How to Block Websites on Android
Android has no editable hosts file, but it has something better for most people: Private DNS, which filters every app on Wi-Fi and mobile data. Add Family Link for children and device management for company phones, and you have a block that holds.
Pick the right method
Start with whose phone it is. A parent setting up a child's phone, an adult blocking distractions and an IT admin managing a fleet each need a different first step.
Menu names on Android vary more than on any other platform, because each phone maker adds its own settings layout on top. Where a step below does not match your phone, use the search bar at the top of Settings and type the name of the option. Keep the phone updated as well, since older Android versions lack some of these settings.
Android blocking methods compared
Each method works at a different layer. The table shows what traffic it sees, whether it understands categories, and the usual way around it.
| Method | All browsers and apps | Mobile data | Categories | Who can turn it off | Usual bypass |
|---|---|---|---|---|---|
| Private DNS | Yes | Yes | Yes, with a category filter | The phone's user, unless managed | VPN apps, changing the setting |
| Family Link site controls | Chrome only | Yes | Explicit site filter plus lists | Parent only | Other browsers, in-app browsers |
| Router DNS | Yes, on that Wi-Fi | No | Yes | Router admin | Mobile data, VPN, other Wi-Fi |
| Android Enterprise MDM | Managed browsers, plus DNS | Yes | Yes, with a filter service | IT admin only | Personal devices outside management |
| Filter or parental control app | Usually, via a local VPN | Yes | Depends on the app | Depends on lock settings | Uninstalling, a second VPN |
Why no hosts file? On Android the hosts file is a protected system file. Editing it requires rooting the phone, which weakens its security. Private DNS gives you the same blocking power without that risk.
Method 1: block websites with Private DNS
Private DNS sends every lookup from the phone to the provider you choose, encrypted, on Wi-Fi and mobile data. Point it at a category filter and blocked sites stop loading in every browser and app.
Before you start
- Android 9 or later
- The filter's Private DNS hostname, not an IP address
- Your category choices ready in the filter dashboard
- For a child's phone: Family Link set up first
The search bar is the fastest route, since menu paths differ between phone makers and Android versions.
The three choices are usually Off, Automatic and Private DNS provider hostname. Select the third.
Type the hostname exactly as given. The Save button only works with a valid hostname.
Visit a site in a blocked category on Wi-Fi, then switch to mobile data and try again. Both should show a block.
In Chrome's privacy and security settings, secure DNS can use its own provider. Set it to use the current provider so the filter applies.
Read more about how encrypted DNS interacts with filters in DNS over HTTPS and web filtering.
Method 2: Family Link for a child's Android phone
Google Family Link lets a parent manage a child's Google account and Android device. Its website controls apply to Chrome when the child is signed in.
Also set in Family Link
- Approval for new app installs, so other browsers and VPN apps need your yes
- Content ratings for the app store
- Screen time limits and bedtime
- Blocked site requests come to your phone
Select the child. Recent versions put site settings under Controls, then Content restrictions, then Google Chrome.
Pick one of the three levels above.
Add approved or blocked sites. A domain entry covers the domain's other addresses; a single site entry does not.
Without this, a second browser installed from the store would not follow the Chrome settings.
DNS filtering covers in-app browsers and other apps that Family Link's Chrome settings do not.
For which categories families usually block at each age, see parental controls filtering and screen time app and website categories.
Method 3: block on the router for every device at home
Setting a filtering DNS server on the home or office router covers every Android phone on that Wi-Fi, plus devices that have no settings of their own, such as smart TVs and consoles.
Every phone, tablet and gadget on your Wi-Fi, with one change in the router.
Phones on mobile data or other Wi-Fi networks. Pair it with Private DNS on those phones.
If a phone uses Private DNS, its lookups go to that provider, not the router. Point both at the same filter so the rules match at home and away.
Change the router's admin password and turn off remote admin, or anyone on the Wi-Fi can remove the DNS setting in a minute.
Step by step instructions are in how to block websites on a router.
Method 4: Android Enterprise for company phones
Organizations manage Android phones through Android Enterprise with an MDM. Fully managed, company owned devices give IT the most control; work profiles on personal phones give much less.
| Policy | What it does | Where it applies |
|---|---|---|
| Chrome managed configuration | Pushes a URL block list and allow list to Chrome, including a block everything plus allow list setup | Chrome approved through the managed app store |
| Chrome secure DNS policies | Controls Chrome's own encrypted DNS so it cannot skip the filter | Managed Chrome |
| Private DNS policy | Sets and locks a Private DNS hostname on the device | Company owned devices on recent Android versions; check your MDM's support |
| App allow lists | Stops users installing other browsers or VPN apps | Most reliable on fully managed or dedicated devices |
| Always on VPN for a filter app | Routes traffic through a filtering app that users cannot turn off | Managed devices |
Support for each policy differs between MDM products and Android versions, so confirm the details with your MDM provider. Our article on MDM web content filter data explains how category data plugs into these setups.
How Android website blocks get bypassed
These are the routes around Android filtering that come up most often, and how to close each one.
When a VPN is on, lookups usually go through it, past Private DNS. Require app approvals and block the VPN / Proxy category. See how to block VPN apps.
On an unmanaged phone the user can switch it off. Device management can lock it; for children, keep the conversation open and check it regularly.
Family Link's site controls cover Chrome. App approvals stop new browsers; DNS covers the rest.
Some browsers can use their own encrypted DNS provider. Point them at the current provider or manage the setting.
Social and chat apps open links inside themselves. Chrome settings do not apply there, but DNS filtering does.
Blocked sites move to new domains. Category filtering with daily updates catches most of them. See blocking proxy sites.
Troubleshooting Android blocks
If a site still loads, check the network path and the app before adding more entries to a list.
| Symptom | Likely cause | What to do |
|---|---|---|
| Blocked on Wi-Fi, open on mobile data | Only the router filters; Private DNS is off | Set Private DNS on the phone |
| Blocked in Chrome, open in another browser | Family Link site controls only cover Chrome | Require app approvals, add DNS filtering |
| Private DNS shows "couldn't connect" | Hostname typed wrongly, or the network blocks encrypted DNS | Check the hostname; try another network to compare |
| Website blocked, app still works | The app uses other domains than the website | Block the related domains or the category, or limit the app |
| Filter suddenly stops | A VPN app is active | Check Settings for VPN, remove it, block installs |
Recommended Android setups
One method rarely covers everything. These combinations hold up well in practice and take less than an hour to set up.
Shared tablets and guest phones
A family tablet often has several users. Android supports separate user profiles on many tablets, but site settings differ per profile, so a router DNS filter is the simplest way to give every profile the same baseline. Guest phones on your Wi-Fi follow the router too; a separate guest Wi-Fi with its own filtering keeps visitors' devices apart.
Test after every change
Open a blocked site on Wi-Fi, then turn Wi-Fi off and try again on mobile data.
Try Chrome, any other installed browser, and a link opened from a messaging app.
Check school, work, maps and banking sites still load without errors.
The blocked lookup should appear in the activity log within moments. If nothing appears, the phone is not using the filter.
Category blocking on Android
Family Link's lists and a router's block page only know the sites you add. A category filter looks every domain up in a database, so a gambling site launched this morning is blocked the first time it is visited, as long as it has been categorized.
See how to block websites by category for the full approach, and look up any site with the domain lookup tool.
Private DNS or a filtering app?
Many parental control and filter apps on Android work by creating a local VPN on the phone and inspecting traffic there. That is a different approach from Private DNS, with its own trade offs.
Built into Android, nothing to install, very light on the battery. It blocks at the domain level and depends on the user not changing the setting.
Can add per app rules and reports on the phone. It occupies the phone's single VPN slot, so a second VPN app cannot run alongside it.
For most households Private DNS plus Family Link is enough. Apps make sense when you need per app time rules beyond what Family Link offers.
Both approaches are only as good as the category data behind them. App makers can license ours; see category database for parental control apps.
Our managed DNS filter for Android
Our managed DNS filter runs on the same database we license to security vendors. Point the router at it, or give each Android phone a private encrypted link for Private DNS that works on Wi-Fi and mobile data.
Stricter categories for children's phones, lighter ones for adults. See profiles and networks.
Social networking and gaming off during homework or work hours.
Safe search results and restricted video modes forced at the DNS level.
Activity logs and monthly reports of what was blocked.
Android website blocking FAQ
How do I block a website on Android without an app?
Set Private DNS to a filtering provider's hostname in the network settings. It works on Wi-Fi and mobile data and blocks the categories you choose in the filter. For a child's account, Family Link can also block named sites in Chrome.
Where is Private DNS on my Android phone?
On many phones it is under Settings, Network & internet, Private DNS. On some Samsung phones it is under Connections, More connection settings. If you cannot find it, search for Private DNS in the Settings search bar. It needs Android 9 or later.
Does Family Link block websites in every browser?
Family Link's site filters apply to Chrome when the child is signed in with their supervised account. Other browsers are not filtered by those settings, so require approval for new apps or use a DNS filter that covers every browser.
Can I type an IP address into Android Private DNS?
No. Private DNS takes a hostname, such as the one your filtering provider gives you. An IP address will not be accepted.
Does a VPN bypass Private DNS on Android?
Often, yes. When a VPN is active, lookups usually go through the VPN's own DNS. Block VPN apps through app approvals or device management and block the VPN / Proxy / Anonymizers category.
Can I edit the hosts file on Android?
Not on a normal phone. The hosts file is a protected system file that needs root access, which weakens security and is not recommended. Private DNS does the same job more safely.
Other device guides: iPhone and iPad, Chromebook at home and Windows 11.
Filter Android phones by category
Tell us how many phones and networks you manage. We will suggest a setup, or a database licence if you build your own app.
Android, Chrome, Google Family Link and Android Enterprise are trademarks of Google LLC. Samsung is a trademark of Samsung Electronics Co., Ltd. They are named only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by these companies.