Security · Topic 13 of 13
Browser Security Settings
Configure browser security: trusted downloads, extensions, password managers, HTTPS and certificates, pop up blockers, cache clearing and private mode.
- 4 min
- Get browsers and extensions only from official sources.
- Extensions can read page data, so keep them minimal.
- A padlock means encrypted, not safe.
What it is
The web browser is the most used program on a workstation and a main route for attacks. A technician configures it to limit risky downloads, protect stored credentials and warn about unsafe sites. Most settings are in the browser's Settings page.
How it works
Trusted sources for browsers and downloads
Install the browser only from the vendor's official website or the operating system's store. A fake browser installer from a search ad or a third party site can carry malware.
Files should also come from trusted sources. For software that publishes a checksum, comparing the hash of the download with the published value confirms the file was not changed.
Extensions and plug-ins
Extensions add features, but each one can read page content, so they are a risk. Install only what is needed from the official extension store, review the permissions requested, and remove extensions that are unused or unknown. Unexpected toolbars, a changed home page or a new search engine suggest a malicious extension.
Password managers
A browser password manager saves and fills passwords. It supports long unique passwords, and it fills only on the matching site, which helps against fake sites. Protect it with a strong master password or the device sign in, and consider a separate dedicated manager for larger needs.
Secure connections and certificates
HTTPS (Hypertext Transfer Protocol Secure) encrypts traffic between browser and website. In many browsers a padlock icon shows that the connection is encrypted and that the site has a certificate that the browser trusts. The padlock does not prove that the site itself is honest, since criminals also use HTTPS.
A certificate warning means the browser cannot trust the site's certificate. Common reasons are an expired certificate, a name that does not match, or an untrusted issuer. On a site where you would enter data, do not click through the warning.
| Warning cause | Meaning |
|---|---|
| Expired certificate | The valid dates have passed |
| Name mismatch | The certificate was issued for a different site name |
| Untrusted issuer | The authority that signed it is not trusted by the browser |
| Self signed certificate | The site signed its own certificate, so nobody vouches for it |
Privacy and safety settings
- Pop up blocker. Stops unwanted windows that may carry scams.
- Clear browsing data. Removes history, cookies and the cache. The cache holds copies of page files, and clearing it can fix pages that load wrongly.
- Private browsing. Does not save history or cookies on the device after the window closes. It does not hide activity from the network, the website or the employer.
- Sign in and sync. Syncing bookmarks, passwords and history through an account is convenient, but the account needs a strong password and multifactor authentication (MFA).
- Ad blockers. Block ads and some trackers, which also reduces malicious ads.
- Proxy and security zone settings. Set in the browser or Windows Internet Options.
Secure DNS
Secure DNS encrypts the lookups that turn site names into addresses. The two forms are DNS over HTTPS (DoH) and DNS over TLS (DoT). In Chrome it is found under Settings, Privacy and security, Security, Use secure DNS.
Windows 11 can also encrypt DNS in the network connection's DNS settings.
Choose between the current service provider and a named provider. Secure DNS hides lookups from people on the network, but it can bypass a company DNS filter.
Keeping the browser safe
Keep the browser updated, because updates fix security flaws. Use the built in safe browsing warnings, and avoid saving payment details on shared computers.
Private browsing is not anonymous. It only keeps the local history clean, so a network administrator can still see the sites visited.
What to remember for the exam
- Get browsers and extensions only from official sources.
- Extensions can read page data, so keep them minimal.
- A padlock means encrypted, not safe.
- Certificate errors include expired, name mismatch, untrusted issuer and self signed.
- Do not bypass a certificate warning on sites that handle logins or payments.
- A pop up blocker, ad blocker and updates reduce exposure.
- Clearing the cache and cookies fixes some page problems and removes stored data.
- Private mode does not hide activity from the network.
- Sync needs a strong account password and MFA.
Common mistakes
Trusting the padlock as proof of honesty. It shows encryption and a valid certificate, not that the site is legitimate.
Installing an extension for convenience. Each extension widens the attack surface.
Believing private mode hides browsing. The network and the site can still see it.
Clicking through certificate warnings. The warning exists because the identity of the site cannot be confirmed.
Check yourself
What should you do when the browser warns of an invalid certificate on a login page?
Stop and do not proceed, then check the cause or report it.
What does private browsing prevent?
It prevents history and cookies from being kept on the local device after the session.
Why remove unused extensions?
Each extension can read page data and may be malicious or out of date.
Topic 13 of 13 in Security
Test yourself on Security
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.