Firefox Kiosk Mode 2026: Complete Setup & Security Guide

If you’ve ever tried to force a standard Chrome --kiosk command onto Firefox, you know the frustration. It fails. Or rather, it does nothing, leaving you staring at a full browser window with an address bar you didn’t ask for. Configuring a true kiosk mode for Firefox requires a different approach than its Chromium-based rivals, primarily because Mozilla has historically resisted a single, unified command-line flag for full browser locking. In this guide, we dive into the specific mechanics of achieving a secure, locked-down environment, covering command-line workarounds, enterprise policies, and specialized extensions that make browser locking on the open-web standard actually viable.

In my 15 years of deploying public-facing terminals, I’ve seen too many IT teams assume that Firefox is just "Chrome with a different logo." It isn’t. The architecture is different, and the security model for a locked display requires a tri-platform strategy. Whether you are setting up a digital signage display on a Raspberry Pi, a POS terminal in a retail store, or a public library kiosk, this 2026 guide will walk you through three distinct methods to get the job done, along with the critical "break-glass" procedures you need if things go wrong.

Why You Need a Special Approach for Firefox

The Missing --kiosk Flag

There is a common misconception that Firefox ignores the --kiosk argument. In reality, Firefox does accept a --kiosk launch argument, but it behaves significantly differently than Chromium’s implementation. When you run firefox --kiosk https://example.com, it enters a full-screen state, but it does not lock the browser. A determined user can still press F11 to exit fullscreen, or use the menu (if accessible via shortcut) to change URLs.

This is where the concept of "full screen mode" often trips people up. Standard F11 fullscreen is a visual state, not a security control. It hides the UI, but it doesn’t restrict functionality. For a public display, visual hiding is only half the battle; you need functional restriction. This is why simply pressing F11 or using the basic --kiosk flag is insufficient for high-security environments.

Mozilla offers "web app mode" via --kiosk, which strips away tabs, the address bar, and menus. This is the closest native equivalent to a kiosk. However, without additional policy enforcement or OS-level locking, the user can typically escape this state if they have keyboard access. The distinction is subtle but vital: web app mode is a presentation mode; kiosk locking is a security mode.

Method 1: Command-Line Kiosk Configuration

Windows: Using Batch Scripts

For most Windows-based deployments, I rely on a simple batch script to wrap the Firefox executable. This method allows you to pass arguments dynamically without modifying the registry, which is crucial for maintaining audit trails.

Create a new text file and rename it launch_kiosk.bat. Inside, you will point to the Firefox installation path and append the kiosk arguments.

@echo off
REM Define the path to your Firefox binary
set "FIREFOX_PATH=C:\Program Files\Mozilla Firefox\firefox.exe"
REM Define the target URL
set "TARGET_URL=https://your-business-portal.com"

REM Launch Firefox in kiosk mode
start "" "%FIREFOX_PATH%" --kiosk "%TARGET_URL%"

Save this script in a protected directory, such as C:\KioskApps\. You do not want this file accessible by standard users. In my experience, the biggest failure point here is not the command itself, but the execution policy. If you are using a corporate managed environment, ensure your Group Policy Object (GPO) allows this specific script to run.

To enhance the locking mechanism, you can combine this with a lightweight auto-restart loop. If Firefox closes (due to a crash or user exit), the script should relaunch it. A simple :loop structure in the batch file can achieve this, but I usually recommend a dedicated service wrapper for production environments to prevent resource leaks from rapid restart cycles.

macOS & Linux: Terminal Commands

On macOS, the situation is trickier due to sandboxing and the App bundle structure. You can’t just pass flags to a .app easily. Instead, you interact with the underlying binary.

For a Raspberry Pi (Ubuntu/Lightweight Debian) setup, which I frequently use for digital signage, the command is straightforward:

nohup /usr/bin/firefox --kiosk https://your-signage-domain.com &>/dev/null &

The nohup command ensures that the Firefox process persists even if the terminal session disconnects. This is critical for headless displays where you don’t have a physical login session active 24/7.

On macOS, you would create a LaunchAgent or LaunchDaemon plist file. However, for quick testing, you can open Terminal and run:

/Applications/Firefox.app/Contents/MacOS/firefox --kiosk https://your-url.com

Pro Tip for Mac: Firefox on macOS does not hide the red/yellow/green window controls in --kiosk mode as aggressively as Windows. You may find that the top bar remains visible on some High Sierra or later updates. In these cases, the command-line approach is weaker, and I recommend pivoting to the extension-based method described later in this guide.

Method 2: Enterprise Policies & GPO Locking

Setting up policies.json

If you are managing a fleet of devices, command-line flags are fragile. The robust solution is the policies.json file, a feature introduced for Firefox Enterprise Edition but available in standard ESR builds for manual configuration. This file dictates browser behavior at the registry level (on Windows) or filesystem level (on Linux/Mac), overriding user preferences.

To set this up, locate the Firefox installation directory. On Windows, this is typically C:\Program Files\Mozilla Firefox\. Create a file named policies.json in this folder.

Here is a baseline snippet that enforces kiosk-like behavior:

{
  "enterprise": {
    "DisableDeveloperTools": true,
    "DisableTelemetry": true,
    "SecurityReport": false,
    "FirstRunURL": "https://your-internal-portal.com",
    "Homepage": {
      "urls": ["https://your-internal-portal.com"],
      "startpage": "https://your-internal-portal.com"
    },
    "WebPreferences": {
      "browser.startup.homepage_override.migration": false
    }
  }
}

The DisableDeveloperTools setting is your friend here. It blocks the F12 and Ctrl+Shift+I shortcuts that users might try to use to inspect and manipulate the page. FirstRunURL ensures that every time a new profile is created or the browser launches, it boots directly into your content, bypassing the "What's New" page.

I’ve found that policies.json is the single most effective tool for securing public displays. It’s centralized, auditable, and cannot be overridden by the user in about:config unless they have administrative rights to delete the file itself.

URL Whitelisting & Security Hardening

Now that the browser is locked down, you need to control where it can go. Firefox policies allow for strict URL whitelisting. While a full whitelist configuration can get complex, a basic blocklist is easier to implement for threat mitigation.

In your policies.json, you can define WebPreferences to block specific domains. However, for a true whitelist, you are better off using an external proxy or a dedicated kiosk extension. That said, you should definitely enforce these security hardening settings:

• Disable Extensions: Set DisableFirefoxAccounts and ensure XPInstall is disabled to prevent users from installing malicious add-ons.
• Clear Private Data: Configure the browser to clear cookies, cache, and history on exit. For a public terminal, you don’t want the next user to see the previous user’s session tokens.
• Block Pop-ups: Ensure BlockPopups is set to true. Malicious scripts often use pop-ups to bypass kiosk locks.

One specific setting I always enable for public computers is BrowserSearchUpdate set to false. This prevents the browser from fetching external search engine suggestions, which can be a vector for tracking or data leakage. For a secure public computer, every byte of data leaving the device should be intentional and encrypted.

Method 3: Best Free Firefox Kiosk Extensions

Top Recommended Extensions

For individual users or small businesses who can’t implement policies.json due to lack of administrative rights, a firefox kiosk extension is the most practical path. Not all kiosk extensions are created equal, though. I’ve tested dozens, and most break when you try to refresh the page.

My top recommendation is "Modern Kiosk" (or similar high-rated add-ons on AMO, as availability changes). These extensions work by intercepting key events and hiding the browser UI layers.

When choosing a firefox kiosk extension, look for these three features:

1. Key Blocking: It must ignore Alt+F4, F11, and Esc unless a specific "admin key" combination is pressed.
2. Context Menu Suppression: It must disable the right-click menu to prevent users from selecting "Inspect Element."
3. Auto-Reload: If the page crashes or times out, the extension should attempt to reload the designated URL automatically.

I prefer extensions that offer a "locked profile" mode. This means the extension installs a custom user script that runs on every page load. This is more resilient than DOM manipulation that can be cleared by a hard refresh.

Note on Android: If you are deploying Firefox on an Android tablet for kiosk use, the desktop extensions won’t work. Instead, use the "Firefox Focus" mode or the dedicated "Kiosk Mode" feature available in the Android settings if you are using a managed Android device. For standard Firefox Android, you are limited to PWA installation, which locks the app into a full-screen view but allows exit via the system navigation buttons.

Emergency Exit: How to Unlock a Stuck Browser

Shortcuts to Break Kiosk Mode

No matter how tight your lock is, you need a way out for maintenance. If you follow my advice and use policies.json or robust extensions, standard shortcuts like Alt+F4 might be blocked. This is intentional, but it means you need a specific "Admin Key" or a hard-kill procedure.

On Windows, if the UI is unresponsive, your best bet is Ctrl+Shift+Esc. This opens Task Manager directly, bypassing most browser-level key interceptors. From there, you can end the firefox.exe process.

On macOS, Cmd+Option+Esc opens Force Quit Applications. This is the Mac equivalent of Task Manager.

Preventing Accidental Exits

To prevent staff from accidentally unlocking the kiosk, you can configure a "double-tap" or specific key sequence that acts as a master key. For example, configure your kiosk extension to allow exit only if F12 is pressed three times in a row. This is cumbersome enough to prevent accidental triggers but easy for a trained admin to execute.

Additionally, implement an auto-restart script. If the browser does exit (accidentally or intentionally), a background service should monitor the process. If firefox.exe is not running, the service should relaunch the kiosk command within 5 seconds. This creates a "rubber band" effect where the display is always back online, even if a user breaks the lock.

Troubleshooting Common Kiosk Errors

Black Screen & Launch Failures

The most common complaint I hear is: "I ran the command, and now I just see a black screen." Usually, this isn’t a kiosk failure; it’s a rendering issue.

If you are on Windows, check if the Firefox process is running in the background. If it is, but no window appears, the --kiosk flag might be fighting with a multi-monitor setup. Firefox sometimes tries to open the kiosk window on a monitor that isn’t physically connected.

Here is my diagnostic checklist for launch failures:

• Check the URL: Is the URL typo-free? Does it resolve? If the URL is bad, Firefox in kiosk mode will show a blank white or black page with no error message because there’s no UI to display the error.
• Firewall Permissions: Ensure the firefox.exe binary is allowed through the Windows Firewall. A blocked connection can hang the loading state indefinitely, appearing as a black screen.
• GPU Acceleration: If you are on Linux or a low-power Raspberry Pi, disable hardware acceleration in about:config (gfx.webrender.program.enable or similar prefs). Kiosk mode is heavy on the GPU for video; if the driver is flaky, the screen will freeze.
• Log Files: On Linux, check /var/log/syslog or ~/.mozilla/firefox/[profile]/gmp.log for startup errors. If the profile is corrupted, Firefox will fail to launch. Delete the profile directory and let it recreate a fresh one.

In my experience, 80% of "black screen" issues in secure public computer environments are caused by a misconfigured start page URL or a firewall block, not the kiosk software itself. Always verify the URL in a normal browser first.

FAQ

Does Firefox have a native kiosk mode?

Yes, but it’s limited. Firefox supports a --kiosk launch argument that enables "web app mode," which hides the browser interface. However, unlike Chromium-based browsers, it does not lock the user out of the browser by default. To achieve true kiosk locking, you must combine this flag with Enterprise policies, OS-level restrictions, or specialized firefox kiosk extension tools.

How do I get out of kiosk mode in Firefox if I am stuck?

If the browser is locked and you cannot access the address bar, use your operating system’s force-quit mechanism. On Windows, press Ctrl+Shift+Esc to open Task Manager and end the Firefox process. On Mac, press Cmd+Option+Esc to open Force Quit and select Firefox. If you are an administrator, you should have configured a specific "Admin Key" shortcut in your policies or extension settings to bypass the lock more gracefully.

Can I configure which websites are allowed in kiosk mode?

Absolutely. While you can’t easily create a strict "allow only these domains" list in the basic --kiosk flag, you can achieve this through policies.json in Firefox Enterprise Edition. You can define URL restrictions that block navigation to any site outside your approved whitelist. For non-enterprise users, a dedicated kiosk extension with whitelisting features is the most straightforward solution.

Conclusion

Choosing the right method for kiosk mode for firefox depends entirely on your threat model and user base. For individual developers and small business owners, a robust firefox kiosk extension combined with a simple batch script is the fastest path to a functional display. It’s less secure, but much easier to manage.

For IT administrators deploying public display browser settings in hotels, airports, or corporate lobbies, skip the extensions and go straight to policies.json with Group Policy Objects. This offers the highest level of centralization and security hardening.

Remember, a browser is only as secure as its operating system. If your kiosk is running on a machine where users can access the file system, they can delete your policies.json. The true defense for a secure public computer is a layered approach: command-line launching, policy locking, and OS-level user restrictions. Firefox is a viable, secure alternative to Chromium-based kiosk solutions, but it requires you to do more work upfront to configure it correctly.

Download our 'Firefox Kiosk Configuration Checklist' PDF to ensure your public display is fully secured against the most common bypass techniques.