Setup Guide

Pick the machine

• Machine. A Mac mini (Apple Silicon) is the setup we recommend. Its power button sits at the back, never on the front where a MacBook or iMac puts it, so the one control no kiosk app can disable stays out of reach. It hides behind the display, runs silent, and sips power all day. Any M-series mini on macOS 14.0 (Sonoma) or later works.
• Display. Use whatever screen fits the space. For a look, scroll or click kiosk, any display plus a Magic Trackpad or mouse is perfect. If visitors will tap the screen, you need a third-party touch display that macOS reads as a pointer, because Apple makes no touchscreen and a Studio Display cannot do touch.
• Input. A trackpad or mouse for pointer kiosks (switch on scroll-only mode for a look, don’t touch display), or the touch panel itself. You only need a keyboard to set up and to exit (⌘⇧S plus your password), so keep it stowed with the operator, not left out for visitors.
• Mounting. Fix the mini out of reach, behind the display or in a locked enclosure, and route cables away. Secure or tether the peripherals, since a Magic Trackpad is easy to pocket.
• Power and network. Keep it on mains and turn on “Start up automatically after a power failure” (see the next step) so it recovers after an outage. Use wired Ethernet where you can for an unattended screen, or run fully offline from a local content folder.

A few one-time settings

No Energy settings needed. Canned Web keeps the display awake while sealed and auto-starts at login on its own, so you only need the ones below. The buttons jump straight to the right pane when you open this page on the kiosk Mac.

Log in automatically

So a power cut or restart boots straight back into the kiosk, no login screen a visitor can’t get past.

System Settings → Users & Groups → “Automatically log in as”

Open Users & Groups

Don’t require a password on wake

If the display sleeps or someone taps the power button, the Mac wakes straight to your site instead of a locked login screen.

System Settings → Lock Screen → “Require password after…” → Never

Open Lock Screen

Turn on a Focus

Do Not Disturb stops notification banners from popping up over the sealed site.

System Settings → Focus → Do Not Disturb → turn on (or schedule it always-on)

Open Focus

Defer automatic updates

Keeps macOS from restarting the machine for an update in the middle of an exhibition.

System Settings → General → Software Update → turn off “Install macOS updates”

Open Software Update

Turn off Dictation

Canned Web blocks screenshots and Spotlight itself, but Dictation is driven by a separate system feature it can’t disable, so a visitor could start it with the 🎤 key or a modifier double-tap. Switch it off here.

System Settings → Keyboard → Dictation → off

Open Keyboard

Install Canned Web

• Download the app, open the file, and drag Canned Web to your Applications folder.
• On first launch, grant Accessibility permission when prompted. It’s what lets the app block Spotlight, Cmd-Tab and other escapes. The setup walks you through it and confirms once it’s on.

Seal your site

• Enter the URL you want to display and pick your options (lock to domain, scroll-only, on-screen controls, display).
• Hold ⌘⇧S to seal, the site takes over the whole screen and the Mac is locked to it.
• To exit, hold ⌘⇧S again and enter your exit password. It’s the only way out, so a visitor can’t stumble on it.

For high-traffic or exposed spots

Canned Web locks the software session. For a machine out in the open that might attract determined tampering, layer these macOS and physical measures on top. Together they cover the paths an app can’t reach, like the power button and recovery mode.

• Turn on FileVault (System Settings → Privacy & Security → FileVault). It encrypts the disk at rest, so no one can pull data or tamper with the install by booting into recovery without your password.
• Run the kiosk under a standard, non-admin account, and keep the admin password off the machine. On Apple Silicon, entering recovery mode needs an admin/volume-owner password, so a non-admin kiosk user hits that wall.
• Physically secure the Mac. A Mac mini keeps the power button around the back, mount it out of reach and route cables away. Once someone has hands on the hardware, physical security is the real perimeter, which is true of any kiosk on any OS.
• Don’t worry about power-cycling: with automatic login and auto-start, a force-restart just reloads the sealed site. Casual button-mashing only restarts the kiosk.

If something’s off

The kiosk won’t seal

Grant Accessibility permission. Canned Web needs it to block system shortcuts. The app checks this on first launch and shows you the exact setting.

The screen keeps going to sleep

Canned Web holds the display awake while sealed, so this is usually the monitor’s own sleep timer or power button. Check the external display’s settings.

A visitor left the site / got stuck

Turn on “Lock to domain” and idle-refresh in the operator screen: off-site links won’t navigate, and the kiosk returns to your home page after a period of inactivity.

Moving to a different Mac

Open the operator screen, choose “Release this license”, then activate the key on the new machine. Each license covers one machine at a time.

A checkout or login redirect gets blocked

If your sealed site sends visitors to a payment provider or login page on another domain, add those domains under “Also allow these domains” in the operator screen. Each entry allows that domain and its subdomains. Turn on the Home button or idle-reset so the kiosk can return; a real checkout redirects back to your site on its own. Test the full flow before your event, since some 3-D Secure card checks bounce to the bank’s own domain that a whitelist can’t cover.