How to clean Safari after a browser hijacker changes search settings

A browser hijacker can alter Safari’s search engine, homepage, new-tab behaviour and default results without asking clearly. It may redirect searches through unfamiliar websites, display aggressive advertisements or prevent you from restoring your preferred settings.

This type of unwanted software often arrives with a free download, a fake update notice, a browser extension or a bundled installer. Mac users in Sydney, Melbourne and other Australian cities can encounter these pages through malvertising, compromised websites or unofficial software advertised as a bargain in the local online market.

The steps below focus on removing the unwanted changes safely. For broader security guidance, cybersecurity guides cover related threats such as adware, spyware and potentially unwanted applications on different operating systems.

Spot the hijacker’s behaviour

Common signs include Safari opening an unfamiliar search page, results being redirected through several domains, a homepage you did not choose, or advertisements appearing on normally clean websites. Search suggestions may also change, and Safari can become slower when several tabs are open.

Check whether the problem affects every Safari window or only one account. If another browser works normally, the issue may be limited to Safari’s extensions or preferences. If all browsers redirect searches, investigate macOS applications, network settings and DNS configuration as well.

Disconnect and record suspicious changes

Close unnecessary tabs and avoid entering passwords, banking details or myGov credentials while redirects are active. Disconnecting from the internet temporarily can stop a hijacker from loading additional content while you inspect the Mac. Wi-Fi can be disabled from the menu bar, while an Ethernet connection can be unplugged.

Before removing anything, take screenshots of the unfamiliar search address, extension names and homepage settings. This record can help identify the unwanted program later. Do not click pop-ups claiming that your Mac is infected or offering a phone number for “technical support”; these are common scam tactics in Australia and should be reported through Scamwatch when appropriate.

Remove unwanted Safari extensions

Open Safari and choose Safari > Settings, then select Extensions. Review every installed extension, including those with vague names such as “Search Helper”, “Web Protect” or “Shopping Assistant”. Disable an extension first, test Safari, and then select it and choose Uninstall if it is clearly unwanted.

If Safari refuses to remove an extension, or the extension returns after restarting, check System Settings > General > Login Items. Remove unfamiliar background items and disable suspicious applications under “Allow in the Background”. Avoid deleting Apple services or software you recognise from a legitimate developer.

Restore search and homepage settings

In Safari Settings, open Search and select a trusted search provider such as Google, Bing, DuckDuckGo or Ecosia. Then open General and inspect the homepage, new windows and new tabs. Replace an unfamiliar address with a page you trust, or set Safari to open a blank page.

Next, select Privacy > Manage Website Data and remove data associated with the hijacker’s domains. Clearing all website data signs you out of many services, so removing only suspicious entries is less disruptive. Safari may need to be closed and reopened before the corrected search settings take effect.

Inspect macOS for unwanted software

Open the Applications folder and sort items by date added. Uninstall programs you do not recognise, especially those installed shortly before the redirections began. Use the developer’s official uninstaller where available, then empty the Bin. Do not rely on dragging an unknown app to the Bin if it has installed extra components.

Check System Settings > General > Device Management for an unfamiliar configuration profile. A rogue profile can lock Safari’s search engine or homepage and may be labelled as an organisation, security tool or browser policy. Remove only profiles you did not install, and contact your workplace or school administrator before deleting a managed profile.

Clear persistence and scan the Mac

If the hijacker returns, inspect Login Items again and review suspicious files in the user’s ~/Library/LaunchAgents folder. Advanced users can also examine /Library/LaunchAgents and /Library/LaunchDaemons, but deleting system files without identifying their publisher can damage macOS. Search the file name online using a separate, trusted device if necessary.

Run a reputable, updated anti-malware scanner for Mac and quarantine anything it identifies as adware, a browser modifier or a potentially unwanted application. Security software downloaded from random advertisements can create a second infection, so use the vendor’s official website or the Mac App Store. Broader Mac security tips can help with scans, Safe Mode and suspicious startup items.

Check network settings and verify Safari

Open System Settings > Network, choose your active connection and inspect Details > DNS and Proxies. Remove DNS servers or proxy entries that you did not add, unless they belong to a trusted workplace, university or VPN provider. On an Australian home network, also review the NBN modem or router administration page if every device is being redirected.

Restart the Mac and test several searches in a private Safari window. Confirm that the homepage, search engine and new-tab page remain unchanged. If the problem persists, start the Mac in Safe Mode, run another scan and repeat the extension and profile checks. A persistent issue may require a new macOS user account or specialist technical assistance.

Keep the search settings protected

Install macOS and Safari updates promptly, and download applications only from official developer websites or the Mac App Store. Avoid cracked software, fake video codecs and “urgent” browser updates. This is especially important when comparing cheap software offers on Australian marketplaces, where a genuine-looking listing can still direct users to an unofficial installer.

Use a standard user account for everyday browsing, enable a password manager and keep regular backups that are disconnected when not in use. If the Mac is used for work, check whether security software or a company profile is required before removing management settings. Windows users handling the same incident on another computer can follow dedicated Windows malware guidance.

Cleanup step	Best use	Main caution
Remove Safari extensions	Stops browser-level redirects and injected adverts	Keep extensions from trusted developers
Restore search and homepage	Reverses visible Safari changes	Suspicious settings may return if malware remains
Delete unknown applications	Removes the likely bundled program	Use an official uninstaller when available
Inspect profiles and DNS	Finds enforced browser or network changes	Do not remove workplace or school settings
Run an anti-malware scan	Detects hidden adware and persistence files	Download the scanner from a legitimate source

After cleanup, Safari should open the expected homepage, use the selected search provider and load results without unexplained redirects. Monitoring the Mac for several days helps confirm that the unwanted software and its persistence mechanisms have been removed.