Understanding Add-on Scopes

In my earlier post on Integrating Add-ons into Firefox, I indicated the for some of the install methods, you have to set the preference extensions.autoDisableScopes to 0. In the comments, Blair McBride recommended against setting this preference to 0, because it would enable any third-party add-on install. Based on the feedback I've seen from enterprises since the release of Firefox 8, they simply want things to work the way they did before Firefox 8. to do that, you set the preference to 0. But Blair's statement made me realize that a much better explanation of add-on scopes and the two related preferences was in order.

So what exactly are add-on scopes? Firefox divides the locations from which add-ons can be installed into four scopes. Each of these scopes can be turned on or off individually. We'll talk about the preferences later, but first, let's understand each of the scopes.


This is the profile scope. This means any add-on that is in the current profile directory.


This is the user scope. This means any add-on that is referenced by the current USER's registry entry or any add-on that is in the user's extensions directory. On Windows, that means %appdata%\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\. You can get more information here and here.


This is the application scope. This means any add-on that is in the extensions directory where the executable is located.


This is the system scope. This means any add-on that is referenced by a SYSTEM/MACHINE registry entry or any add-on that is in the system's extensions directory. Windows does not have a system extension directory. You can get more information here and here.

To use the scopes as preferences values, just add together the values.

There are two preferences that use these scopes, extensions.enabledScopes and extensions.autoDisableScopes. A lot of confusion seems to be arising because the preferences are named similarly. Let's take each one individually and see if we can make sense of them.

extensions.enabledScopes has been around since Firefox 4. It used to prevent Firefox from even looking in certain locations to find add-ons. You may wonder "why would I ever want to do that?" A good example would be if you were running Firefox from a USB key like SurfEasy or Portable Firefox. You would probably not want add-ons that are on the host computer to be loaded into Firefox. So you would set extensions.enabledScopes to 5 10. That says "don't read add-ons from the user's directory or the system." The default value for this preference is 15 which means that all locations are searched for add-ons.

extensions.autoDisableScopes was introduced in Firefox 8 as part of the effort to crack down on third-party add-ons. It is used to specify the locations from which add-ons will be disabled by default. The default value for this preference is 15 which means that add-ons are disabled by default in all locations. You may wonder how this works, since the user's profile directory is one of those locations. Add-ons are only disabled by default if they were not explicitly installed by the user. So if an external application places an add-on into the user's profile directory, it is disabled by default.

Because these preferences are required very early in Firefox's startup (and for obvious reasons), you cannot set them in your extension. I recommend setting them via an autoconfig file. You would create the autoconfig file as documented in that post and then add:

pref("extensions.autoDisableScopes", 0);
pref("extensions.enabledScopes", 15);

If you are using remote autoconfig (or you don't want to use autoconfig), the only other place you can set these values is with a file in the default preferences. You would use the same code as the autoconfig.

And that's how add-on scopes work.

Please note: I reserve the right to delete comments that are offensive or off-topic.

Leave a Reply

Your email address will not be published. Required fields are marked *

26 thoughts on “Understanding Add-on Scopes

  1. Hi Mike

    Thanks for the informative posting. I'd just like to clarify one part. You said...

    You would probably not want add-ons that are on the host computer to be loaded into Firefox. So you would set extensions.enabledScopes to 10. That says “don’t read add-ons from the user’s directory or the system.”

    Doesn't that enable SCOPE_SYSTEM (8) + SCOPE_USER (2) i.e. the exact opposite of what we want?

    • > Doesn't that enable SCOPE_SYSTEM (8) + SCOPE_USER (2) i.e. the exact opposite of what we want?

      Yes it does. I was thinking of disabling scopes. See, even I get confused :). I've fixed the post.

  2. Maybe you can add a note clarifying that setting autoDisableScopes in a autoconfiguration file on a remote server (http://server/firefox_prefs.js) doesn't work because it is read too late by Firefox.

    The only solution is setting it directly inside /defaults/pref directory, as you said in the enterprise mailing list (thx :-)).

  3. If I want to enable all third party plugins automatically, will doing a
    user_pref("extensions.autoDisableScopes", 0);
    be sufficient to achieve this ?

      • I have tried to include user_pref("extensions.autoDisableScopes", 0);
        into prefs.js inside of
        Mozilla\Firefox\Profiles\****.default - directory
        and also inside of my defaults\preferences\prefs.js

        but the extension didn't auto enable.. why is that? how can it be fixed? thank you

        • You can't set autoDisableScopes in your profile. It has to be set in the defaults/preferences file.

          In the defaults preferences file, it's not user_pref, it's pref:

          pref("extensions.autoDisableScopes", 0);

          Also, you need to name your file with a low letter in the alphabet to make sure it doesn't clash with Mozilla's file. What did you name the JS file?

  4. Hi Mike,

    Thanks for your Article, actually I had a different requirement, where I wanted to enable the Add-On which is part of the application. i.e, present in the Extensions directory where Firefox executable is located. Other Add-On's which are available on the System will be ignored. I used the combination of enabled scope and auto disable scope it helped in deploying the package for a corporate firm.

    pref("extensions.enabledScopes", 4);
    pref("extensions.autoDisableScopes", 0);

    Used above settings in.cfg file, now only the Add-On which is part of the application is enabled by default without prompting users to explicitly enable it.


  5. Thanks, this is helpful.

    In my FF 13 about:config page I don't have the preference extensions.enabledScopes. Has this since been removed?



    • It's not there by default. It's something you add to your JS files.

      It's not something a user would typically add via about:config

      If you do add via about:config, add as an integer pref.

  6. Hi Mike,

    I'm trying to customize FF 19 so that it allows me load a .xpi for all Users on an enterprise client machine. However, i'm having no luck with this even using your suggestions above. These Users are non-admins so they keep being prompted to approve the extension but don't have permission to do that. Has something changed in FF19 that might prevent me doing this?

    • Nothing should have changed that would cause this. Which prompt specifically are you seeing? You can contact me off line and I can help.

  7. hello,
    I started with a 4-person team that manages 1,600 PC for administration in New Caledonia. We have an Active Directory (FUNCTIONAL level 2008).
    I would like to deploy the module GPO for Firefox 0.9.4 automatically and without user intervention.
    I deployed the 24.3.0 version of ESR french.
    Abraxas is the Geckozone site that has me towards you. I can not seem to add the GPO for Firefox command line. I give you the link of the site where I mention what I've done:

    Can you help me to solve my problem please?

  8. hi Mike I am facing one issue with Firefox 10.0.5 ESR version.
    I have installed QTP add-on for Firefox. I am able to that add-on in extensions section but it's always disabled. if I click on enable it asks for Firefox restart doing so crashes Firefox.
    I tried adding extension.autodisable 0 in default pref but the moment I add this line and open Firefox it crashes.
    Appreciate your help on this issue

      • it's client provided version of Firefox. client forced us to test application on 10 version of Firefox. QTP is a automation testing tool used to test application. To make QTP compatible with Firefox QTP itself provides add-on. once it's installed we can see that add-on in extension.

        • I would test in a more recent version of Firefox and see if it still crashes.

          If you are experiencing a Firefox crash, it is a problem with the add-on or Firefox, but Mozilla will not support Firefox 10.

  9. Hi Mike - great wealth of info on Firefox Add-ons, very easy to read too, so thanks!

    I do have one question:
    I have a group of machines (in a domain environment) that have had an extension installed as part of a windows software installation (LastPass). The extension is installed in the appdata/roaming folder for each user and is of course disabled by default.

    I see that using

    pref("extensions.autoDisableScopes", 0);
    pref("extensions.enabledScopes", 15);

    causes new addons to be enabled automatically but does this apply to addons that were installed prior to me placing the mozilla.cfg file (and associated .js) in the Firefox directory?

    I'm a little stumped and can't find a way to enable this existing addon.

    Any thoughts would be greatly appreadicated!



    • Where in the appdata/roaming folder specifically?

      I'm honestly not sure. You would have to test to find out. If they don't become enabled, you could add some custom code to your mozilla.cfg that explicitly enables them.

      • It's installing it in C:\Users\user-name\AppData\Roaming\Mozilla\Firefox\Profiles\2jk5b3g7.default\extensions\

        I solved the issue by uninstalling the app & extensions on all machines, then applying the mozilla.cfg and redeploying the app & extension. The extension was then automatically enabled.

        I'll have to experiment as I'm rather curious as to what was happening. Any pointers on explicitly enabling extensions?