The core extensions for me are always a combination of uBO and uMatrix, using the latter to block scripts, xhr and cookies on all sites.

That leaves javascript disabled by default but I can whitelist what I need, either temporarily or permanent by saving the rules for frequently used sites or domains.

But it’s not for everyone, because it requires micromanaging what you allow.