Web Content Filter

com.apple.webcontent-filter

The payload that configures web content filters.

iOS 7.0+macOS 10.15+visionOS 1.1+

macOS: device channel only

Configuration Keys (28)

Showing 28 of 28 keys

Key	Type	Description	Default	Range
`FilterType`string Filter Type iOS 8.0+	string	The type of filter, built-in or plug-in. In macOS, the system only supports the plug-in value.	Default: "BuiltIn"	Range: Built-In (iOS only) (BuiltIn), Plug-In (Plugin)
`FilterGrade`string Filter grade macOS 10.15+ · not on iOS, visionOS	string	The system uses this value to derive the relative order of content filters. Filters with a grade of 'firewall' see network traffic before filters with a grade of 'inspector'. However, the system doesn't define the order of filters within a grade.	Default: "firewall"	Range: Firewall (firewall), Inspector (inspector)
`AutoFilterEnabled`boolean Web filter enabled not on macOS	boolean	If 'true', the system enables automatic filtering. Use when 'FilterType' is 'BuiltIn'.	Default: false	Range: —
`PermittedURLs`array Permitted URLs not on macOS	array	An array or URLs that are accessible whether or not the automatic filter allows access. Use when 'FilterType' is 'BuiltIn'. Requires that 'AutoFilterEnabled' is 'true'.	Default: —	Range: —
`PermittedURLItems`string Permitted url items	string	—	Default: —	Range: —
`FilterBrowsers`boolean Filter WebKit Traffic not on macOS	boolean	If 'true', the system enables filtering WebKit traffic. Use when 'FilterType' is 'Plugin'. Note: At least one of 'FilterBrowsers' or 'FilterSockets' needs to be 'true'.	Default: false	Range: —
`AllowListBookmarks`array Allow List Bookmarks iOS 14.5+ · not on macOS	array	An array of dictionaries that define the pages that the user can bookmark or visit. Use when 'FilterType' is 'BuiltIn'.	Default: —	Range: —
`AllowListBookmarksItem`dict Allow List Bookmarks Dictionary	dict	—	Default: —	Range: —
`URL`string URL required	string	The URL of the bookmark in the allow list.	Default: —	Range: —
`Title`string Title required	string	The title of the bookmark.	Default: —	Range: —
`WhitelistedBookmarks`array Allowlisted Bookmarks iOS · deprecated 14.5 · not on macOS, visionOS deprecated	array	Use 'AllowListBookmarks' instead.	Default: —	Range: —
`WhitelistedBookmarksItem`dict Allowlisted Bookmarks Dictionary	dict	—	Default: —	Range: —
`URL`string URL required	string	The URL of the bookmark in the allow list.	Default: —	Range: —
`Title`string Title required	string	The title of the bookmark.	Default: —	Range: —
`DenyListURLs`array Deny List URLs iOS 14.5+ · not on macOS	array	An array of URLs that are inaccessible. Use when 'FilterType' is 'BuiltIn'. Limit the number of these URLs to no more than 500.	Default: —	Range: —
`DenyListURLItems`string Deny List URL	string	—	Default: —	Range: —
`BlacklistedURLs`array Denylisted URLs iOS · deprecated 14.5 · not on macOS, visionOS deprecated	array	Use 'DenyListURLs' instead.	Default: —	Range: —
`BlacklistedURLItems`string Denylisted URL	string	—	Default: —	Range: —
`UserDefinedName`string Filter Configuration Display Name	string	The display name for this filtering configuration. Required when 'FilterType' is 'Plugin'. Depends on: FilterType ∈ [Plugin]	Default: —	Range: —
`PluginBundleID`string Plug-In Bundle ID	string	The bundle ID of the plug-in that provides filtering service. Required when 'FilterType' is 'Plugin'. Otherwise, it ignores this value. Consult your filtering solution vendor to determine what to specify for this value. Required when 'FilterType' is 'Plugin'. Depends on: FilterType ∈ [Plugin]	Default: —	Range: —
`ServerAddress`string Server Address	string	The server address, which may be the IP address, hostname, or URL. Use when 'FilterType' is 'Plugin'.	Default: —	Range: —
`UserName`string Username	string	The user name for the service. Use when 'FilterType' is 'Plugin'.	Default: —	Range: —
`Password`string Password	string	The password for the service. Use when 'FilterType' is 'Plugin'.	Default: —	Range: —
`PayloadCertificateUUID`string Certificate UUID	string	The UUID of the certificate payload within the same profile that the system uses to authenticate the user. Use when 'FilterType' is 'Plugin'.	Default: —	Range: —
`Organization`string Organization	string	The organization string to pass to the third-party plug-in. Use when 'FilterType' is 'Plugin'.	Default: —	Range: —
`FilterSockets`boolean Enable Socket Filtering	boolean	If 'true', enables the filtering of socket traffic. Use when 'FilterType' is 'Plugin'. Note: At least one of 'FilterBrowsers' or 'FilterSockets' needs to be 'true'.	Default: false	Range: —
`FilterDataProviderBundleIdentifier`string Filter data provider bundle identifier	string	The bundle identifier string of the filter data provider system extension. This string identifies the filter data provider when the filter starts running. Required if 'FilterSockets' is 'true'. Depends on: FilterSockets ∈ [true]	Default: —	Range: —
`FilterDataProviderDesignatedRequirement`string Filter data provider designated requirement not on iOS, visionOS	string	The designated requirement string that the system embeds in the code signature of the filter data provider system extension. This string identifies the filter data provider when the filter starts running. Required if 'FilterSockets' is 'true'. Depends on: FilterSockets ∈ [true]	Default: —	Range: —
`FilterPackets`boolean Enable Packet Filtering macOS 10.15+ · not on iOS, visionOS	boolean	If 'true' and 'FilterType' is 'Plugin', the system enables filtering network packets. Use when 'FilterType' is 'Plugin'. Note: At least one of 'FilterPackets' or 'FilterSockets' needs to be 'true'.	Default: false	Range: —
`FilterPacketProviderBundleIdentifier`string Filter packet provider bundle identifier macOS 10.15+ · not on iOS, visionOS	string	The bundle identifier string of the filter packet provider system extension. This string identifies the filter packet provider when the filter starts running. Required if 'FilterPackets' is 'true'. Depends on: FilterPackets ∈ [true]	Default: —	Range: —
`FilterPacketProviderDesignatedRequirement`string Filter packet provider designated requirement macOS 10.15+ · not on iOS, visionOS	string	The designated requirement string that the system embeds in the code signature of the filter packet provider system extension. This string identifies the filter packet provider when the filter starts running. Required if 'FilterPackets' is 'true'. Depends on: FilterPackets ∈ [true]	Default: —	Range: —
`VendorConfig`dict Vendor Configuration	dict	The custom dictionary that the filtering service plug-in needs. Use when 'FilterType' is 'Plugin'.	Default: —	Range: —
`{{key}}`string Vendor Custom Key Name required	string	—	Default: —	Range: —
`{{value}}`string Vendor Custom Key Value required	string	The custom key/value pairs for the filtering service.	Default: —	Range: —
`ContentFilterUUID`string Content filter UUID iOS 16.0+ · not on macOS	string	A globally unique identifier for this content filter configuration. The content filter processes network traffic for managed apps with the same 'ContentFilterUUID' in their app attributes. Use when 'FilterType' is 'Plugin'.This key must be present for unsupervised devices and user enrollment.	Default: —	Range: —
`HideDenyListURLs`boolean HideDenyListURLs iOS 18.0+ · visionOS 2.0+ · not on macOS	boolean	If 'true', the device hides the 'DenyListURLs' item in the profiles that display in Settings > General > VPN & Device Management.	Default: false	Range: —
`FilterURLs`boolean FilterURLs iOS 26.0+ · macOS 26.0+ · not on visionOS	boolean	If 'true', the system filters URL requests. Use when 'FilterType' is 'Plugin'.	Default: false	Range: —
`URLFilterParameters`dict iOS 26.0+ · macOS 26.0+ · not on visionOS	dict	A dictionary containing URL filter parameters. Required when 'FilterURLs' is 'true'. Depends on: FilterURLs ∈ [true]	Default: —	Range: —
`URLFilterControlProviderDesignatedRequirement`string URL filter control provider designated requirement	string	The designated requirement string in the code signature of the URL filter control provider app extension. The system uses this string to identify the URL filter control provider when the filter starts running. Required in macOS.	Default: —	Range: —
`URLFilterControlProviderBundleIdentifier`string URL filter control provider bundle identifier required	string	The bundle identifier string of the URL filter control provider app extension. The system uses this string to identify the URL filter control provider when the filter starts running.	Default: —	Range: —
`PIRServerURL`string Private information retrieval server URL required	string	The URL containing the domain name of the private information retrieval server.	Default: —	Range: —
`PIRPrivacyPassIssuerURL`string Privacy pass issuer URL required	string	The URL containing the domain name of Privacy Pass Issuer.	Default: —	Range: —
`PIRAuthenticationToken`string Authentication token required	string	The per-user authentication token string, which is an HTTP bearer token for the person using your app. The system uses this token to attest that it is a valid user when requesting anonymous authentication tokens for PIR exchanges.	Default: —	Range: —
`URLFilterFailClosed`boolean URLFilterFailClosed	boolean	If 'true', the system blocks URLs if the filter is enabled, but it fails to make any filtering decision; for example, if there's a communication failure with the PIR server. If 'false', the system allows URLs if the filter is enabled, but it fails to make any filtering decision.	Default: false	Range: —
`URLPrefilterFetchFrequency`integer URLPrefilterFetchFrequency	integer	The time interval in seconds that the system uses to periodically run the 'NEURLFilterControlProvider' app extension. The default value is 86400 seconds (1 day). The minimum allowed value is 2700 seconds (45 minutes). The system allows 'NEURLFilterControlProvider' implementations to download prefilter Bloom filter data onto the device periodically at the specified interval. Implementations need to allow for a slight difference between the scheduled time and the actual runtime of the task, due to the scheduling mechanism on the system.	Default: 86400	Range: 2700 – —
`SafariHistoryRetentionEnabled`boolean SafariHistoryRetentionEnabled iOS 26.0+ · macOS 26.0+ · visionOS 26.0+	boolean	If 'true', this payload enforces a policy which requires retention of browsing history. This causes Safari to disable clearing of browsing history, and prevents the use of private browsing mode because that mode doesn't keep browsing history.	Default: true	Range: —