--- title: WebContentFilter framework: devicemanagement role: symbol role_heading: Device Management Profile path: devicemanagement/webcontentfilter --- # WebContentFilter The payload that configures web content filters. ## Declaration ```data object WebContentFilter ``` ## Properties AllowListBookmarks: An array of dictionaries that define the pages that the user can bookmark or visit. Use when FilterType is BuiltIn. Available: iOS 14.5+ | iPadOS 14.5+ | visionOS 1.1+ AutoFilterEnabled: If true, the system enables automatic filtering. Use when FilterType is BuiltIn. Available: iOS 7+ | iPadOS 7+ | visionOS 1.1+ BlacklistedURLs: Use DenyListURLs instead. Available: iOS 7+ | iPadOS 7+ Deprecated: iOS 14.5+ | iPadOS 14.5+ ContentFilterUUID: A globally unique identifier for this content filter configuration. The content filter processes network traffic for managed apps with the same ContentFilterUUID in their app attributes. Use when FilterType is Plugin.This key must be present for unsupervised devices and user enrollment. Available: iOS 16+ | iPadOS 16+ | visionOS 1.1+ DenyListURLs: An array of URLs that are inaccessible. Use when FilterType is BuiltIn. Limit the number of these URLs to no more than 500. Available: iOS 14.5+ | iPadOS 14.5+ | visionOS 1.1+ FilterBrowsers: If true, the system enables filtering WebKit traffic. Use when FilterType is Plugin. note: At least one of FilterBrowsers or FilterSockets needs to be true. Available: iOS 7+ | iPadOS 7+ | visionOS 1.1+ FilterDataProviderBundleIdentifier: The bundle identifier string of the filter data provider system extension. This string identifies the filter data provider when the filter starts running. Required if FilterSockets is true. FilterDataProviderDesignatedRequirement: The designated requirement string that the system embeds in the code signature of the filter data provider system extension. This string identifies the filter data provider when the filter starts running. Required if FilterSockets is true. Available: macOS 10.15+ FilterGrade: The system uses this value to derive the relative order of content filters. Filters with a grade of firewall see network traffic before filters with a grade of inspector. However, the system doesn’t define the order of filters within a grade. Available: macOS 10.15+ FilterPacketProviderBundleIdentifier: The bundle identifier string of the filter packet provider system extension. This string identifies the filter packet provider when the filter starts running. Required if FilterPackets is true. Available: macOS 10.15+ FilterPacketProviderDesignatedRequirement: The designated requirement string that the system embeds in the code signature of the filter packet provider system extension. This string identifies the filter packet provider when the filter starts running. Required if FilterPackets is true. Available: macOS 10.15+ FilterPackets: If true and FilterType is Plugin, the system enables filtering network packets. Use when FilterType is Plugin. note: At least one of FilterPackets or FilterSockets needs to be true. Available: macOS 10.15+ FilterSockets: If true, enables the filtering of socket traffic. Use when FilterType is Plugin. note: At least one of FilterBrowsers or FilterSockets needs to be true. FilterType: The type of filter, built-in or plug-in. In macOS, the system only supports the plug-in value. Available: iOS 8+ | iPadOS 8+ | macOS 10.15+ | visionOS 1.1+ FilterURLs: If true, the system filters URL requests. Use when FilterType is Plugin. Available: iOS 26+ | iPadOS 26+ | macOS 26+ HideDenyListURLs: If true, the device hides the DenyListURLs item in the profiles that display in Settings > General > VPN & Device Management. Available: iOS 18+ | iPadOS 18+ | visionOS 2+ Organization: The organization string to pass to the third-party plug-in. Use when FilterType is Plugin. Password: The password for the service. Use when FilterType is Plugin. PayloadCertificateUUID: The UUID of the certificate payload within the same profile that the system uses to authenticate the user. Use when FilterType is Plugin. PermittedURLs: An array or URLs that are accessible whether or not the automatic filter allows access. Use when FilterType is BuiltIn. Requires that AutoFilterEnabled is true. Available: iOS 7+ | iPadOS 7+ | visionOS 1.1+ PluginBundleID: The bundle ID of the plug-in that provides filtering service. Required when FilterType is Plugin. Otherwise, it ignores this value. Consult your filtering solution vendor to determine what to specify for this value. Required when FilterType is Plugin. SafariHistoryRetentionEnabled: If true, this payload enforces a policy which requires retention of browsing history. This causes Safari to disable clearing of browsing history, and prevents the use of private browsing mode because that mode doesn’t keep browsing history. Available: iOS 26+ | iPadOS 26+ | macOS 26+ | visionOS 26+ ServerAddress: The server address, which may be the IP address, hostname, or URL. Use when FilterType is Plugin. URLFilterParameters: A dictionary containing URL filter parameters. Required when FilterURLs is true. Available: iOS 26+ | iPadOS 26+ | macOS 26+ UserDefinedName: The display name for this filtering configuration. Required when FilterType is Plugin. UserName: The user name for the service. Use when FilterType is Plugin. VendorConfig: The custom dictionary that the filtering service plug-in needs. Use when FilterType is Plugin. WhitelistedBookmarks: Use AllowListBookmarks instead. Available: iOS 7+ | iPadOS 7+ Deprecated: iOS 14.5+ | iPadOS 14.5+ ## Discussion Discussion Specify com.apple.webcontent-filter as the payload type. The system matches URLs using string-based matching. A URL matches an allow list, deny list, or permitted list pattern if the exact characters of the pattern appear as a substring of the URL requested in the web browser. For example, if the system doesn’t allow test.com/a, it blocks test.com/a, test.com/apple, and test.com/a/b. The system matches list entries that terminate with a / character explicitly; if the system blocks or allows test.com/a/, it blocks or allows test.com/a and test.com/a/b. Matching discards a www subdomain prefix if present, so if the system doesn’t allow www.test.com, it also blocks m.test.com. All filtering options are active simultaneously. The system only permits URLs and sites that pass all rules. Profile availability | | | | | | | | Profile example PayloadContent AutoFilterEnabled DenylistURLs https://notallowedname.company.com FilterBrowsers FilterSockets FilterType BuiltIn PermittedURLs https://example.company.com PayloadIdentifier com.example.mywebcontentfilterpayload PayloadType com.apple.webcontent-filter PayloadUUID fb5d598f-0a96-4b77-9702-9edfc3417601 PayloadVersion 1 PayloadDisplayName Web Content Filter PayloadIdentifier com.example.myprofile PayloadType Configuration PayloadUUID b510e0c6-dc81-4b62-88d0-6a3ef82925e7 PayloadVersion 1 ## Topics ### Objects - [WebContentFilter.AllowListBookmarksItem](devicemanagement/webcontentfilter/allowlistbookmarksitem.md) - [WebContentFilter.URLFilterParameters](devicemanagement/webcontentfilter/urlfilterparameters-data.dictionary.md) - [WebContentFilter.VendorConfig](devicemanagement/webcontentfilter/vendorconfig-data.dictionary.md) - [WebContentFilter.WhitelistedBookmarksItem](devicemanagement/webcontentfilter/whitelistedbookmarksitem.md) ## See Also ### Web - [WebClip](devicemanagement/webclip.md)