The modern web: a practical privacy and resilience checklist

A page can be fast and still collect too much. A browser can block ads and still expose identifying signals. The right starting point is the risk you want to reduce.

Name the threat model

Write down whether your concern is intrusive advertising, cross-site tracking, malware, account compromise or losing access when a script fails. These are different problems. The W3C notes that browser fingerprinting can identify or re-identify a user through observable characteristics, sometimes across sites. Blocking a cookie does not automatically remove every fingerprinting surface.

Reduce unnecessary dependencies

Prefer pages that remain readable without a chain of third-party scripts. Review browser extension permissions; an extension with broad access can become another point of trust. Choose a maintained browser and update it. For a site you operate, minimize third-party requests, document the services that are necessary and test the core content with scripts unavailable.

Test rather than worship a brand

Compare the same journey in two browser configurations: load, readability, sign-in and privacy controls. Do not claim complete anonymity from a toggle or a blocker. A setting that breaks a needed workflow may not be adopted. Record the trade-off and revisit it when browsers, sites or your threat model change.

Try it on a real case

A small publication removes an unnecessary analytics script, keeps its article text server-rendered and tests the page with JavaScript disabled. Readers can still read and navigate; the editors document the one external service they retain.

Limit: Privacy tools reduce exposure; they do not make a user invisible or remove the need for safe account practices.