Last updated: August 14, 2026
Web Content Filter
This page explains how to configure a macOS Web Content Filter profile using MDM to manage and secure web traffic on corporate Mac devices running macOS 10.15 and above. IT admins can set up third-party plug-in filters by specifying plugin bundle IDs, choosing between socket or packet filter types for application or network-level traffic control, setting filter grades, and enabling webkit filtering for browser traffic. Pairing this profile with System Extensions and PPPC policies is recommended for full functionality.
With an increased number of threats, attacks, scams across the internet, it is the foremost task of the IT admin to establish a protected workspace. Managing web content of your corporate mac devices is made simple with MDM. You can manage your web traffic by configuring a third party plug-in a web content filter profile and apply to your devices.
Note: This is applicable for devices above macOS version 10.15. It is recommended to configure a System Extensions policy and PPPC along with this plug-in filter.
Configuring Plug-ins
| Profile Specification | Description |
|---|---|
| Filter name | Provide a name for your plug-in. |
| Plugin bundle id | Fill the plugin bundle id and not the app bundle id. Ex: com.crowdstrike.falcon.App |
| Filter type | Choose the type of the filter as socket if you wanted to manage the application traffic or choose packet if you want to manage the network packet traffic. |
| Socket Bundle identifier | Enter the bundle identifier of the socket. Ex: identifier "com.crowdstrike.falcon.Agent" |
| Socket Designated identifier | Enter the designated identifier of the socket. Ex: identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.011] = "X9E956P446" |
| Packet Bundle identifier | Enter the bundle identifier of the packet. Ex: com.checkpoint.fw.filter |
| Packet Designated identifier | Enter the designated identifier of the packet. Ex: anchor apple generic and identifier "com.checkpoint.fw.filter" and (certificate leaf[field.1.2.840.113635.100.6.1.9] / exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf [field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = TZ3UEPFYKD) |
| Filter grade | Choose the filter grade as firewall, if you wanted to filter the network level traffic or else choose inspect if you wanted the filter grade something below network level. |
| Filter webkit | If you choose to filter webkit, you can manage the browser traffic. |
| Vendor configuration | There might be certain additional functions offered by the vendors to manage the web content. Contact the web content filter vendor to know what functions can be performed. |
Note: There are some advanced settings which are optional and can be enabled when specified by the vendor.
Frequently Asked Questions
What macOS version is required to use a Web Content Filter profile?
This profile is applicable for devices running above macOS version 10.15.
Should I configure any other profiles together with Web Content Filter?
Yes, it's recommended to configure a System Extensions policy and PPPC alongside this plug-in filter.
What's the difference between choosing Socket or Packet as the filter type?
Choose socket if you want to manage application-level traffic, or packet if you want to manage network packet traffic instead.