Lock a Mac to one website

There’s no built-in macOS kiosk mode — unlike iPadOS, the Mac has no Guided Access or Single App Mode you can just switch on. So when you’ve got a Mac that needs to show one website to the public — an exhibition screen, a product demo at a trade-show booth, a reception display, digital signage — and visitors have to be able to use it without quitting the app, wandering off-site, or reaching the desktop, you have to build that lockdown yourself. Here’s how, and the options in order of pain.

The native options (and where they stop)

Apple Configurator — Single App Mode

Free, but you supervise the Mac over USB, build a configuration profile, and it locks to an app, not a website. Fiddly to set up and easy to get subtly wrong.

Guided Access

iPad and iPhone only — it doesn’t exist on macOS, so it’s off the table for a Mac kiosk.

Full-screen Safari + hiding the Dock

Cosmetic, not escape-proof. Cmd-Tab, Spotlight, screenshots and keyboard shortcuts all still work, so a curious visitor is one keystroke from your desktop.

MDM (Jamf, Hexnode, Scalefusion, KioWare…)

Powerful and genuinely good for fleets — but it’s a subscription and a lot of overhead for a single screen. Overkill when you just need one Mac showing one page.

What “locked down” actually needs

A screen you can hand to the public has to do all of this — not just look full-screen:

• Take over the whole screen with one website, fullscreen.
• Block the escapes: Spotlight, Cmd-Tab, Cmd-Q, Mission Control, screenshots and media keys.
• Lock to the domain so off-site links don’t navigate away.
• Survive a restart or power cut — auto-login and auto-start back into the site.
• Leave exactly one deliberate way out (a password), so a visitor can’t stumble on it.
• Optionally: scroll-only mode, on-screen back/forward/home, and pick which display runs it.

The simple way: Canned Web

Canned Web is a native Mac app that does every point on that list. Enter a URL, hold ⌘⇧S to seal, and hand over the Mac — it’s locked to your site until you hold the shortcut again and type your exit password. No MDM, no configuration profiles, no subscription, no cloud, and nothing phones home.

It works with a live URL or a website folder stored on the Mac (fully offline), runs on macOS 14.0 or later on Apple Silicon or Intel, and it’s a one-time €49 per machine — with a 14-day free trial so you can seal a real screen before you buy.

Mac kiosk mode — FAQ

Does macOS have a built-in kiosk mode?

No. Unlike iPadOS, macOS has no Guided Access or Single App Mode you can switch on. You lock a Mac to one website with a dedicated kiosk app, or by cobbling together MDM restrictions.

How do I lock a Mac to a single website?

Point a kiosk app at the URL and seal it fullscreen. Canned Web does it in one step: enter the URL, hold ⌘⇧S, and the Mac is locked to that site until you enter your exit password — no MDM or configuration profiles required.

Do I need an MDM to run a Mac kiosk?

No. MDM is useful for remote fleet management and zero-touch enrollment, but it is not needed to lock a single Mac to one website. Canned Web runs standalone with no MDM, no cloud, and no subscription.

Can visitors exit the kiosk or leave the site?

No. Canned Web takes over the whole screen, blocks Spotlight, Cmd-Tab, Cmd-Q and screenshots, and can lock navigation to your domain so off-site links do not work. The only way out is your exit password.

Does a Mac kiosk work offline?

A live website needs an internet connection, like any browser. But you can point Canned Web at a website folder stored on the Mac, and then it runs completely offline.

Which macOS versions are supported?

macOS 14.0 (Sonoma) or later, on Apple Silicon or Intel.

How much does a Mac kiosk app cost?

Canned Web is a one-time €49 per machine, with future updates included and a 14-day free trial. No subscription.

Can I disable the Mac’s power button for a kiosk?

No app can disable the power / Touch ID button — macOS does not expose it. Use a Mac mini (its button is on the back), mount it out of reach, and set “no password on wake” so a stray press just wakes back to your site.