>
    Strata Copilot
    Block Downloads in Firefox
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Deploy the Prisma Browser Extension
    4. Prisma Browser Extension Support for Firefox
    5. Block Downloads in Firefox
    Download PDF
    Prisma Browser

    Block Downloads in Firefox

    Table of Contents

    Block Downloads in Firefox

    This is a description on how to turn off downloads in Firefox.

    How to Disable File Downloads in Firefox using ContentAnalysis

    Firefox includes a built-in Data Loss Prevention (DLP) hook called ContentAnalysis. By configuring this enterprise policy, you can block all file downloads across all websites or restrict downloads on specific chosen sites without requiring a separate DLP agent.

    Key Features and Behavior

    • In-Browser Enforcement: Blocks occur inside the browser rather than on the network level.
    • Comprehensive Coverage: Blocks server downloads as well as client-side dynamic downloads (e.g., JavaScript-generated files, blob URLs, and Service Worker files).
    • User Experience: Users receive a blocked notification immediately, and no data is written to the local download folder.

    Steps to Block All Downloads

    1. Access your Firefox Enterprise Policy settings configuration file or the Management console.
    2. Locate the ContentAnalysis policy section.
    3. Set the deny list pattern to .* to target all file downloads.
    4. Save and apply the policy settings across your Firefox installation.
    PolicyContentAnalysis
    Keys
    Enabled = true · DenyUrlRegexList = .* ·InterceptionPoints.Download.Enabled = true
    Scope
    All downloads, or only the sites you list .
    Minimum Version
    Firefox 142 or Firefox ESR 140.2
    Platforms
    Windows, macOS, Linux

    Requirements and Limitations

    Review these prerequisites before initiating deployment. While not prohibitive, these factors impact policy configuration.
    • Version Requirements: Requires Firefox 142 or Firefox ESR 140.2 at minimum, as earlier builds lack the download interception mechanism and will bypass enforcement without warning.
    • Explicit Disabling Needed: You must explicitly turn off Clipboard, DragAndDrop, FileUpload, and Print; otherwise, their default true value will unintentionally restrict copy, paste, uploads, and printing.
    • Single Integration Limit: Only a single DLP integration can utilize the ContentAnalysis slot at any given time, preventing concurrent third-party DLP operations.
    • Placeholder Artifacts: A temporary zero-byte file is briefly generated to reserve the filename before removal. Including "StartDownloadsInTempDirectory": true in the configuration prevents cluttering the download directory.
    • Direct Pattern Matching: Enforcement functions strictly as a binary block rather than a scanning tool, evaluating requests purely against your defined deny list without performing file inspection.
    • Locked Configuration: Applying the policy locks all ContentAnalysis parameters into a read-only state, preventing end-user modification within about:config.

    Test on Your own Machine First

    Before any fleet rollout, apply the policy on one device and confirm the behavior meets your needs. Save the following as policies.json and place it in the Firefox distribution folder:
    1. Windows: C:\Program Files\Mozilla Firefox\distribution\policies.json
    2. macOS: /Applications/Firefox.app/Contents/Resources/distribution/policies.json
    3. Linux: /etc/firefox/policies/policies.json
    {
"policies": {
"ContentAnalysis": {
  "Enabled": true,
  "DenyUrlRegexList": ".*",
  "InterceptionPoints": {
    "Download":    { "Enabled": true },
    "Clipboard":   { "Enabled": false },
    "DragAndDrop": { "Enabled": false },
    "FileUpload":  { "Enabled": false },
    Print":       { "Enabled": false }
    }
   }
  }
 }

    Block Specific Sites Instead of all Downloads

    The same policy can be scoped to chosen sites. DenyUrlRegexList takes a space-separated list of regular expressions, so .* is simply the pattern that matches everything. Replace it to block only the sites you care about:
    "DenyUrlRegexList": "https://drive\\.google\\.com/.* https://.*\\.dropbox\\.com/.*"
    There is also AllowUrlRegexList for the opposite shape: deny everything, then allow a short list of approved sites. Allow entries win over deny entries, so you can combine DenyUrlRegexList = .* with an allow list of internal sites:
    "DenyUrlRegexList": ".*",
"AllowUrlRegexList": "https://intranet\\.example\\.com/.* https://files\\.example\\.com/.*"
    Patterns are matched against the download URL. Remember to escape dots in regular expressions, as shown above.

    Roll Out

    Once validated, deploy using whichever option fits your setup:
    1. 1. Push via MDM (standalone): In Intune, create a Settings catalog profile (Devices → Configuration →New Policy, Windows 10 and later), search for Firefox, and set the ContentAnalysis values above. On macOS, deploy the same values as a managed preferences profile for org.mozilla.firefox through Intune or Jamf. On Linux, ship the policies.json file with your configuration management tool.
    2. Push via Group Policy (Windows): Import the Firefox ADMX templates and set the same values, or write them directly to the registry: 
      Software\Policies\Mozilla\Firefox\ContentAnalysis\Enabled = 0x1 
Software\Policies\Mozilla\Firefox\ContentAnalysis\DenyUrlRegexList = ".*"
Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Download\Enabled =0x1 
Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Clipboard\Enabled =0x0 
Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\DragAndDrop\Enabled= 0x0 
Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\FileUpload\Enabled =0x0
Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Print\Enabled = 0x0
    3. Add to the extension's existing config: If you already deploy the Prisma Browser Extension through a managed Firefox configuration, include the ContentAnalysis block in that same file so it shipst ogether with the extension install.

    © 2026 Palo Alto Networks, Inc. All rights reserved.