The error message ‘Safari no longer supports the unsafe extension’ in macOS Catalina or Mojave with the latest version of Safari might appear. This can happen either on attempting to install an extension or immediately after updating macOS when an unsafe extension was previously installed in Safari.

There doesn't appear to be any way round the problem, with existing extensions removed and unable to be added again even if you download the package for the extension as worked in previous versions.

With Mojave now being released, some extension developers have released extensions through an Apple-approved process. Here's links to some popular extensions which would have brought this message up, but now work fine if installed through the gallery!

If the extension you're looking to install isn't available on the Safari Extensions Gallery or App Store, not all hope is lost. It requires manually installing the extension, so you won't get automatic updates for it in the future, but it's still perfectly usable and is the only way to get certain functionality until developers update their extensions for you (which some might not even do). This article presumes you've checked whether your extension exists in an Apple-approved form elsewhere, for example if you've installed uBlock Origin from uBlock0.safariextz you'll get the message that the extension was removed, but it is available to download from the Safari Extensions Gallery (here's a link to get uBlock Origin without going through this process). However, not all extensions are available there and it is soon to be discontinued anyway with App Extensions the only way forward. So begins how to install any extension blocked by Safari:

Download and unzip the extension

The first step is to download the .safariextz file. This will be from the developer's website, how you usually installed the extension previously. In this tutorial, I will use Tampermonkey as the example as it is my preferred userscripts extension for Safari and is not available on the App Store or the Gallery. Rename the file's extension from .safariextz to .zip, then extract the zip by double-clicking on the file. This gives you a .safariextension which is a folder containing the JavaScript and other files which make up the extension. You're ready to add the extension to Safari!

Getting a .zip.cpgz instead?

If you're not able to extract the extension, it may be because the underlying archive is an xar instead. You can confirm this with Terminal:

$ file betterttv.zip
betterttv.zip: xar archive version 1, SHA-1 checksum

To extract the file, rename the file extension to .xar and use The Unarchiver, or with Terminal:

xar -xf betterttv.xarCode language: CSS (css)

Add safariextension to Extension Builder

The Develop menu needs to be enabled to use the Extension Builder, which can be enabled from Safari → Preferences → Advanced → Show Develop menu in menu bar.

Once the Develop menu is enabled, open it and select Show Extension Builder. You'll be presented with a window, and if you've never built an extension before it will be blank. Click the + button and choose Add Extension…. Select the .safariextension folder that you extracted and choose the Select button.

Run the extension in Safari

The extension folder you added will be shown in the builder, and some extension information should be shown too such as a logo and author details. Click the Run button in the top-right to run the extension. You will be prompted to authenticate the action, which you can do by entering your account password or with Touch ID. The extension will be installed and be available from the usual places, such as a menu bar button and Safari Preferences. Enjoy your unblocked extension!

Import previous settings into new extension

Settings for an extension you previously had installed won't be seen by this extension you've run manually. If you don't mind setting up the extension from scratch, or it had no options, there's no need to worry about this step. Otherwise you can import these settings by copying them from the old extension to the new extension which has a different team ID. Open ~/Library/Preferences/com.apple.Safari.Extensions.plist with something like Xcode. Find the extension you just added, which should be at the bottom, and delete its dictionary using the minus sign. Go to the dictionary with the same extension name, click on the name and replace the team ID with 0000000000, 10 zeros. Save the file and reload the extension in Safari to see your settings imported.

To expand some more on precisely what this does: when you install an extension built by someone else usually, that extension will be signed with a Safari Extensions certificate. The package that is created has this certificate inside it, and this contains a Team ID which is the ID of the developer or organisation which built and signed the extension. Your previous installation of the extension will have a Team ID because of this signing process, however the extension you have packed yourself and run manually will not since you did not use a certificate. Therefore, the Team ID for your unsigned certificate is ten zeros, so you'll need to rename the old extension's Team ID to be zeros for it to associate it with your new extension.

Next steps

Next time you relaunch Safari, the extension will still be in Extension Builder but won't be ‘Run’. You can automatically run the extension with the following AppleScript. Add this script to ~/Library/Application Scripts/com.apple.Safari (you may need to create the folders along this path, note the ~ reference to your home folder rather than the root Library folder).

tell application "System Events"
	tell process "Safari"
		set frontmost to true
    	click menu item "Show Extension Builder" of menu "Develop" of menu bar 1
    	delay 0.5
    	click button "Run" of splitter group 1 of window "Extension Builder"
    	click button 1 of window "Extension Builder"
	end tell
end tellCode language: AppleScript (applescript)

Enable the Application Scripts menu in Script Editor → Preferences → General under ‘Show Script menu in menu bar’, then when launching Safari you can open the Script menu and choose the script you added under Safari Scripts. The script will pause when you're prompted for authentication, at which point you can Touch ID or enter your password.

You can also prevent Safari from inexplicably throwing away your extension settings by locking the preferences file. Get Info (⌘I) on the com.apple.Safari.Extensions.plist preferences file, then check the box labelled Locked. This prevents changes to the file and will ensure Safari doesn't throw away the preferences for the extension on quit.