Apple services

What is com.apple.WebKit.Networking?

com.apple.WebKit.Networking is the network process of WebKit, the engine of Safari. Safari and apps that show web content load pages through it, so their browsing traffic shows under this process.

Process: com.apple.WebKit.NetworkingAlso seen as: Safari Networking, com.apple.Safari.SafeBrowsing.ServiceMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It is WebKit's network process, which does all network access for Safari and for apps that show web pages, so their browsing shows under it.

Don’t block

Don't block it. Safari and every app that shows web pages stop loading. Block the website instead.

Path
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
Signing identifier
com.apple.WebKit.Networking com.apple.Safari.SafeBrowsing

What it is

WebKit's documentation says that each web page loads in its own WebContent process. Several of those share a browsing session in one shared network process.

WebKit says that the network process handles all network access. It also manages the disk cache and website storage such as IndexedDB.

The program is an XPC service inside WebKit.framework. Activity Monitor can show it with the name of the app it works for, such as Safari Networking.

Apple lists token.safebrowsing.apple for Safari's fraudulent website warnings. A separate Safe Browsing service in macOS handles that.

Why it uses the network

  • Web pages. Pages, images, video and scripts that Safari or a WebKit app loads all go through it.
  • Website data. The network process keeps the disk cache and website storage, so later visits can use less data.
  • Fraud warnings. Safari checks sites against its fraudulent website list. Apple lists a host for that.

How much is normal

A lot of traffic is normal while you browse. It is the sites you visit.

Video streaming in Safari is the biggest part. A film is gigabytes.

When the browser is idle, open tabs can still refresh or stream.

When it uses a lot, and why

  • Video in Safari. Streaming sites send video for as long as it plays, at the quality the site picks.
  • Many open tabs. Tabs that refresh, play media or keep live connections keep using data in the background.
  • Apps with web views. Mail, help viewers and other apps that show web content load it through WebKit too.

Is it safe to block?

Don’t block

Don't block it. Safari and every app that shows web pages stop loading. Block the website instead.

What breaks if you block it

  • Safari can't load any page.
  • Apps that show web content through WebKit, such as Mail's remote content, stop loading it.
  • A rule on this process acts on all browsing. Block the host instead, for every app or one app.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. Close tabs that play video or refresh in the background.

  2. Lower the video quality on streaming sites, in the site's own player.

  3. On a hotspot, turn on Low Data Mode for that network. See Use Low Data Mode on a Mac.

  4. Don't quit it in Activity Monitor. Every open page reloads.

See how much it uses

  1. Open Activity Monitor from Applications › Utilities. Click Network.

  2. Type com.apple.WebKit.Networking in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. nettop cuts names to 15 characters.

    nettop -p 'com.apple.WebKi' -P

With Kilobat

  1. With the network filter on, Kilobat names Safari or the app that opened a connection, not only the WebKit process.

  2. In Connections, click ⓘ on one of its rows. The popover explains the host it talks to.

  3. Ask the same question in Terminal.

    kilobat explain com.apple.WebKit.Networking

  4. Block one site for every app, subdomains included.

    kilobat block-host example.com

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

token.safebrowsing.appleThe Apple host for Safari's fraudulent website warnings.Apple →

What isn’t documented

Apple doesn't document how Activity Monitor names WebKit network processes for each app. The names come from what macOS shows on a test Mac.

Questions

Why is Safari Networking using so much data?

It loads every page, image and video that Safari shows. Video streaming is usually the biggest part.

Is com.apple.WebKit.Networking a virus?

The genuine macOS WebKit networking process is inside WebKit.framework in /System/Library/Frameworks and signed by Apple. Check the process path and signature if unsure.

Sources

Checked on 1 November 2026.