# XProtect Canonical page: https://vitalsmac.com/glossary/xprotect Activity Monitor glossary, Processes you will see. What is XProtect on Mac? Also: built-in malware protection **Short answer:** XProtect is the malware protection built into macOS. It checks apps against Apple's malware signatures when they first open, when they change and when the signatures update, scans the Mac in the background, and removes the malware it finds. Apple updates its rules separately from macOS updates. XProtect is not malware and not a third-party app. It is Apple's own antivirus, installed with macOS in /Library/Apple/System/Library/CoreServices/XProtect.app, and it has no window or settings of its own. You notice it in two ways: a Finder alert that an app was blocked as malware and moved to the Trash, and processes with XProtect in their names in Activity Monitor. It works in two layers. The first checks apps against Apple's signatures at the moments above. The second, XProtect Remediator, scans the Mac on a schedule for malware that is already installed and removes it. macOS checks for new XProtect rules daily and installs them in the background, with no macOS update and no restart. ## Why XProtect is using CPU Background scans are the usual reason. XProtect Remediator runs a quick scan every few hours and longer daily and weekly ones, which wait until the Mac is on power. While a scan runs you may see XProtect, XProtectPluginService and processes named XProtectRemediator followed by a malware name, such as XProtectRemediatorAdload or XProtectRemediatorPirrit, near the top of the CPU and Disk lists. Each looks for one family of malware and finishes on its own. New rules cause a second, shorter round. When a signature update installs, XProtect checks apps again against the new rules, so its CPU can rise for a while after an update. The same happens on a smaller scale when you install or update several apps at once, because each changed app is checked again. ## What to do about it Let the scan finish. Do not quit XProtect processes or look for ways to disable them: macOS starts them again, and they are what removes malware from your Mac. If scans keep landing at a bad time, leave the Mac awake and plugged in for a while when you are not using it, so the longer ones can complete. Keep its updates on. Open System Settings → General → Software Update, click the Info button next to Automatic Updates, and make sure Install system data files and security updates is turned on. On macOS Sequoia and earlier the setting is called Install Security Responses and system files. That is how new XProtect rules reach your Mac. ## How to check XProtect is running and up to date Activity Monitor shows XProtect at work, and Terminal or System Information tells you which version of its rules you have. 1. Open Activity Monitor, click the CPU tab, choose View → All Processes, and type `xprotect` in the search field. Usually you will see xprotectd, XprotectService and XProtectBridgeService. During a scan, XProtect, XProtectPluginService and XProtectRemediator processes join them. 2. To see where each one runs from, open Terminal and run `ps -axo user,comm | grep -i xprotect`. Apple's processes run from /usr/libexec, from /Library/Apple/System/Library/CoreServices/XProtect.app, or from /System/Library/PrivateFrameworks/XprotectFramework.framework. 3. On macOS Sequoia and later, run `xprotect version`. It prints the installed version of XProtect's rules and the date they were installed. 4. Run `sudo xprotect check` and enter your password to see the newest version Apple has published. If it is higher than yours, `sudo xprotect update` installs it now. 5. On any recent macOS, hold Option, choose Apple menu → System Information, and click Installations under Software. Updates named XProtectPlistConfigData, XProtectPayloads or XProtectCloudKitUpdate are XProtect's. In Terminal, `system_profiler SPInstallHistoryDataType | grep -A4 XProtect` prints the same list. ## Normal XProtect use vs a problem Normal: XProtect's processes come and go through the day and use little most of the time. If the same one stays near the top of the CPU list for hours every day, restart the Mac, which ends a stuck scan, and make sure its updates are on, so any fix Apple ships reaches you. XProtect is busier than usual at these times, and each one ends on its own: - A scheduled scan: a quick one every few hours, and longer daily and weekly ones when the Mac is plugged in. - The hours after new rules install, when it checks apps again against them. - The first launch of apps you have downloaded or updated, which are checked before they open. - Installing or updating many apps at once, since each changed app is checked again. ## If XProtect finds malware When XProtect finds known malware as an app opens, it blocks it, moves it to the Trash and shows an alert in Finder. Empty the Trash, and do not download the app again from the same place. XProtect Remediator removes malware it finds during its scans without asking. XProtect does not restart the Mac by itself, and some removals finish only after a restart. If you have seen an alert, restart when you can. An alert that keeps coming back for an app you did not download yourself means something on the Mac is fetching it again. Look in System Settings → General → Login Items & Extensions for items you do not recognize, and remove the app they belong to. ## Questions people ask ### What is XProtect on Mac? Apple's built-in malware protection. It checks apps against known malware when they open or change, scans the Mac in the background with XProtect Remediator, and removes what it finds. ### Is XProtect malware? No. XProtect is part of macOS and is the thing that removes malware. The real one lives in /Library/Apple/System/Library/CoreServices/XProtect.app and in /System/Library/PrivateFrameworks/XprotectFramework.framework, and it is signed by Apple. ### Can I turn off XProtect? System Settings has no switch for it, and you should not try. Turning off automatic security updates only stops new rules from arriving, which leaves your Mac protected against less malware. ### What is XProtectPluginService and why is it using high CPU? It is part of XProtect, a helper inside XProtect.app that takes part in its scheduled malware scans. High CPU from it means a scan is running. It ends on its own, and the longer scans run only when the Mac is on power. ### What are the XProtectRemediator processes? The scanners of XProtect Remediator. Each one looks for a single family of Mac malware, which is why they have names like XProtectRemediatorAdload or XProtectRemediatorPirrit. They appear during a scan and quit when it is done. ## In Vitals Most XProtect processes run as root, so Vitals measures them when its optional helper is on. Without the helper they are counted among the processes the window says it cannot measure. ## Related - [syspolicyd](https://vitalsmac.com/glossary/syspolicyd) - [trustd](https://vitalsmac.com/glossary/trustd) - [% CPU](https://vitalsmac.com/glossary/cpu-percent) - [Unmeasured processes](https://vitalsmac.com/glossary/unmeasured-processes) Looking for something better than Activity Monitor? See [the best Activity Monitor alternatives for Mac](https://vitalsmac.com/best-activity-monitor-alternatives), or [every term in the glossary](https://vitalsmac.com/glossary).