Safari-Hardening

Configuration profiles to enhance the privacy, security, & usability of Safari & WebKit on macOS...

Please see here for configuration profiles to harden your system as a whole.

Tip

See Safari's currently configured settings at: ~/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist

Overview

There are currently 2 core Safari configs: Base & Extended.

Base

Base makes the following changes to Safari:

Privacy

• Always asks users for consent before translating content
• Blocks third-party cookies
• Clears browsing history after one day
• Clears download history when Safari exits
• Disables Back/Forward Cache
• Disables the Beacon API - (WebKitBeaconAPIEnabled)
• Disables Diagnostic Logging
• Disables the Digital Credentials API - (WebKitExperimentalDigitalCredentialsEnabled)
• Disables DNS Prefetching
• Disables enumerating all network interfaces
• Disables enumerating visible network interfaces
• Disables Extensible SSO
• Disables the Gamepad API
• Disables Highlights
• Disables Link Prefetching
• Disables preloading top search hits
• Disables Private Click Measurement
• Disables Private Click Measurement Fraud Prevention
• Disables the Reporting API
• Disables restoring session at launch
• Disables Search Suggestions
• Disables Siri Suggestions
• Disables the SpeechSynthesis API
• Disables thumbnail caching for History and Top Sites
• Disables use of Private Tokens by third parties
• Disables user-installed Fonts
• Disables WebGPU
• Enables advanced tracking and fingerprinting protection in all windows
• Enables Cookies Having Independent Partitioned State (CHIPS) - (WebKitExperimentalOptInPartitionedCookiesEnabled)
• Enables the Cookie Consent API
• Enables ICE Candidate Filtering
• Enables Safari's Fraudulent Website Warning (Google Safe Browsing)
• Enforces Safari to always load all app extensions, content blockers, and web extensions at launch
• Prevents websites from checking if you use Apple Pay/Apple Card
• Switches the homepage from https://www.apple.com/ to Safari's local topsites://

Security

• Always prompts before downloading files
• Connects to websites through HTTPS by default
• Disables automatically opening safe downloads
• Disables FTP
• Disables the HTML <model> element - (WebKitExperimentalModelElementEnabled)
• Disables the HTML <model> element for stand-alone documents - (WebKitExperimentalModelDocumentEnabled)
• Disables JavaScript from Apple Events
• Disables JavaScript in Safari's URL Bar (Smart Search Field...)
• Disables legacy Plug-ins
• Disables local file content sniffing
• Disables MathML
• Disables Remote Automation
• Disables the WebXR Device API
• Enables automatic extension updates
• Enables the link sanitizer
• Enables parsing web fonts with a safe font parser in Lockdown Mode
• Enables Password Breach Detection
• Enables Post Quantum Encryption
• Enables showing the full URL in Safari's URL Bar (Smart Search Field...)
• Enables Trusted Types
• Enables upgrading insecure (HTTP) content to HTTPS in mixed content, including local content
• Enables upgrading known insecure (HTTP) hosts to HTTPS
• Enforces Cross-Origin Embedder Policy
• Enforces Cross-Origin Opener Policy
• Enforces local file restrictions
• Enforces Safari to always prefer sandboxed media parsing
• Enforces Secure Context Checks
• Enforces Site Isolation
• Enforces use of HTTPS
• Prompts users before submitting insecure forms
• Requires biometrics to access Private Browsing tabs
• Requires media capture to use secure connections

Misc.

• Blocks JavaScript from launching browser windows automatically...
• Blocks notification prompts
• Disables Encrypted Media Extensions
• Disables prompts to set Safari as the deafult browser
• Enables CSS Masonry Layout - (WebKitExperimentalMasonryEnabled)
• Enables Safari's Debug menu
• Enables Safari's Develop menu
• Enables user stylesheets

Extended

In addition to the changes noted for Base above, Extended also includes:

Privacy

• Blocks websites from requesting access to geolocation
• Disables Cloud Sync
• Disables 'Frequently Visited' Websites
• Disables WebGL
• Switches the default search engine to DuckDuckGo

Security

• Disables AutoFilling credit cards, contact information, passwords, and misc. forms
• Disables JIT & WASM