to do:

  1. Type about:config in the browser's address bar and hit the enter key.
  2. Confirm that you will be careful if this is the first time you are opening the page.
  3. Filter for plugin.state using the search box.

You see a list of plugins here. They may have a value of 0, 1 or 2, or no value.

  • 0 means it is disabled.
  • 1 means click to play is active
  • 2 means it is enabled
  • no value means it has not been configured yet

If you see a value of 0, 1 or 2 here right-click the preference and select reset. This sets it to the default value. Now, double-click the value and change it to the one of the values, e.g. 0 to disable it.

plugin state

If you go to about:addons afterwards and try to change the plugins state here, you will notice that it blocks that from happening.

Closing Words

If you want to make sure that plugins never reactivate in Firefox, use the process outlined above to make sure of that. It provides you with a second option - the other is to block plugin scans in select directories directly so that plugins that you do not want to work with are not even picked up initially by Firefox.

We need your help

Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.

We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats (video ads) or subscription fees.

If you like our content, and would like to help, please consider making a contribution:

Comments

  1. Taomyn said on July 9, 2013 at 6:00 am
    Reply

    Errmm…I have a feeling the new tri-states for plugins isn’t in FF22, at least my copy isn’t showing them and just has the “enable/disable” buttons.

    I can see in your shots you have “Nightly” so maybe it’s an upcoming feature?

    1. Martin Brinkmann said on July 9, 2013 at 6:04 am
      Reply

      You are right, it is not in Firefox 22. I’m usually running the Nightly version of the browser. The plugin states that you can set in the about:config should however be there. Can you check that?

      1. Taomyn said on July 9, 2013 at 6:58 am
        Reply

        Yes, the plug-in states are there but only appear if you disable something the first time therefore my first check resulted in no entries. Once I disabled a plugin it the entry for it was there.

  2. Ed said on July 9, 2013 at 6:40 am
    Reply

    Nope, no plugin.state key in about:config for Firefox 22.0.

  3. hessam said on July 9, 2013 at 7:09 am
    Reply

    hi,
    why your first page changed?
    its changed to black and white

    http://a0.vsoh.com/imazrm.png

    1. Martin Brinkmann said on July 9, 2013 at 7:28 am
      Reply

      You are somehow being redirected to the mobile version, not sure why. I have deleted the cache, can you try again please? Also, can you please Hit Ctrl-F5 when you are on the page to see if it resolves the issue?

  4. hessam said on July 9, 2013 at 7:32 am
    Reply

    thank you very much it fixed and page open normally:)

  5. Ken Saunders said on July 9, 2013 at 2:42 pm
    Reply

    Odd stuff.

    Firefox 22 for me just shows plugin.state.np32dsw which is Shockwave for Director. I only have Flash Player and Shockwave, only Flash is enabled.

    In Nightly however, several are listed (plugin.state) including Java, iTunes, Google Earth, and some others even though those plugins don’t exist. They once did, but I deleted them.
    Nightly isn’t installed on my system, and it’s on a different hard drive (it’s essentially a portable version), so I wonder if that matters even though the profile is stored in the default Firefox profiles location.

    I can’t seem to find any documentation about plugin.state. Can you?

  6. Ken Saunders said on July 9, 2013 at 2:56 pm
    Reply

    I deleted them from prefs.js (the Nightly profile) and now they’re gone.
    It’s odd that the Nightly plugin.state entries didn’t show in other Firefox profiles.

  7. Karl J. Gephart said on July 10, 2013 at 12:47 am
    Reply

    Martin, silly question but I’m going to ask it, is there any way in Windows to reactivate a plugin that crashes w/o restarting Windows? Shockwave Director crashes once nightly after a full day or work every day for me, causing YouTube vids not to play. Any fast way w/o rebooting?

    1. fokka said on July 10, 2013 at 1:30 am
      Reply

      have you tried logging off and on again?

      sometimes that’s enough to fix a couple things.

      1. Karl J. Gephart said on July 10, 2013 at 4:52 am
        Reply

        Yeah, same as reboot – no difference in behavior. The plugin hasn’t been needing an update until tonight, so I’m going to try it and hope that fixes it! :)

    2. Ken Saunders said on July 10, 2013 at 6:16 pm
      Reply

      Do you mean Shockwave Flash? That plugin allows for the playing of Flash videos. Reloading the page that the video or game is on is usually all that you need to do to reactivate the plugin.

      Check out the following two pages.
      https://support.mozilla.org/en-US/kb/keep-flash-up-to-date-and-troubleshoot-problems

      https://support.mozilla.org/en-US/kb/troubleshoot-issues-with-plugins-fix-problems

  8. David said on July 23, 2013 at 2:00 pm
    Reply

    Reloading the page works mostly very well, although I had some problems with Shockwave Flash and needed to restart the whole browser in order to make it work.
    @Ken Thanks for the links, I didn’t search there before but the threads on the support pages seem to be really helpful, the lack of new updates was the problem in my plug-in too :-)

Leave a Reply