Web Content Filter

The type of filter, built-in or plug-in. In macOS, the system only supports the plug-in value.

The system uses this value to derive the relative order of content filters. Filters with a grade of 'firewall' see network traffic before filters with a grade of 'inspector'. However, the system doesn't define the order of filters within a grade.

If 'true', the system enables automatic filtering. Use when 'FilterType' is 'BuiltIn'.

An array or URLs that are accessible whether or not the automatic filter allows access. Use when 'FilterType' is 'BuiltIn'. Requires that 'AutoFilterEnabled' is 'true'.

—

If 'true', the system enables filtering WebKit traffic. Use when 'FilterType' is 'Plugin'. Note: At least one of 'FilterBrowsers' or 'FilterSockets' needs to be 'true'.

An array of dictionaries that define the pages that the user can bookmark or visit. Use when 'FilterType' is 'BuiltIn'.

—

The URL of the bookmark in the allow list.

The title of the bookmark.

The URL of the bookmark in the allow list.

The title of the bookmark.

Use 'AllowListBookmarks' instead.

—

The URL of the bookmark in the allow list.

The title of the bookmark.

The URL of the bookmark in the allow list.

The title of the bookmark.

An array of URLs that are inaccessible. Use when 'FilterType' is 'BuiltIn'. Limit the number of these URLs to no more than 500.

—

Use 'DenyListURLs' instead.

—

The display name for this filtering configuration. Required when 'FilterType' is 'Plugin'.

Depends on: FilterType ∈ [Plugin]

The bundle ID of the plug-in that provides filtering service. Required when 'FilterType' is 'Plugin'. Otherwise, it ignores this value. Consult your filtering solution vendor to determine what to specify for this value. Required when 'FilterType' is 'Plugin'.

Depends on: FilterType ∈ [Plugin]

The server address, which may be the IP address, hostname, or URL. Use when 'FilterType' is 'Plugin'.

The user name for the service. Use when 'FilterType' is 'Plugin'.

The password for the service. Use when 'FilterType' is 'Plugin'.

The UUID of the certificate payload within the same profile that the system uses to authenticate the user. Use when 'FilterType' is 'Plugin'.

The organization string to pass to the third-party plug-in. Use when 'FilterType' is 'Plugin'.

If 'true', enables the filtering of socket traffic. Use when 'FilterType' is 'Plugin'. Note: At least one of 'FilterBrowsers' or 'FilterSockets' needs to be 'true'.

The bundle identifier string of the filter data provider system extension. This string identifies the filter data provider when the filter starts running. Required if 'FilterSockets' is 'true'.

Depends on: FilterSockets ∈ [true]

The designated requirement string that the system embeds in the code signature of the filter data provider system extension. This string identifies the filter data provider when the filter starts running. Required if 'FilterSockets' is 'true'.

Depends on: FilterSockets ∈ [true]

If 'true' and 'FilterType' is 'Plugin', the system enables filtering network packets. Use when 'FilterType' is 'Plugin'. Note: At least one of 'FilterPackets' or 'FilterSockets' needs to be 'true'.

The bundle identifier string of the filter packet provider system extension. This string identifies the filter packet provider when the filter starts running. Required if 'FilterPackets' is 'true'.

Depends on: FilterPackets ∈ [true]

The designated requirement string that the system embeds in the code signature of the filter packet provider system extension. This string identifies the filter packet provider when the filter starts running. Required if 'FilterPackets' is 'true'.

Depends on: FilterPackets ∈ [true]

The custom dictionary that the filtering service plug-in needs. Use when 'FilterType' is 'Plugin'.

—

The custom key/value pairs for the filtering service.

A globally unique identifier for this content filter configuration. The content filter processes network traffic for managed apps with the same 'ContentFilterUUID' in their app attributes. Use when 'FilterType' is 'Plugin'.This key must be present for unsupervised devices and user enrollment.

If 'true', the device hides the 'DenyListURLs' item in the profiles that display in Settings > General > VPN & Device Management.

If 'true', the system filters URL requests. Use when 'FilterType' is 'Plugin'. Available in iOS 26 and macOS 26, and later.

A dictionary containing URL filter parameters. Required when 'FilterURLs' is 'true'. Available in iOS 26 and macOS 26 and later.

Depends on: FilterURLs ∈ [true]

The designated requirement string in the code signature of the URL filter control provider app extension. The system uses this string to identify the URL filter control provider when the filter starts running. Required in macOS.

The bundle identifier string of the URL filter control provider app extension. The system uses this string to identify the URL filter control provider when the filter starts running.

The URL containing the domain name of the private information retrieval server.

The URL containing the domain name of Privacy Pass Issuer.

The per-user authentication token string, which is an HTTP bearer token for the person using your app. The system uses this token to attest that it is a valid user when requesting anonymous authentication tokens for PIR exchanges.

If 'true', the system blocks URLs if the filter is enabled, but it fails to make any filtering decision; for example, if there's a communication failure with the PIR server. If 'false', the system allows URLs if the filter is enabled, but it fails to make any filtering decision.

The time interval in seconds that the system uses to periodically run the 'NEURLFilterControlProvider' app extension. The default value is 86400 seconds (1 day). The minimum allowed value is 2700 seconds (45 minutes). The system allows 'NEURLFilterControlProvider' implementations to download prefilter Bloom filter data onto the device periodically at the specified interval. Implementations need to allow for a slight difference between the scheduled time and the actual runtime of the task, due to the scheduling mechanism on the system.

If 'true', this payload enforces a policy which requires retention of browsing history. This causes Safari to disable clearing of browsing history, and prevents the use of private browsing mode because that mode doesn't keep browsing history.

—

—

The URL of the bookmark in the allow list.

The title of the bookmark.

The URL of the bookmark in the allow list.

The title of the bookmark.

—

The URL of the bookmark in the allow list.

The title of the bookmark.

The URL of the bookmark in the allow list.

The title of the bookmark.

—

—

—

The custom key/value pairs for the filtering service.

The designated requirement string in the code signature of the URL filter control provider app extension. The system uses this string to identify the URL filter control provider when the filter starts running. Required in macOS.

The bundle identifier string of the URL filter control provider app extension. The system uses this string to identify the URL filter control provider when the filter starts running.

The URL containing the domain name of the private information retrieval server.

The URL containing the domain name of Privacy Pass Issuer.

The per-user authentication token string, which is an HTTP bearer token for the person using your app. The system uses this token to attest that it is a valid user when requesting anonymous authentication tokens for PIR exchanges.

If 'true', the system blocks URLs if the filter is enabled, but it fails to make any filtering decision; for example, if there's a communication failure with the PIR server. If 'false', the system allows URLs if the filter is enabled, but it fails to make any filtering decision.

The time interval in seconds that the system uses to periodically run the 'NEURLFilterControlProvider' app extension. The default value is 86400 seconds (1 day). The minimum allowed value is 2700 seconds (45 minutes). The system allows 'NEURLFilterControlProvider' implementations to download prefilter Bloom filter data onto the device periodically at the specified interval. Implementations need to allow for a slight difference between the scheduled time and the actual runtime of the task, due to the scheduling mechanism on the system.