How to Block Websites on a Router
A router rule is the one change that reaches every device on your Wi-Fi at once: laptops, phones, tablets, smart TVs and game consoles. This guide covers the router's own block list, DNS filtering, schedules and guest networks, and where each one leaks.
Why block websites on the router instead of each device
Device settings protect one device. A router rule protects the network, so new devices and visitors' devices follow the same policy without anyone installing anything.
One place to manage
You change one setting and every device that joins your Wi-Fi or plugs into a cable follows it, including devices with no parental controls at all.
Nothing to install
Smart TVs, consoles, printers and voice assistants cannot run filter apps. A router or DNS rule still applies to them.
Only on your network
A phone that switches to mobile data, or a laptop at a cafe, leaves the router's reach. For travelling devices you need a device setting as well.
For most homes and small offices the best result comes from two layers: a router level DNS filter for everything on the network, plus a light device setting on the phones and laptops that leave the building.
Router blocking methods compared
Routers differ by brand and firmware, but the options fall into five groups. The table shows what each one covers and the usual way around it.
| Method | What it blocks | Works on HTTPS sites | Typical bypass | Effort |
|---|---|---|---|---|
| Router site or domain block list | Exact domains you type in | Partly, by domain name only | Related domains, mirror sites, VPN, encrypted DNS in the browser | Low, but manual forever |
| Router keyword filter | Domains containing a word | No, cannot read page text | Any site without the word in its name | Low, very imprecise |
| Built-in parental controls or profiles | Per device time limits, sometimes a basic filter | Depends on the firmware | Changing the device's network address (MAC randomization), other devices | Medium |
| DNS filtering on the router | Whole categories of sites, including new ones | Yes, works at the domain level | VPN, hard coded or encrypted DNS on a device | Low once set |
| Firewall rules on IP addresses | Specific server addresses | Yes, but addresses change and are shared | Sites on shared cloud addresses move constantly | High, fragile |
Short version: the router's own list is fine for blocking two or three named sites. For anything broader, such as adult content, gambling or all social networks, a category-based DNS filter set on the router is far more effective.
Method 1: use the router's own website block list
Almost every home and small office router has a page for blocking sites. The name varies: look for Parental Controls, Access Control, Security, Firewall, Content Filtering or URL Filtering in the admin pages.
- Open the router's admin page
Type the router's address into a browser on a connected device. It is usually printed on a label under the router, often an address such as 192.168.0.1 or 192.168.1.1. Many routers now use a phone app instead.
- Sign in with the admin password
This is not the Wi-Fi password. If it is still the default from the label, change it now, or anyone on your network can undo your rules.
- Find the blocking page
Look under the names listed above. On mesh systems it is often in the app under each person's profile or under a security or family section.
- Add the domain, not the full link
Enter the bare domain such as example.com rather than a full address with a path. Routers match on the domain name, so paths and page names are ignored.
- Add the related domains too
Most large services load from several domains: a main site, a content delivery domain and an app domain. If you only block the main one, the app may keep working.
- Apply to all devices or chosen ones
Some routers let you apply the list to everyone, others only to devices you pick. Devices that randomize their network address can escape per device rules.
- Save, then clear caches and test
Restart the browser or the device so it forgets old DNS answers, then try the site on a phone on Wi-Fi and on a laptop. See the testing checklist below.
Good for
- Blocking a few named sites quickly
- Networks where you cannot change DNS
- Short term rules, such as during exams or work hours
Weak spots
- Only stops the exact names you typed
- Many routers cap the list at a few dozen entries
- New sites, mirrors and lookalike domains get through
- Usually no reports on what was blocked
Method 2: set a filtering DNS server on the router
Every visit to a website starts with a DNS lookup that turns a name into an address. If the router hands out a filtering DNS server, blocked names get a block page answer instead of the real address, for every device on the network.
- Get the filter's DNS addresses
A category DNS filter gives you two server addresses for your network, or links your public IP address to your policy. Keep both addresses, a primary and a secondary.
- Open the router's internet or DHCP settings
Look for Internet, WAN, LAN or DHCP Server. Some routers set DNS for the router itself, others set the DNS servers handed to devices. Either works if devices use the router for DNS.
- Switch DNS from automatic to manual
Replace the provider's DNS servers with the filter's addresses. If there is an IPv6 DNS field, fill it with the filter's IPv6 addresses or turn off IPv6 DNS from the provider, or lookups may leak around the filter.
- Choose categories in the filter dashboard
Pick what to block: for example Adult, Gambling, Malware / Phishing / Suspicious and VPN / Proxy / Anonymizers. Add always allow entries for sites your household or team needs.
- Reconnect devices
Devices keep their old DNS settings until they reconnect. Turn Wi-Fi off and on, or restart, so they pick up the new servers.
- Stop devices from using other DNS servers
On routers that allow it, add a rule that blocks outgoing DNS (port 53) to any server except the filter, so a device cannot just type in another resolver.
If your provider's router does not let you change DNS, you can put a second router or mesh system behind it and set DNS there, or set the filter on each device using its encrypted DNS option. The guide on what DNS filtering is explains the mechanics in more detail.
Why category blocking beats typing domains into a list
A block list only knows the sites you thought of. Category filtering looks up each domain in a categorized database, so a site you have never heard of is blocked the first time anyone tries it, as long as it belongs to a blocked category.
Our database covers 120 million categorized domains across 59 web filtering categories. About 300,000 newly registered domains are categorized every day and checked again after a week and after a month, because many sites add content after launch. That is the difference between a list you maintain and a filter that keeps up by itself. The full approach is in how to block websites by category.
Fresh domains are a weak point of hand-made lists. If that matters to you, read how to block newly registered domains.
Schedules, profiles and guest Wi-Fi
A router filter does not have to be all or nothing. Most households and offices want different rules for different people and different hours.
Time schedules
Block social networks and games on school nights, or streaming during office hours. Router schedules usually cut all internet for a device, while a DNS filter can switch single categories. See time schedules.
Different profiles
Children's devices on a strict profile, adults on a light one. Some routers do this per device; a hosted filter can do it per network. See profiles and networks.
Guest Wi-Fi
Give visitors and smart home gadgets their own network with its own rules. It also keeps their devices away from your computers. See guest Wi-Fi content filtering.
SafeSearch
DNS filters can force SafeSearch on search engines and restricted mode on video sites, which closes the search results gap. See SafeSearch enforcement.
How router blocks get bypassed, and what to do
No network rule is perfect. Knowing the common routes around a router block lets you close the ones that matter for your situation.
A phone that switches off Wi-Fi uses the carrier network, which your router never sees. Use the phone's own controls or an encrypted DNS profile for that device.
A VPN tunnels everything past the router. Block the VPN / Proxy / Anonymizers category and see how to block VPN apps.
Browsers can send DNS over HTTPS to their own resolver, skipping the router. Turn it off on managed devices or block known resolver domains. See DNS over HTTPS and web filtering.
Someone types another DNS server into their device. A router rule that only allows outgoing DNS to the filter closes this.
Phones use a different hardware address per network by default, which breaks per device rules. Apply rules to the whole network or ask for the private address option to be turned off on that device.
A default admin password lets anyone remove the rules. Change it, turn off remote admin and keep the router's firmware updated.
Holding the reset button wipes everything. Keep the router somewhere less reachable and note your settings so you can restore them.
Blocked sites reappear on new names within days. Category filtering with daily updates catches most of them; a fixed list does not.
How to test that the block works
Test from more than one device and in more than one way. A block that works in one browser on one laptop is not a working block.
- Restart the test device so it drops cached DNS answers
- Try the blocked site in two different browsers
- Try the site's app on a phone connected to Wi-Fi
- Try a private or incognito window
- Check that an allowed site you rely on still loads normally
- Turn on a browser's secure DNS setting and test again
- Check the filter's activity log for the blocked lookup
- Repeat on the guest network if you have one
- Look up a domain's category with our domain lookup tool
If a site still opens, the usual cause is a domain you did not block. Check which other domains the page loads from, or block its category instead of its name.
Home network or small office: what to set up
The right setup depends less on the router model and more on who uses the network and what you need to see afterwards.
Family home
- Filtering DNS on the router with Adult, Gambling, VPN / Proxy and Malware blocked
- Stricter profile and schedule for children's devices
- SafeSearch forced on
- Device settings on children's phones for mobile data
- Router admin password changed, remote admin off
Small office
- Filtering DNS on the router or firewall for all staff
- Separate guest Wi-Fi with its own policy
- Malware / Phishing / Suspicious blocked everywhere
- Logs kept so you can answer "why is this blocked"
- Written acceptable use policy that staff have seen
For an office, a written policy matters as much as the technical setting. Our page on web filtering for small offices covers policy wording and the categories small businesses usually block.
The category-based option: our managed DNS filter
If you would rather not maintain lists at all, our managed DNS filter runs on the same web filtering database we license to security vendors. You point the router's DNS at it and choose categories in a dashboard.
Category switches
Turn categories on or off per site or network. Changes apply in seconds across every device behind the router.
Your own lists on top
Always allow and always block lists override categories. You can import lists from your old setup.
Logs and reports
See what was blocked and when, so a "why is this blocked" question takes a minute to answer.
Off-network devices
A private encrypted DNS link covers laptops and phones away from home, with the same policy as the router.
Router makers and security vendors who want to build category filtering into their own products can license the database itself; see router content filtering for OEMs.
Router website blocking FAQ
Can I block a website on my router for every device?
Yes, for devices that use your Wi-Fi or wired network and your router's DNS. Phones on mobile data, devices with a VPN and devices with their own encrypted DNS setting are not covered by the router alone.
Why does a site I blocked on the router still open?
The usual causes are a cached DNS answer on the device, a browser using its own encrypted DNS, a VPN or proxy, or the site loading from a different domain than the one you entered. Clear the cache, check the browser's secure DNS setting and block the related domains or the whole category.
Does router keyword blocking work on HTTPS sites?
Mostly not. With HTTPS the router cannot see the page path or the words in the page, only the domain name. Keyword rules on most home routers therefore match only domain names, which is far less precise than it sounds.
Is DNS filtering on the router better than the router's own block list?
For most homes and small offices it is. A category-based DNS filter blocks whole groups of sites, including new ones you have never heard of, while a router block list only stops the exact domains you typed in.
Can I block websites only at certain times on a router?
Many routers offer schedules for internet access per device, and some offer schedules for blocking rules. A hosted DNS filter with time schedules can switch categories on and off by day and hour regardless of the router model.
Will changing the router's DNS slow down my internet?
Usually not noticeably. DNS lookups are small and cached, and a well run filtering resolver answers in a few milliseconds. Page loading speed depends far more on your connection and the sites themselves.
Blocking on the devices themselves
Router rules cover the network. These guides cover the device settings that follow a phone or laptop everywhere.
Filter the whole network by category
Tell us about your network, home office or client sites, and we will suggest a setup. Vendors can also license the database behind it.
Windows is a trademark of Microsoft Corporation. macOS, iPhone and iPad are trademarks of Apple Inc. Android and ChromeOS are trademarks of Google LLC. They are named only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by these companies.