How WebFence works
WebFence has three parts that ship inside one app. You only ever use the first; the other two keep working when the app is closed.
The parts
- The WebFence app (for you)
- Where you choose protected accounts, edit the allowed sites, switch modes and see the status. It opens locked; you unlock it with your macOS administrator password. A child who opens it sees the status and nothing they can change.
- The policy service (runs in the background)
- A macOS background service that starts at boot and keeps your list in a database only the system can read or write. It accepts a change only after macOS has confirmed an administrator approved it.
- The network filter (part of macOS networking)
- A macOS content-filter extension. Every new connection a protected account makes goes past it, and it allows the connection only if the destination is on the list. Other accounts on the Mac are not affected.
What happens when your child opens a website
- The browser starts a connection to, say,
www.example.com. - The filter checks which account the connection belongs to. If it isn't a protected account, it is allowed and nothing is recorded.
- For a protected account, the filter compares the website's name with your list. A rule for
example.comwith subdomains allowswww.example.combut neverevil-example.com. - Not on the list: the connection is refused and the attempt is noted (site, app, port, reason) so you can review it and add the site if you agree.
WebFence does not open or read encrypted traffic, doesn't install a certificate and doesn't see page contents. It decides by destination only.
The modes
| Mode | Protected accounts can reach |
|---|---|
| Allowlist Active | Only the sites on your list |
| Internet Locked | Nothing on the internet |
| Protection Off | Everything, as if WebFence weren't installed |
Every mode change and every change to the list asks for your macOS administrator password, every time. There is no separate WebFence password.
Why "Protected" means something
The dashboard shows Protected only when three things are true: the filter has confirmed it is enforcing your latest list, it reported in within the last few seconds, and its self-test passed. Otherwise you see Needs Approval or Degraded with what to do next, so you never get a green tick for protection that isn't there.
What a child can't do
From a Standard account, your child can't quit the filter, stop the background service, edit the database, change proxy or DNS settings to get around it, or uninstall WebFence. Each of those needs an administrator. We tested these on real hardware; the one exception we know of is described on the limitations page.
Browsers
The filter works below the browser, so it applies to every app the protected account runs. So far we have verified it end to end with Safari. Testing with Chrome, Firefox and Edge is planned before version 1.0; until then, if your child uses one of those, please treat it as untested.
Updates and licensing
When you unlock the app, WebFence checks for updates (see privacy for exactly what that sends) and offers to install them; nothing installs without you. Your license key is checked on the Mac itself, with no activation server.
Tips for a smooth start
- Give each child their own Standard account, and keep the administrator password to yourself.
- Sign in to a new child account once, and finish the macOS welcome screens, before you protect it. A brand-new account needs to reach Apple during its first sign-in, which a protected account can't.
- Turn off the Guest account, Screen Sharing and Remote Login if you don't need them.
- Only ever open the copy of WebFence in your Applications folder.