Hello, Safari on iOS is showing a “Fraudulent Website Warning” for our domain: https://doobler.ru/ We are trying to understand how to properly diagnose this and request a re-evaluation. The website has a valid HTTPS certificate and does not currently appear to be flagged by the reputation tools we checked, including Google Safe Browsing / Search Console / VirusTotal. However, some iPhone users still see the Safari warning, while others do not. What we have checked so far: HTTPS certificate is valid No mixed-content or obvious redirect issues found Google Safe Browsing does not show the domain as unsafe Google Search Console does not show security issues VirusTotal does not show active malware/phishing detections The warning appears only for some users/devices We submitted a review request through Apple’s Website Review form, but have not received any response yet We would like to know: Is there any way to confirm whether the warning comes from Apple’s own reputation system, Google Safe Browsing, or another provider used by Safari? How long does Apple Website Review usually take for Safari fraudulent website warnings? Is there a recommended process for requesting re-evaluation if the warning appears to be a false positive? Are there specific technical signals Safari checks that we should verify, such as redirects, third-party scripts, domain reputation, or brand/phishing heuristics? This is affecting real users, so any guidance on the correct escalation or diagnostic path would be appreciated. Thank you.

1. System/device combinations where the issue does not occur: Physical device: iOS 26.0 (23A5318c) + iPhone 16 Pro Max 2. System/device combinations where the issue does occur: System versions: Physical device: iOS 26.0 (23A5330a), iOS 26.0 (23A340) Simulator: iOS 26.0 (23A339) Device models: Physical device: iPhone 12 Reproducible in Safari, WKWebView, and UIWebView: Yes Actual behavior In WebView (and identically in Safari): Before the keyboard is shown, header/footer elements with position: fixed are correctly aligned with the screen viewport. Scrolling up/down works as expected. After the keyboard appears, the visualViewport position changes. Bug: When the keyboard is dismissed, visualViewport.offsetTop does not reset to 0. As a result, fixed header/footer elements remain misaligned: When scrolling down, the position looks correct. When scrolling up, the header/footer are visibly offset. Steps to reproduce Focus an input field → the keyboard appears Dismiss the keyboard Observe that visualViewport.offsetTop remains >0 (does not reset to zero) position: fixed header/footer elements are misplaced relative to the screen Expected behavior After the keyboard is dismissed, visualViewport.height should return to match the layout viewport, and visualViewport.offsetTop should reset to 0. When scrolling upward, fixed elements should remain correctly positioned within the layout viewport. Minimal reproducible demo A simple HTML file containing: A header and footer with position: fixed An input element to trigger the keyboard <!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" /> <title>H5 吸顶吸底页面 Demo</title> <style> * { margin: 0; padding: 0; box-sizing: border-box; } body { font-family: Arial, sans-serif; height: 2000px; /* 设置内容高度 */ background-color: #f0f8ff; /* body 背景浅蓝色 */ padding-top: 120px; /* 预留 header 高度 */ padding-bottom: 60px; /* 预留 footer 高度 */ overflow-x: hidden; } /* 吸顶 Header */ header { position: fixed; top: 0; left: 0; width: 100%; height: 120px; background-color: #ff6b6b; /* 红色 */ display: flex; align-items: center; justify-content: center; color: white; font-size: 24px; font-weight: bold; z-index: 1000; } /* 吸底 Footer */ footer { position: fixed; bottom: 0; left: 0; width: 100%; height: 60px; background-color: #4ecdc4; /* 青绿色 */ display: flex; align-items: center; justify-content: center; color: white; font-size: 18px; font-weight: bold; z-index: 1000; } /* 输入框样式 */ .input-container { margin: 100px auto; width: 80%; max-width: 600px; text-align: center; } input[type='text'] { padding: 12px; font-size: 16px; border: 2px solid #ddd; border-radius: 8px; width: 100%; box-sizing: border-box; } input[type='text']:focus { outline: none; border-color: #4ecdc4; } </style> </head> <body> <!-- 吸顶 Header --> <header>吸顶 Header (120px)</header> <!-- 主体内容 --> <div class="input-container"> <input type="text" placeholder="请输入内容..." /> </div> <!-- 吸底 Footer --> <footer>吸底 Footer (60px)</footer> </body> </html>

I have a WebView App for my WordPress site. For multilanguage support I am using gTranslate. This works fine on any browser (also Safari) and also in my App on Android - but it does NOT work on iPhones. gTranslate is using GoogleTranslate. On iPhones it is kicked on correctly, but just does not translate the page. Do you have any clue why this is the case? What is hindering gTranslate (Google-Translate) to run on iPhones? My WebViews is starting with this - do I need something special for iOs?: <WebView style={{ flex: 1 }} ref={webViewRef} source={{ uri: initialUrl }} applicationNameForUserAgent={APP_AGENT} javaScriptEnabled={true} domStorageEnabled={true} sharedCookiesEnabled={true} cacheEnabled={false} thirdPartyCookiesEnabled={true} originWhitelist={['*']} setSupportMultipleWindows={false} startInLoadingState={true} .... If you don't know a solution: Is there another service I can or should use for iPhones? What I want to achieve is: The app should start (automatically) in the language of the user (from device-locales) - on iPhone in the same way like on Android. BTW: I don't habe an iPhone and therefore can't test myself. I receive the messages from my users.

Context: This is for a privacy relay in a browser, where the proxy is toggled on/off and rotated mid-session, so we can't lose the user's logged-in sessions when it engages. Connection pool behavior — is this expected? When we mutate proxyConfigurations on a live data store, the proxy only applies to newly-visited origins. Origins that already have established connections keep going direct — reloading the page, and even tearing down and recreating the WKWebView, doesn't move them onto the proxy. The only thing that reliably forces all traffic through the proxy is swapping in a brand-new WKWebsiteDataStore. Is that the intended behavior — i.e. is recreating the store the expected way to re-establish the connection pool — or is there a supported way to invalidate the existing connections so a mutated proxy config takes effect on already-loaded origins? What does fetchData / restoreData actually carry? To preserve the session across that store swap, we serialize the old store with fetchData(of: WKWebsiteDataStore.allWebsiteDataTypes()) and rehydrate the new one with restoreData(_:) (iOS 26). Passing the full allWebsiteDataTypes() set: Does this round-trip everything those types represent — cookies, localStorage, IndexedDB, service worker registrations, etc. — into a store created with init(forIdentifier:)? Does anything not enumerated by allWebsiteDataTypes() — per-site permissions, tracking-prevention/ITP state — get dropped silently?

Hi! It seems like in Safari, elements inserted into a page by web extensions (such as and elements) are currently subject to the page's Content Security Policy. If the CSP is strict enough, this prevents these elements from loading. Based on my testing, I've found that this behavior is different in other browsers, where a page's CSP is not applied to elements inserted by an extension. Is this expected behavior in Safari, or might it be considered a bug? Any advice on working around these restrictions, as it currently prevents my extension from working correctly on websites with a strict CSP?

Is there an MDM solution that will give a Safari extension all the permissions it needs with no interaction from the end user?

Hello, We have a Network extension transparent proxy (NETransparentProxyProvider) that receives browser TCP flows as NEAppProxyTCPFlow. For each flow we create an NWConnection to the flow's original destination and set NEParameters.preferNoProxies = true - expecting the outbound connection to bypass the user's HTTP/HTTPS proxy and PAC so it goes to the destination server directly. However, in practice we see connections still being redirected to local proxy after being evaluated against the PAC rules using the destination IP and port. Our questions are: Could we expect preferNoProxies to be respected when a PAC exist on the endpoint and supersede the PAC rule decision? If yes, what would be the best way to file a bug and what information do you need? If not, is there any other way of making sure that the outbound NWConnection created by the transparent proxy is not redirected to a proxy and goes directly to the destination? One other way of avoiding our NWConnection being redirected to the proxy is to use hostname instead of destination IP. Would there be a reliable way of getting hostname for the NEAppProxyTCPFlow so that PAC can correctly filter all NWConnection based on rules? We have explored remoteHostname but it's generally not available for connections from browsers other than Safari.

After enabling WebXR following instructions from https://developer.apple.com/forums/thread/732629, I can successfully run WebXR, but it is limited to VR. I cannot get AR running. If I try await navigator.xr.isSessionSupported("immersive-ar"), the result is false. But if I try await navigator.xr.isSessionSupported("immersive-vr"), the result is true. I double checked that I specifically checked the box "WebXR Augmented Reality Module" in the Safari feature flags. Any idea how to enable WebXR AR mode? Thanks in advance!

Has Apple worked out how WebXR authored projects in Safari operate with VisionOS? Quest has support already. And I imagine many cross platform experiences (especially for professional markets where the apps are on windows through web) would be serve well with this. Is there documentation for this?

Hi, I see that on WebViews we don't get the same interface for allowing the user to use a saved password or passkey as in Safari or on an Authentication View. Can the same be accomplished on a WebView?

The new WKJSScriptingBuffer API allows Swift to define data buffers and make them available to JS code running in a WKWebView. Is there any API for passing an ArrayBuffer of data from a WKWebView to Swift code? Currently the usual workaround is to convert the buffer to a base64 string, but that is slow and can lead to exhausting memory depending on the size of the buffer. On the web, window.postMessage() has an argument that allows transferring ownership of ArrayBuffers to the receiver, but the webkit.messageHandlers.<name>.postMessage() API doesn't seem to support that.

I build a framework that has a function that returns a UIView with a web view inside. The app that uses the framework has control over the webview through the subviews API of my UIView. I do not want the framework consumer to utilise the web view's methods and properties. How do I limit access to web view methods like evaluateJavascript, navigation delegate etc?

I'm working on a document reader for long form articles and I love what WebKit gives me for quickly delivering good looking content. But I'm hearing that accessibility support is stronger if I go with UIKit or SwiftUI. Accessibility support is meant to be a headline feature in my app so it's the deciding factor on which technology I should use (webview versus UIKit/SwiftUI). Given Accessibility Reader now provides system-wide reflow and spoken reading, is there now a durable reason a document reader developer should still invest in native UIKit/SwiftUI rendering rather than well-structured HTML in a webview? Where specifically does the system stop helping webview content? What I've heard is that webviews are disadvantaged on custom rotors, focus, and Dynamic Type fidelity. Is this accurate or has it changed this year? Bottom line, I'm wondering if WebKit is a compromise for a11y if I want not baseline accessibility, but truly leading unsurpassed accessibility.

Context: This is for a privacy relay in a browser, where the proxy is toggled on/off and rotated mid-session, so we can't lose the user's logged-in sessions when it engages. Connection pool behavior — is this expected? When we mutate proxyConfigurations on a live data store, the proxy only applies to newly-visited origins. Origins that already have established connections keep going direct — reloading the page, and even tearing down and recreating the WKWebView, doesn't move them onto the proxy. The only thing that reliably forces all traffic through the proxy is swapping in a brand-new WKWebsiteDataStore. Is that the intended behavior — i.e. is recreating the store the expected way to re-establish the connection pool — or is there a supported way to invalidate the existing connections so a mutated proxy config takes effect on already-loaded origins? What does fetchData/restoreData actually carry? To preserve the session across that store swap, we serialize the old store with fetchData(of: WKWebsiteDataStore.allWebsiteDataTypes()) and rehydrate the new one with restoreData(_:) (iOS 26). Passing the full allWebsiteDataTypes() set, does this round-trip everything those types represent — cookies, localStorage, IndexedDB, service worker registrations, etc. — into a store created with init(forIdentifier:)? And does anything not enumerated by allWebsiteDataTypes() — per-site permissions, tracking-prevention/ITP state — get dropped silently?

Our app uses WKWebView to load web pages, and we're encountering a crash with WKScreenTimeConfigurationObserver on iOS 26.1 and above. However, there are no WKScreenTimeConfigurationObserver-related code calls in our project. The crash log is as follows: NSInternalInconsistencyException Cannot update for observer <WKScreenTimeConfigurationObserver 0x13be821e0> for the key path "configuration.enforcesChildRestrictions" from <STScreenTimeConfigurationObserver 0x13be808e0>, most likely because the value for the key "configuration" has changed without an appropriate KVO notification being sent. Check the KVO compliance of the STScreenTimeConfigurationObserver class. We want to confirm if this is a system bug. How can we fix it?

Safari on iOS 17, when entering characters into text input box after deleting characters, the layout is off. Here's the HTML: <body> <div id="J001" style="display: inline-block;"> <div id="J001__0" style="display: inline-block;"> <input id="J001__0__input" style="display: inline-block; height: 28px; padding:2px; border:1px solid gray;"></div> <div id="J003__0" style="display: inline-block;"> <button id="J003__0__btn" style="display: inline-block; height:34px;">a</button> </div> </div> </body> Enter "A" into text input box. Delete "A" with the backspace(x). Enter "A" into text input box, the button position will be shifted down. iOS 17 の Safari にて、テキスト入力ボックスで文字を削除した後、文字を入力するとレイアウトが崩れます。 テキスト入力ボックスに「A」と入力します。 バックスペース(x)で「A」を削除します。 テキスト入力ボックスに「A」と入力すると、ボタンの位置が下にずれます。

Hello everyone, I am testing how Siri interacts with web pages on iOS devices. When a user utilizes Siri voice commands to search for or open a specific website, Siri usually processes the request and opens the result inside the Safari browser. As a web developer, I want to know if there are any specific HTML meta tags, Schema markup, or SEO best practices that we should implement. This is to ensure Siri can accurately recognize the website's name, brand, and content. What are the simplest ways to make a static web page friendly for Siri voice search? Thanks in advance!

Is there any documentation or advice on printing from a Safari webapp (in JavaScript)? My app needs to print labels, and printing from Safari presents few options. For example, you can't turn off backgrounds or the URL/date/time footer. And it wants to print a full-size page, which ends up printing miles of label. (I've also tried printing from SwiftUI on a macOS app, and even that is just terrible to try to get right. Why is printing so hard?)

Hi Team, We are observing a noticeable performance difference in client-side PDF generation between Safari and Chrome. Use Case We have an AI modal with a “Download PDF” feature. The PDF is generated on the client side using HTML content from the modal. Observation Chrome: PDF generation completes in ~1–2 seconds Safari: Same flow takes ~25–30 seconds Additional Details The functionality works correctly in both browsers, and the PDF downloads successfully. The issue is mainly the increased processing time in Safari. The modal content may include: Large formatted text Markdown/code blocks Images/styled UI We suspect the delay may be related to Safari’s handling of: Canvas rendering DOM-to-image conversion Blob/PDF generation Font/image processing Libraries/approaches involved: html2canvas jsPDF window.print() (in some cases) Question Is this considered expected behavior in Safari/WebKit for client-side PDF generation? Has anyone found effective Safari-specific optimizations or best practices to improve performance for this use case? Thanks in advance.

We are seeing intermittent WKWebView main-frame navigation failures on iOS 26.4.x. The failure is reported through: webView:didFailProvisionalNavigation:withError: The error code is: NSURLErrorNetworkConnectionLost (-1005) The affected pages are normal HTTPS H5 pages loaded by WKWebView,。 From our client logs, the issue appears during provisional navigation, before the page finishes loading. In many cases, error.userInfo does not contain a useful description, and the log only shows: did fail provisional navigation, error code: -1005, description: nil We have also observed a high concentration of this error on iOS 26.4.x devices. The failures are intermittent and may recover after a retry, which makes us suspect that the underlying network connection may be lost during request processing or connection reuse. What we would like to know: Is there any known issue in iOS 26.4.x / WebKit / CFNetwork that could cause WKWebView provisional navigation to fail with NSURLErrorNetworkConnectionLost (-1005)? Does WKWebView expose any public API or diagnostic mechanism to determine whether the failed request reused an existing TCP/HTTP2 connection? Is there a recommended way to collect lower-level networking diagnostics for WKWebView, such as connection reuse, HTTP/2 stream state, socket close timing, or CFNetwork diagnostics? For main-frame GET navigations that fail with -1005, is a one-time silent retry considered an acceptable mitigation? We can provide timestamps, affected URLs, device OS versions, and client logs if needed.