WhySlow
What is XprotectService on Mac?
Apple's built-in malware scanner.
Why is XprotectService using so much CPU?
Busy while scanning new downloads, or after its malware definitions update.
Should you quit XprotectService?
No. XprotectService is part of macOS. Quitting it can break things, and macOS starts it again anyway. When it is busy, it usually calms down once its work is done.
Is XprotectService a virus?
No. XprotectService is a genuine part of macOS, signed by Apple and stored in a protected system folder that apps can't change. Malware sometimes borrows familiar names, so if a process called XprotectService lives outside /System or /usr, or you see it after installing something unusual, run a check with a trusted tool and keep macOS up to date.
How to check XprotectService on your Mac
Open Activity Monitor (Applications › Utilities), choose the CPU tab and type XprotectService in the search field. The % CPU column shows how busy it is: 100% means one full processor core. The Memory tab shows how much memory it uses. Activity Monitor shows numbers but doesn't say what they mean; WhySlow explains XprotectService in plain English and only flags it when it is really slowing your Mac down.
What to do if XprotectService stays busy
- Wait 10 to 15 minutes. Most macOS background work finishes on its own.
- If XprotectService stays busy for more than a day, restart your Mac. That clears a stuck process safely.
- Keep macOS up to date: Apple fixes runaway background processes in updates.
How WhySlow helps with XprotectService
- Shows how much CPU and memory XprotectService is using right now, in plain English.
- Tells you when XprotectService is the real cause of a slow Mac, and when it isn't.
Free to explain. $7 once for one-click fixes.