--- title: "com.apple.WebKit.Networking: what Safari Networking is, and whether to block it · Kilobat" url: "https://kilobat.app/processes/webkit-networking" description: "com.apple.WebKit.Networking is WebKit's network process, which loads pages for Safari and apps. Why it uses so much data, and why you block sites, not this process." --- Apple services # What is com.apple.WebKit.Networking? `com.apple.WebKit.Networking` is the network process of WebKit, the engine of Safari. Safari and apps that show web content load pages through it, so their browsing traffic shows under this process. Process: `com.apple.WebKit.Networking` · Also seen as: `Safari Networking`, `com.apple.Safari.SafeBrowsing.Service` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It is WebKit's network process, which does all network access for Safari and for apps that show web pages, so their browsing shows under it. Don’t block Don't block it. Safari and every app that shows web pages stop loading. Block the website instead. Path `/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking` `/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service` Signing identifier `com.apple.WebKit.Networking` `com.apple.Safari.SafeBrowsing` ## What it is WebKit's documentation says that each web page loads in its own WebContent process. Several of those share a browsing session in one shared network process. WebKit says that the network process handles all network access. It also manages the disk cache and website storage such as IndexedDB. The program is an XPC service inside `WebKit.framework`. Activity Monitor can show it with the name of the app it works for, such as Safari Networking. Apple lists `token.safebrowsing.apple` for Safari's fraudulent website warnings. A separate Safe Browsing service in macOS handles that. ## Why it uses the network - **Web pages.** Pages, images, video and scripts that Safari or a WebKit app loads all go through it. - **Website data.** The network process keeps the disk cache and website storage, so later visits can use less data. - **Fraud warnings.** Safari checks sites against its fraudulent website list. Apple lists a host for that. ## How much is normal A lot of traffic is normal while you browse. It is the sites you visit. Video streaming in Safari is the biggest part. A film is gigabytes. When the browser is idle, open tabs can still refresh or stream. ## When it uses a lot, and why - **Video in Safari.** Streaming sites send video for as long as it plays, at the quality the site picks. - **Many open tabs.** Tabs that refresh, play media or keep live connections keep using data in the background. - **Apps with web views.** Mail, help viewers and other apps that show web content load it through WebKit too. ## Is it safe to block? Don’t block Don't block it. Safari and every app that shows web pages stop loading. Block the website instead. What breaks if you block it - Safari can't load any page. - Apps that show web content through WebKit, such as Mail's remote content, stop loading it. - A rule on this process acts on all browsing. Block the host instead, for every app or one app. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. Close tabs that play video or refresh in the background. 2. Lower the video quality on streaming sites, in the site's own player. 3. On a hotspot, turn on Low Data Mode for that network. See [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac). 4. Don't quit it in Activity Monitor. Every open page reloads. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `com.apple.WebKit.Networking` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. nettop cuts names to 15 characters. ``` nettop -p 'com.apple.WebKi' -P ``` ## With Kilobat 1. With the network filter on, Kilobat names Safari or the app that opened a connection, not only the WebKit process. 2. In Connections, click ⓘ on one of its rows. The popover explains the host it talks to. 3. Ask the same question in Terminal. ``` kilobat explain com.apple.WebKit.Networking ``` 4. Block one site for every app, subdomains included. ``` kilobat block-host example.com ``` The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Hosts it contacts Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac. - [token.safebrowsing.apple](https://kilobat.app/hosts/token-safebrowsing-apple): The Apple host for Safari's fraudulent website warnings. ## What isn’t documented Apple doesn't document how Activity Monitor names WebKit network processes for each app. The names come from what macOS shows on a test Mac. ## Questions **Why is Safari Networking using so much data?** It loads every page, image and video that Safari shows. Video streaming is usually the biggest part. **Is com.apple.WebKit.Networking a virus?** The genuine macOS WebKit networking process is inside WebKit.framework in `/System/Library/Frameworks` and signed by Apple. Check the process path and signature if unsure. ## Sources - [WebKit Documentation: WebKit2, WebKit’s multi-process architecture](https://docs.webkit.org/Deep%20Dive/Architecture/WebKit2.html) - [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555) - [Apple Support: View network activity in Activity Monitor on Mac](https://support.apple.com/guide/activity-monitor/view-network-activity-actmntr1006/mac) Checked on 1 November 2026. ## Related - [networkserviceproxy](https://kilobat.app/processes/networkserviceproxy): Part of macOS. It is the transparent proxy for Apple system services and can carry iCloud Private Relay traffic, so other apps' browsing can show under it. - [mDNSResponder](https://kilobat.app/processes/mdnsresponder): Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups. - [“Safari can’t connect to the server” on Mac](https://kilobat.app/guides/safari-cant-connect-to-server) - [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth)