Guideline 4.4.2 - Design: Safari Extension Requesting Overly Broad Website Access

Apple is rejecting your Safari extension because it requests access to more websites than necessary for its stated functionality. Safari extensions must follow the principle of least privilege — requesting access only to the specific domains where the extension provides value, not blanket access to all websites. This rejection commonly hits ad blockers, productivity extensions, and content modification tools that request 'All Websites' access when they could function with access to a narrower set of domains. Apple's concern is both privacy (extensions can read page content) and security (broad access increases attack surface). The reviewers check your extension's SFSafariWebsiteAccess configuration in the Info.plist. If your Level is set to All but your extension's functionality only applies to specific sites (e.g., a coupon finder that only works on shopping sites), Apple will reject it. The fastest compliant path is to restrict your Allowed Domains to only the domains where your extension actually provides functionality. If your extension genuinely needs broad access (like a password manager or accessibility tool), you need to justify it clearly in your Review Notes and privacy disclosures.