What WebFence does not stop

No filter stops every way around it, and we would rather you know the gaps before you buy than find them later. This page lists the ones we know about, from our own testing.

WebFence makes one promise: a child signed in to a Standard account can't change, stop or uninstall the list you set, and can't reach sites that aren't on it. Here is where that promise ends.

A child who knows an administrator password

An administrator can switch off anything on a Mac, including WebFence. If your child knows your password, or has an administrator account of their own, WebFence can't help. Keep children on Standard accounts and keep the administrator password to yourself. The same goes for starting the Mac from Recovery or an external disk.

Another Mac, a phone or a tablet

WebFence protects the accounts you choose on the Mac where it's installed. It doesn't know about other computers, phones, tablets, game consoles or a friend's laptop.

Another account on the same Mac (cross-user proxy)

If your child can also sign in to an account that isn't protected, such as a sibling's account or a shared account, they can use it to browse freely. A more technical version: a program running in the unprotected account (a "proxy") can pass web traffic through to the protected account. We confirmed this on real hardware. Protect every Standard account your child can sign in to, or make sure they don't know the other passwords, and keep Screen Sharing and Remote Login off.

DNS tunnelling

A skilled user can, very slowly, hide internet traffic inside the address lookups that every Mac makes (this is called DNS tunnelling). It needs special software and a server prepared for it; it isn't something a child stumbles on. WebFence doesn't block it.

The Finder Trash dialog

This is how macOS itself behaves (we are preparing a report for Apple), and an app can't prevent it. What WebFence does about it:

• The next time you unlock WebFence, it notices the filter is gone, shows a banner with the time it happened, and switches the filter back on automatically.
• macOS then asks you to approve the extension again in System Settings ▸ General ▸ Login Items & Extensions ▸ Network Extensions. If the WebFence switch there already looks on, turn it off and on again.

Until you unlock WebFence, the Mac stays unfiltered. Open WebFence regularly, and look for the banner. Families whose Macs are managed with a device-management (MDM) profile can close this gap; contact support for the profile settings.

Opening a copy of the app from somewhere else

Always open WebFence from your Applications folder, never from the disk image or from Downloads. Opening another copy can stop the background service after its next restart until the Mac is restarted. Filtering keeps working meanwhile, but you can't change anything. Eject the disk image after installing.

Only Safari is verified so far

The filter works below the browser, so the same rules apply to Chrome, Firefox, Edge and every other app. But we have only verified it end to end with Safari so far. Testing of Chrome, Firefox and Edge, including their private windows and built-in secure DNS settings, is planned before version 1.0.

Content inside allowed sites

WebFence decides by website, not by page. If you allow a site that can show other sites (a search engine's cached pages, a translation service, a video site, a site that hosts user content), your child can see whatever that site shows. Choose allowed sites with that in mind.

Other, more technical limits

• Someone who controls their own server on the internet can disguise which website a connection is for in a few ways the filter can't see through. This takes skill and preparation.
• A VPN or proxy that an administrator installed is trusted; WebFence doesn't override it.
• A newly installed WebFence briefly blocks the internet for Standard accounts while it starts up. That is deliberate: it fails closed.

WebFence is one layer. Talking with your child, keeping devices in shared rooms and knowing which other devices they use still matter more than any software.