SitePolicies

Fine grained control over policies for specific sites.

Use this to harden or restrict individual sites rather than the whole browser, for example turning the JIT engine off on untrusted sites or requiring HTTPS for a set of internal hosts. Each rule applies only to the sites it matches, so you can tighten the browser where it matters without changing behavior everywhere else.

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 150	Available since 153	Available since 150

CCK2 Equivalent: N/A
Preferences Affected: N/A

Examples

{
  "policies": {
    "SitePolicies": [
      {
        "Match": [
          "*.example.com"
        ],
        "Policies": {
          "DisableJit": true
        }
      },
      {
        "Exceptions": [
          "*.example.org"
        ],
        "Policies": {
          "DisableJit": true
        }
      },
      {
        "Match": [
          "*.example.net"
        ],
        "Policies": {
          "HttpsOnly": true
        }
      }
    ]
  }
}

JSON schema

{
  "type": "array",
  "items": {
    "type": "object",
    "properties": {
      "Match": {
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "Exceptions": {
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "Policies": {
        "type": "object",
        "properties": {
          "DisableJit": {
            "type": "boolean"
          },
          "HttpsOnly": {
            "type": "boolean"
          }
        }
      }
    },
    "required": [
      "Policies"
    ]
  }
}

A wildcard * can be used to refer to all sites. For example this setting would disable the JIT for only *.example.com:

[
  {
    "Match": ["*.example.com"],
    "Policies": {
      "DisableJit": true
    }
  }
]

While this setting would disable the JIT on every site except *.example.org:

[
  {
    "Exceptions": ["*.example.org"],
    "Policies": {
      "DisableJit": true
    }
  }
]

Values

The policy is made up of a list of rules that are evaluated in order. Each rule can contain:

Match: a list of sites. An empty list or missing property means to match all sites.
Exceptions: a list of sites which when matched bypasses this set of rules.
Policies: an object defining the site policies.

Currently the supported site policies are:

DisableJit disables the JIT engine for the site when true.

When the JIT engine is disabled, some sites may be slow, experience breakages, and WebAssembly won't be executed. Be sure to scope DisableJit as narrowly as possible using Match patterns, or via exemptions using Exceptions.
HttpsOnly stops the site from being loaded over plain HTTP when true. When it is false, HTTP is explicitly allowed for the site, which is how you carve a site out of a broader rule.

Windows (GPO)

Software\Policies\Mozilla\Firefox\SitePolicies (REG_MULTI_SZ) =
[
  {
    "Exceptions": ["*.example.com"],
    "Policies": {
      "DisableJit": true
    }
  }
]

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SitePolicies

Value (string):

<enabled/>
<data id="JSON" value='[
  {
    "Exceptions": ["*.example.com"],
    "Policies": {
      "DisableJit": true
    }
  }
]'/>

macOS

<dict>
  <key>SitePolicies</key>
  <array>
    <dict>
      <key>Exceptions</key>
      <array>
        <string>*.example.com</string>
      </array>
      <key>Policies</key>
      <dict>
        <key>DisableJit</key>
        <true/>
      </dict>
    </dict>
  </array>
</dict>