How to Force SafeSearch on Mac

Learn how to force SafeSearch on Mac using the Hosts file, Terminal commands, your Content Policy, or device management.

Tech Lockdown Team

Updated October 18, 2024

If you're configuring your Mac to block online content, one step you've probably considered is making sure that SafeSearch is always enabled and not intentionally or accidentally bypassed. This guide will take a look at a few effective methods for enforcing SafeSearch on a Mac.

There are several ways to enforce SafeSearch:

Network-level enforcement, such as modifying DNS settings.
Device-specific implementation, including native Mac settings and browser configurations.

In addition to enforcing SafeSearch, you might want to consider blocking search engines that don't support SafeSearch.

We recommend combining several of the below approaches together so that if one enforcement layer fails, the other one can ensure that SafeSearch is still activated.

Protect Browser SafeSearch Preferences with a Configuration Profile

Web browsers like Google Chrome provide SafeSearch preferences that you can force on and prevent from being toggled off.

Once a browser setting is protected, it won't be possible to override it by changing the setting in the browser interface.

You can quickly configure a browser with protected settings, like SafeSearch being forced on, using configuration profiles that can be installed on a Mac .

Go to Tools > Mac > Config Presets in your Tech Lockdown dashboard

Choose whether or not you want to require a password to uninstall this config (recommended if you care about bypass prevention)

Download and install the Force Browser SafeSearch config

If you click the minus button to remove this config, it will prompt you for the removal password, which can be retrieved from your Tech Lockdown dashboard in the uninstall section of Mac Config Presets

Now, when you open one of the supported web browsers (Chrome, Edge, Brave, Safari), you'll see that SafeSearch is completely enforced and can't be overridden.

Enable a SafeSearch Rule on Your Content Policy

This step only applies if you've connected your Mac device and have connected it to the Tech Lockdown content policy . This allows you to enforce SafeSearch on the network-layer of the Mac.

Create a SafeSearch Rule for Supported Search Engines

On the Tech Lockdown dashboard, go to Content Policy, and create a new rule:

Choose SafeSearch from the Create a New Rule screen:

By default, this rule should apply to all search engines that support SafeSearch for all devices connected to your Content Policy.

Bing Chat is disabled by SafeSearch

Like we mentioned previously, Bing's copilot chat may not work while SafeSearch is enabled for Bing.

Here are some workarounds if you need to use Bing chat on the device with SafeSearch enforced.

Create an allow rule

Go to the Content, edit Applications, then select Bing

Add a schedule to choose when Bing is excluded from SafeSearch (like during work or productive hours).

Save the rule then go to the content policy page. Confirm that the Allow rule where bing is selected is higher up in the list above the SafeSearch rule. You can click edit and re-order if it is not.

Block Search Engines that Don't Support SafeSearch

Following the instructions above won't block search engines that don't have a SafeSearch option. You can instead block all but a select group of search engines that you know support SafeSearch.

Create a new Block rule on your Content Policy

Block the category Search Engines. This will now block all search engines, but you'll exclude specific search engines later on.

Edit your existing SafeSearch rule or create a new one.

Uncheck the two categories: News, Portal, & Search and Search Engines

Add the following Domains to the rule instead:

google.com
google.co.uk
bing.com
duckduckgo.com
search.yahoo.com
yandex.com

Important note about rule order

On the Content Policy page, the SafeSearch rule needs to be ordered above the block search engines rule.

Using the Terminal Application to Enforce SafeSearch

An additional layer alongside DNS-enforced SafeSearch is using the Mac's terminal application to configure SafeSearch natively on the Mac and for specific browsers.

To get started, you need to make sure that the Terminal application is configured correctly and that you can open it.

Exclude Bing if you use Copilot

Entering the commands related to Microsoft/bing search will disable Bing Copilot. Omit the associated commands/hosts file entries if you do not want it disabled. Use the Content Policy to schedule when Bing SafeSearch is enabled instead.

Open the Settings Application and search for "Privacy & Security":

In this list, look for Full Disk Access:

If you don't see Terminal listed, click the plus button:

Click on Utilities > Terminal, then Open:

You may need to relaunch Terminal:

Make sure the switch is toggled on:

Open the Terminal application. You can quickly search for Terminal to open it quickly, or find it in Applications > Utilities.

Use the Defaults Command to Force SafeSearch on your Browser

Some browsers let you manually set SafeSearch through the Terminal application. This method works alongside the DNS-enforced SafeSearch.

Do the following for each command below:

Copy/paste each command into terminal

Press the enter (return) key

Google SafeSearch if Google chrome is installed:

defaults write com.google.Chrome.plist GoogleSafeSearch -int 1

Bing SafeSearch if Microsoft edge is installed:

defaults write com.microsoft.edge.plist ForceBingSafeSearch -int 2

Add SafeSearch Hosts File Entries

In addition to the above terminal commands and DNS-level SafeSearch enforcement, you can update the Mac's hosts file to natively enforce SafeSearch across all browsers where the search engines are accessed.

To get started, use terminal to open the hosts file:

Copy the following command, then press return. Enter your Macbook's password (must be an admin) when prompted and press return again. This will open the hosts file in terminal.

sudo nano /etc/hosts

Use your arrow keys to scroll down the file. The mouse and keyboard don't work as you might expect when using terminal/nano.

Now, copy/paste the following entries to the bottom of the hosts file:

# Google SafeSearch
216.239.38.120 google.com
216.239.38.120 www.google.com
216.239.38.120 google.co.uk
216.239.38.120 www.google.co.uk

# Bing SafeSearch
204.79.197.220 www.bing.com
204.79.197.220 bing.com

# DuckDuckGo SafeSearch
52.149.247.1 duckduckgo.com

# Yahoo SafeSearch
98.137.11.163 search.yahoo.com
98.137.11.163 www.search.yahoo.com

# Yandex SafeSearch
77.88.55.80 yandex.com
77.88.55.80 www.yandex.com

## Youtube Safe Search ##
216.239.38.119 www.youtube.com
216.239.38.119 m.youtube.com
216.239.38.119 youtubei.googleapis.com
216.239.38.119 youtube.googleapis.com
216.239.38.119 www.youtube-nocookie.com

Block Non-SafeSearch Search Engines

Not all search engines support the SafeSearch feature. You can block most of them by added these entries to the end of your Hosts file:

0.0.0.0 a.searx.space
0.0.0.0 beezboo.com
0.0.0.0 boomle.com
0.0.0.0 darmarit.org
0.0.0.0 dogpile.com
0.0.0.0 dynabyte.ca
0.0.0.0 ecosia.org
0.0.0.0 engo.mint.lgbt
0.0.0.0 eulie.de
0.0.0.0 fireball.de
0.0.0.0 gibiru.com
0.0.0.0 gigablast.com
0.0.0.0 go.mail.ru
0.0.0.0 haku.ahmia.fi
0.0.0.0 haku.lelux.fi
0.0.0.0 hmsearx.h0meserver.com
0.0.0.0 jsearch.pw
0.0.0.0 lite.qwant.com
0.0.0.0 lukol.com
0.0.0.0 metacrawler.com
0.0.0.0 metager3.de
0.0.0.0 metager.de
0.0.0.0 metager.org
0.0.0.0 metasearch.nl
0.0.0.0 mijisou.com
0.0.0.0 mojeek.com
0.0.0.0 neeva.com
0.0.0.0 nibblehole.com
0.0.0.0 nigma.eu
0.0.0.0 nova.rambler.ru
0.0.0.0 null.media
0.0.0.0 openworlds.info
0.0.0.0 oscobo.com
0.0.0.0 peekier.com
0.0.0.0 ransack.i2p
0.0.0.0 recherche.aol.fr
0.0.0.0 recherche.catmargue.org
0.0.0.0 results.excite.com
0.0.0.0 roteserver.de
0.0.0.0 search.0xcb.dev
0.0.0.0 search.activemail.de
0.0.0.0 search.anonymize.com
0.0.0.0 search.aol.ca
0.0.0.0 search.aol.co.uk
0.0.0.0 search.aol.com
0.0.0.0 search.azkware.net
0.0.0.0 search.biboumail.fr
0.0.0.0 search.bluelock.org
0.0.0.0 search.brave.com
0.0.0.0 search.disroot.org
0.0.0.0 search.ethibox.fr
0.0.0.0 search.gougeul.org
0.0.0.0 search.jigsaw-security.com
0.0.0.0 search.jpope.org
0.0.0.0 search.lgbtq.cool
0.0.0.0 search.mdosch.de
0.0.0.0 search.modalogi.com
0.0.0.0 search.nebulacentre.net
0.0.0.0 search.opentunisia.org
0.0.0.0 search.paulla.asso.fr
0.0.0.0 search.privacytools.io
0.0.0.0 search.seds.nl
0.0.0.0 search.snopyta.org
0.0.0.0 search.spaeth.me
0.0.0.0 search.st8.at
0.0.0.0 search.stinpriza.org
0.0.0.0 search.yahoo.com
0.0.0.0 searchencrypt.com
0.0.0.0 searchx.mobi
0.0.0.0 searx.32bitflo.at
0.0.0.0 searx.alec.ninja
0.0.0.0 searx.bar
0.0.0.0 searx.bbaovanc.com
0.0.0.0 searx.be
0.0.0.0 searx.canox.net
0.0.0.0 searx.ch
0.0.0.0 searx.com.au
0.0.0.0 searx.decatec.de
0.0.0.0 searx.deepak.pro
0.0.0.0 searx.devol.it
0.0.0.0 searx.dojocasts.com
0.0.0.0 searx.dresden.network
0.0.0.0 searx.elukerio.org
0.0.0.0 searx.everdot.org
0.0.0.0 searx.feneas.org
0.0.0.0 searx.fmac.xyz
0.0.0.0 searx.foo.li
0.0.0.0 searx.forked.io
0.0.0.0 searx.fossencdi.org
0.0.0.0 searx.gnu.style
0.0.0.0 searx.gotrust.de
0.0.0.0 searx.guillaumea.fr
0.0.0.0 searx.handskemager.xyz
0.0.0.0 searx.hardwired.link
0.0.0.0 searx.info
0.0.0.0 searx.ir
0.0.0.0 searx.kvch.me
0.0.0.0 searx.lambda.li
0.0.0.0 searx.laquadrature.net
0.0.0.0 searx.lavatech.top
0.0.0.0 searx.lelux.fi
0.0.0.0 searx.libmail.eu
0.0.0.0 searx.likkle.monster
0.0.0.0 searx.linux.pizza
0.0.0.0 searx.lnode.net
0.0.0.0 searx.louifox.house
0.0.0.0 searx.lwhr.xyz
0.0.0.0 searx.lynnesbian.space
0.0.0.0 searx.mastodontech.de
0.0.0.0 searx.maxxblow.de
0.0.0.0 searx.monicz.pl
0.0.0.0 searx.mxchange.org
0.0.0.0 searx.nakhan.net
0.0.0.0 searx.netzspielplatz.de
0.0.0.0 searx.nevrlands.de
0.0.0.0 searx.nightmare.life
0.0.0.0 searx.ninja
0.0.0.0 searx.nixnet.services
0.0.0.0 searx.nulltime.net
0.0.0.0 searx.olymp.to
0.0.0.0 searx.openhoofd.nl
0.0.0.0 searx.openpandora.org
0.0.0.0 searx.operationtulip.com
0.0.0.0 searx.org
0.0.0.0 searx.ouahpiti.info
0.0.0.0 searx.pofilo.fr
0.0.0.0 searx.privatenet.cf
0.0.0.0 searx.prvcy.eu
0.0.0.0 searx.pwoss.org
0.0.0.0 searx.rasp.fr
0.0.0.0 searx.ro
0.0.0.0 searx.ru
0.0.0.0 searx.run
0.0.0.0 searx.rxyz.rocks
0.0.0.0 searx.semipvt.com
0.0.0.0 searx.simonoener.com
0.0.0.0 searx.slash-dev.de
0.0.0.0 searx.solusar.de
0.0.0.0 searx.sp-codes.de
0.0.0.0 searx.sulu.me
0.0.0.0 searx.sunless.cloud
0.0.0.0 searx.thegreenwebfoundation.org
0.0.0.0 searx.tuxcloud.net
0.0.0.0 searx.tyil.nl
0.0.0.0 searx.vitanetworks.link
0.0.0.0 searx.wegeeks.win
0.0.0.0 searx.win
0.0.0.0 searx.xyz
0.0.0.0 searx.zapashcanon.fr
0.0.0.0 searx.zdechov.net
0.0.0.0 searxzh.cn
0.0.0.0 seeks.hsbp.org
0.0.0.0 skyn3t.in
0.0.0.0 spot.ecloud.global
0.0.0.0 startpage.com
0.0.0.0 suche.aol.de
0.0.0.0 suche.dasnetzundich.de
0.0.0.0 suche.mexmail.de
0.0.0.0 suche.uferwerk.org
0.0.0.0 suchfeuer.de
0.0.0.0 timdor.noip.me
0.0.0.0 tromland.org
0.0.0.0 trovu.komun.org
0.0.0.0 unmonito.red
0.0.0.0 webcrawler.com
0.0.0.0 websearch.excite.co.jp
0.0.0.0 wtf.roflcopter.fr
0.0.0.0 www.finden.tk
0.0.0.0 www.gruble.de
0.0.0.0 www.perfectpixel.de
0.0.0.0 www.searxs.eu
0.0.0.0 yep.com
0.0.0.0 yippy.com
0.0.0.0 you.com
0.0.0.0 zoek.anchel.nl

After adding your desired host entries, press ctrl+x and then shift+y to save changes.

To see your changes, flush your Mac's DNS first.

Type the following command into terminal and press enter:

sudo killall -HUP mDNSResponder

If prompted for a sudo password, enter your administrator account password (probably the account you login to your mac with)

Enforce SafeSearch with Screen Time

Another way that you can enforce SafeSearch is by using Screen Time settings. Screen Time let's you set adult sites as limited on Safari.

Open Settings and search for Screen Time

Scroll down and select Content & Privacy Restrictions

Click on Store, Web, Siri & Game Center Content

Under Access to Web Content, choose Limit Adult Websites

Click done to save

It is also possible to install a specialized Config Preset that enforces the Limit Adult Websites feature. Since Config Files can be locked behind a complex password, this is a lot more effective than the 4-digit PIN Screen Time uses.

Frequently Asked Questions

Which options to enable SafeSearch should I consider?

If you're self-managing your own technology, a good rule of thumb is to enable multiple layers at the same time. This helps build something we call the blocking system, which is necessary to consider if your goal is to ultimately eradicate and block porn on a mac .

If you want the most restrictive setup for yourself, we strongly recommend using Config Files, the Hosts file, and Content Policy rules all at once. Optionally, you can also use the Terminal commands to add a final backup layer.

Just note that in order to undo the restriction, the Hosts file, Config File, and Content Policy rule will all need to be disabled at once.

How do I undo the Terminal Commands that enforce SafeSearch?

You'll want to use these commands:

defaults delete com.google.Chrome.plist GoogleSafeSearch
defaults delete com.microsoft.edge.plist ForceBingSafeSearch

How does SafeSearch impact other browser features?

Before enforcing SafeSearch, you should be aware Microsoft's Copilot Chat may not work properly depending on how you access it.

If SafeSearch is enforced, you'll see this message when trying to access bing's copilot feature:

Here are some possible work-arounds:

Assign a schedule to the content policy SafeSearch rule to turn off bing safesearch during productive hours, then turn it back on during leisure time.
Omit the bing entries and commands discussed in this guide.