Essential browser security hygiene settings to practice before initializing non-custodial swaps on an online site

1. Isolate your swap environment

Before you interact with any online site for a non-custodial swap, create a dedicated browser profile. Use a fresh, clean browser instance that has no saved passwords, cookies, or extensions from your daily browsing. This prevents cross-site tracking and malicious scripts from accessing your wallet data.

Disable all browser extensions except your wallet connector (e.g., MetaMask, Phantom). Extensions like ad-blockers, password managers, or grammar checkers can inject code into pages. In non-custodial swaps, any injected script can read transaction details or redirect funds. Test your wallet connection in a private window after disabling extensions.

Clear session data before each swap

Manually clear your browser’s cache, local storage, and service workers after each swap session. Attackers use persistent storage to fingerprint your wallet activity. Use the browser’s “Clear browsing data” tool with a time range of “last hour” to remove residual scripts without losing all settings.

2. Harden network and connection settings

Use a VPN with a kill switch to mask your IP address. Non-custodial swaps often involve blockchain explorers or RPC nodes that log IPs. Combine this with DNS-over-HTTPS (DoH) to prevent DNS leaks. In Chrome, enable “Use secure DNS” under Privacy and Security settings; select a provider like Cloudflare or Quad9.

Disable WebRTC in your browser to prevent IP leaks even behind a VPN. WebRTC can bypass your proxy and reveal your real IP to swap interfaces. Use extensions like “WebRTC Leak Prevent” or manually disable WebRTC in your browser flags (chrome://flags/#disable-webrtc). Test your IP leak status before proceeding.

3. Validate page integrity and script execution

Always check the SSL certificate of the swap interface. Click the padlock icon and verify the certificate matches the domain exactly. Phishing sites often use lookalike domains with valid SSL but different ownership. Use browser developer tools (F12) to inspect the page source for obfuscated scripts that attempt to modify transaction data.

Enable “Strict” mode in your browser’s Content Blocking settings (Safari) or use uBlock Origin in hard mode to block third-party scripts. Non-custodial swaps should only load scripts from the swap provider’s domain. Any external script request (e.g., from analytics or CDN) is a red flag. Pause execution if you see unknown script sources.

Disable automatic form filling and password saving

Turn off autofill for forms and passwords in your browser. Swapping interfaces rarely require passwords, but autofill can leak your name, address, or seed phrases if a scam page includes hidden fields. In Chrome, go to Settings > Autofill and disable “Addresses and more” and “Passwords.”

4. Post-swap verification and cleanup

After completing a swap, immediately disconnect your wallet from the site via the wallet’s interface. Do not rely on the site’s “disconnect” button; revoke permissions through your wallet’s connected sites list. Then, clear your browser’s cookies, site data, and service workers for that specific domain.

Run a malware scan on your device after each swap session. Use tools like Malwarebytes or Windows Defender to detect any keyloggers or clipboard hijackers that may have been downloaded. Non-custodial swaps require signing transactions; a hijacked clipboard can replace your recipient address with an attacker’s address.

FAQ:

Should I use a hardware wallet with non-custodial swaps?

Yes, always. Hardware wallets sign transactions offline, preventing browser-based malware from accessing your private keys even if your browser is compromised.

Can I trust a swap site if it has HTTPS?

HTTPS only secures data in transit, not the site’s code. Always verify the domain and inspect scripts. Phishing sites can have valid HTTPS certificates.

How often should I clear browser data for swaps?

Clear all site data after each swap session. Residual cookies or service workers can track your wallet activity across sessions.

What is the biggest risk during a non-custodial swap?

Clipboard hijacking and malicious browser extensions that modify transaction data before signing. Always double-check recipient addresses on your hardware wallet screen.

Do I need a separate browser for swaps?

Using a dedicated browser profile or a portable browser (like Firefox Portable) reduces exposure to extensions and cookies from your daily browsing. It’s recommended but not mandatory.

Reviews

Carlos M.

I followed these steps before a recent swap on a new site. Disabling extensions and clearing cache saved me from a phishing script that was hidden in a favicon. Highly practical guide.

Lena K.

The WebRTC leak tip was eye-opening. My VPN was working, but WebRTC still exposed my real IP. After disabling it, I felt much safer signing transactions. Great hygiene checklist.

Raj P.

Using a dedicated browser profile for swaps has become my routine. This article covers every weak point I missed. The post-swap cleanup step is often overlooked but critical.