Do I need MDM to lock a Mac to one website?

No. MDM is the right tool for centrally managing a fleet you administer. For one Mac or a handful, a kiosk app like Canned Web locks the Mac to a site on its own, with no configuration profiles, server, account or subscription.

What happens if the kiosk app crashes?

With Canned Web, a watchdog relaunches it automatically and it seals back into the site; with auto-start at login it also recovers after a restart or power cut. A DIY setup has no equivalent: a crashed full-screen browser simply drops the visitor at the desktop.

Can it reset between visitors?

Yes. Canned Web’s idle reset returns to your home page and clears navigation, scroll and form state after a period of inactivity, so each visitor starts fresh. Scroll-only mode and an on-screen Home button are optional extras.

How to lock a Mac to one website

So visitors can use the site, and nothing else.

To lock a Mac to a single website you need two things macOS does not give you out of the box: a browser that fills the screen and cannot be left, and a lock on the system around it (Cmd-Tab, Cmd-Q, Spotlight, Force Quit, the address bar). There are three ways to get there: build it yourself from a standard user account and Screen Time, enforce it through an MDM, or install a kiosk browser app that does it in one step. Here is what each one really gives you.

Route 1: do it yourself (free, partial)

Create a separate standard (non-admin) user account for the kiosk and log into it.
Make the browser open at login (Login Items) with your URL as its home page, then put it in full screen.
In Screen Time, turn on Content & Privacy, allow only your website, and use App Limits to block everything else.
Hide the Dock, set the account to log in automatically, and turn off “require password on wake”.

This is better than nothing, and it is fine for a low-stakes screen you are standing next to. It is not a lockdown. Full-screen Safari is cosmetic: Cmd-Tab still switches apps, Cmd-Q quits, Spotlight launches anything, the address bar accepts any URL, and Cmd-Option-Esc opens Force Quit. Screen Time narrows the damage but cannot remove those shortcuts, its limits are easy to trip over, and the whole thing unlocks with the account passcode. More on why in Safari kiosk mode on a Mac and disabling Cmd-Tab, Spotlight and screenshots.

Route 2: MDM (powerful, heavy)

An MDM (Jamf, Kandji, Mosyle, Intune and others) pushes a configuration profile that restricts apps, hides the Dock and keeps the Mac in a managed state. It is the right tool for a fleet you administer centrally, and the only route if you also need remote control over many devices. The cost is machinery: enrollment, profiles, a subscription per device, and someone to run it. For one booth or a few Macs that is a lot of overhead to show one page, and on its own it still does not give you a true single-website browser.

Route 3: a kiosk browser app (one step)

A kiosk app does the lockdown itself, with no profile and no server. What to look for:

Blocks the system shortcuts: Cmd-Tab, Cmd-Q, Spotlight, Mission Control, screenshots, Force Quit.
Locks navigation to your domain (ideally a single path too), with an allowlist for a payment or login provider.
Leaves exactly one deliberate way out: an exit password.
Starts at login and seals automatically, so it survives a restart or a power cut.
Relaunches on its own if it ever crashes.
Resets between visitors, returning to the home page after inactivity.

Canned Web does all of the above as a native Mac app, with no MDM, no account and no cloud. Enter the URL, hold ⌘⇧S, and the Mac is locked to that site until you hold the shortcut again and type your exit password. One-time €49 per machine with updates included, a 14-day free trial, macOS 14 or later on Apple Silicon or Intel.

Download for Mac How it works Setup guide

Which route?

One Mac, a booth, or a few screens: A kiosk app. Minutes to set up, nothing to administer, and the shortcuts are actually blocked.
A fleet you already manage: Your MDM, for enrollment and policy. You can still run a kiosk app on top for the sealed browser.
A screen you are sitting next to: The DIY route is enough, as long as you accept that a curious visitor is one keystroke from the desktop.

FAQ

Can visitors escape fullscreen Safari?: Yes. Full screen is a view mode, not a lock. Cmd-Tab switches apps, Cmd-Q quits Safari, Spotlight opens anything, the address bar accepts any URL, and Cmd-Option-Esc opens Force Quit. A real kiosk needs those blocked at the system level, which no browser setting does.
Do I need MDM to lock a Mac to one website?: No. MDM is the right tool for centrally managing a fleet you administer. For one Mac or a handful, a kiosk app like Canned Web locks the Mac to a site on its own, with no configuration profiles, server, account or subscription.
What happens if the kiosk app crashes?: With Canned Web, a watchdog relaunches it automatically and it seals back into the site; with auto-start at login it also recovers after a restart or power cut. A DIY setup has no equivalent: a crashed full-screen browser simply drops the visitor at the desktop.
Can it reset between visitors?: Yes. Canned Web’s idle reset returns to your home page and clears navigation, scroll and form state after a period of inactivity, so each visitor starts fresh. Scroll-only mode and an on-screen Home button are optional extras.

Not sure which route fits? Tell us the setup and we will be straight with you.

Email [email protected]