[mothered]

You don't use VMs?

It's good practice to also use private search engines. Here's a few, with one (Metager) that allows opening links anonymously via It's built-In proxy.

https://metager.de/
https://www.ixquick.com/
https://duckduckgo.com/
https://www.startpage.com/

There's too much to mention so without going Into detail, you may want to look Into encrypting your DNS servers (thus prevent DNS leaks), anonymize WebRTC fingerprinting, changing your browser's user agent (even In Tor), anonymize your entry point to Tor using bridges, prevent location, OS, hardware and login leaks and the list goes on.

Chrome supports X-Frame-Options HTTP header check/response header (SAMEORIGIN & DENY), so that's one step ahead In preventing clickjacking attacks.

You have a pretty good setup though.