CIS Apple Safari 18 Benchmark

This recommendation verifies that Fraudulent Website Warning Is Enabled on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari WarnAboutFraudulentWebsites
# Should return: 1

# MDM profile check:
profiles -C -o stdout | grep -A2 WarnAboutFraudulentWebsites

defaults write com.apple.Safari WarnAboutFraudulentWebsites -bool true

# Via MDM configuration profile:
# PayloadType: com.apple.Safari
# Key: WarnAboutFraudulentWebsites
# Value: true

This recommendation verifies that Do Not Track Header Is Sent on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari SendDoNotTrackHTTPHeader
# Should return: 1

defaults write com.apple.Safari SendDoNotTrackHTTPHeader -bool true

This recommendation verifies that Preload Top Hit Is Disabled on the Apple Safari 18 web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apple Safari 18 web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

defaults read com.apple.Safari PreloadTopHit
# Should return: 0 (disabled)

defaults write com.apple.Safari PreloadTopHit -bool false

This recommendation verifies that Full Website Address Is Displayed on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari ShowFullURLInSmartSearchField
# Should return: 1

defaults write com.apple.Safari ShowFullURLInSmartSearchField -bool true

This recommendation verifies that Intelligent Tracking Prevention Is Enabled on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari WebKitPreferences.privateClickMeasurementEnabled
# Should return: 1 (Intelligent Tracking Prevention enabled)

defaults write com.apple.Safari WebKitPreferences.privateClickMeasurementEnabled -bool true

# Safari > Settings > Privacy > Prevent cross-site tracking: Enable

This setting ensures that Pop-Up Windows Are Blocked on the Apple Safari 18 web browser. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apple Safari 18 web browser is essential for defense in depth.

defaults read com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically
# Should return: 0

defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically -bool false

# Safari > Settings > Websites > Pop-up Windows: Block and Notify

This recommendation verifies that Plug-Ins Are Disabled on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari WebKitPreferences.plugInsEnabled 2>/dev/null
# Should return: 0

defaults write com.apple.Safari WebKitPreferences.plugInsEnabled -bool false

# Safari > Settings > Websites > Plug-ins: disable all

This recommendation verifies that Java Is Disabled on the Apple Safari 18 web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apple Safari 18 web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

defaults read com.apple.Safari WebKitJavaEnabled 2>/dev/null
# Should return: 0 (or domain not found — Java deprecated)

defaults write com.apple.Safari WebKitJavaEnabled -bool false

This recommendation verifies that AutoFill Passwords Is Disabled on the Apple Safari 18 web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apple Safari 18 web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

defaults read com.apple.Safari AutoFillPasswords
# Should return: 0

defaults write com.apple.Safari AutoFillPasswords -bool false

# Safari > Settings > AutoFill > User names and passwords: Uncheck

This recommendation verifies that AutoFill Credit Cards Is Disabled on the Apple Safari 18 web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apple Safari 18 web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

defaults read com.apple.Safari AutoFillCreditCardData
# Should return: 0

defaults write com.apple.Safari AutoFillCreditCardData -bool false

# Safari > Settings > AutoFill > Credit cards: Uncheck

This recommendation verifies that AutoFill Contact Info Is Disabled on the Apple Safari 18 web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apple Safari 18 web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

defaults read com.apple.Safari AutoFillFromAddressBook
# Should return: 0

defaults write com.apple.Safari AutoFillFromAddressBook -bool false

# Safari > Settings > AutoFill > Using information from my contacts: Uncheck

This recommendation verifies that AutoFill Other Forms Is Disabled on the Apple Safari 18 web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apple Safari 18 web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

defaults read com.apple.Safari AutoFillMiscellaneousForms
# Should return: 0

defaults write com.apple.Safari AutoFillMiscellaneousForms -bool false

# Safari > Settings > AutoFill > Other forms: Uncheck

This recommendation verifies that Search Engine Suggestions Are Suppressed on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari SuppressSearchSuggestions
# Should return: 1 (suggestions suppressed)

defaults write com.apple.Safari SuppressSearchSuggestions -bool true

# Safari > Settings > Search > Include search engine suggestions: Uncheck

This recommendation verifies that Spotlight Suggestions Are Disabled in Safari on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari UniversalSearchEnabled
# Should return: 0

defaults write com.apple.Safari UniversalSearchEnabled -bool false

# Safari > Settings > Search > Include Spotlight Suggestions: Uncheck

This recommendation ensures that Only Required Extensions Are Installed on the Apple Safari 18 web browser. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Apple Safari 18 web browser may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

defaults read com.apple.Safari ExtensionsEnabled
# Review whether extensions are enabled

# List installed extensions:
ls ~/Library/Safari/Extensions/ 2>/dev/null
ls /Library/Safari/Extensions/ 2>/dev/null

# Review and remove unnecessary extensions:
# Safari > Settings > Extensions
# Disable or uninstall extensions that are not required

# Remove extension files:
rm ~/Library/Safari/Extensions/<extension>.safariextz

This setting ensures that Extension Website Access Is Restricted on the Apple Safari 18 web browser. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apple Safari 18 web browser is essential for defense in depth.

# Check per-website extension permissions:
defaults read com.apple.Safari | grep -i extension

# Safari > Settings > Extensions > select extension > Website Access

# For each extension:
# Safari > Settings > Extensions > select extension
# Set Website Access to: Ask for Every Website or specific allowed sites
# Remove extensions with excessive permissions

This recommendation verifies that HTTPS Upgrade Is Enabled on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari UpgradeHTTPSEnabled 2>/dev/null
# Should return: 1 (HTTPS upgrade enabled)

# Safari > Settings > Advanced > Privacy > HTTPS Upgrade

defaults write com.apple.Safari UpgradeHTTPSEnabled -bool true

# Safari > Settings > Advanced > Privacy > HTTPS Upgrade: Enable

This recommendation verifies that Certificate Status Information Is Visible on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check EV certificate display preference:
defaults read com.apple.Safari ShowStatusBar
# Should return: 1
defaults read com.apple.Safari ShowFullURLInSmartSearchField
# Should return: 1

defaults write com.apple.Safari ShowStatusBar -bool true
defaults write com.apple.Safari ShowFullURLInSmartSearchField -bool true

This recommendation verifies that Trust Settings for Root Certificates Are Reviewed on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check for certificate pinning usage with:
security find-identity -v -p ssl-client
# Review system trust settings:
security dump-trust-settings -d 2>/dev/null | head -30

# Review and remove untrusted certificates:
# Keychain Access > System Roots > Certificates
# Set untrusted CAs to 'Never Trust'

security set-trust-settings-trustroot -d <certificate>

This recommendation verifies that Develop Menu Is Disabled in Production on the Apple Safari 18 web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apple Safari 18 web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

defaults read com.apple.Safari IncludeDevelopMenu
# Should return: 0 in production
defaults read com.apple.Safari WebKitDeveloperExtrasEnabled
# Should return: 0

defaults write com.apple.Safari IncludeDevelopMenu -bool false
defaults write com.apple.Safari WebKitDeveloperExtrasEnabled -bool false

# Safari > Settings > Advanced > Show features for web developers: Uncheck

This recommendation verifies that Remote Automation Is Disabled on the Apple Safari 18 web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apple Safari 18 web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

defaults read com.apple.Safari WebKitPreferences.allowsRemoteAutomation 2>/dev/null
# Should return: 0

defaults write com.apple.Safari WebKitPreferences.allowsRemoteAutomation -bool false

# Disable Safari remote automation in Develop menu

This recommendation verifies that JavaScript Bookmarklets Are Reviewed on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari AllowJavaScriptMarkup 2>/dev/null
# Review JavaScript bookmarklet permissions

# Review and remove JavaScript bookmarklets:
# Bookmarks > Edit Bookmarks > identify javascript: URLs
# Delete any untrusted JavaScript bookmarks

This recommendation verifies that External Links Open in Tabs on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari OpenExternalURLsInExistingTab 2>/dev/null
# Check how external links are handled

# Safari > Settings > Tabs > Open pages in tabs instead of windows: Always
defaults write com.apple.Safari TabCreationPolicy -int 2

This recommendation verifies that Push Notification Prompts Are Disabled on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari CanPromptForPushNotifications
# Should return: 0

defaults write com.apple.Safari CanPromptForPushNotifications -bool false

# Safari > Settings > Websites > Notifications > Allow websites to ask: Uncheck

This recommendation verifies that Cookie Blocking Policy Is Restrictive on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari WebKitPreferences.storageBlockingPolicy
# Check cookie blocking policy
defaults read com.apple.Safari BlockStoragePolicy
# Should show restrictive value

defaults write com.apple.Safari BlockStoragePolicy -int 2

# Safari > Settings > Privacy > Block all cookies: Enable
# (Or use ITP for balanced approach)

This setting ensures that Camera & Microphone Permissions Are Restricted on the Apple Safari 18 web browser. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apple Safari 18 web browser is essential for defense in depth.

defaults read com.apple.Safari WebsiteAuthorization 2>/dev/null
# Check camera/microphone permission defaults

# Safari > Settings > Websites > Camera / Microphone

# Safari > Settings > Websites > Camera: set to Ask or Deny for all sites
# Safari > Settings > Websites > Microphone: set to Ask or Deny for all sites
# Safari > Settings > Websites > Location: set to Ask or Deny for all sites

This recommendation verifies that Download List Is Auto-Cleared on the Apple Safari 18 web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apple Safari 18 web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari DownloadsClearingPolicy
# Review download list auto-clearing

ls ~/Downloads/ | wc -l
# Review Downloads folder size

defaults write com.apple.Safari DownloadsClearingPolicy -int 2

# Safari > Settings > General > Remove download list items: After one day
# Or manually: Safari > Settings > General > Remove download list items: When Safari quits

This setting ensures that Browsing History Retention Is Limited on the Apple Safari 18 web browser. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apple Safari 18 web browser is essential for defense in depth.

defaults read com.apple.Safari HistoryAgeInDaysLimit
# Check browsing history retention period

defaults write com.apple.Safari HistoryAgeInDaysLimit -int 30

# Safari > Settings > General > Remove history items: After one month