How to Block Websites on a Chromebook at Home
For family and personal Chromebooks that you own. Four layers work together: Family Link for the child's account, owner settings that close loopholes, DNS on the Chromebook, and a filter on the home router.
First: is this your Chromebook or the school's?
This guide is for Chromebooks a family or person owns. School issued Chromebooks are managed by the school and follow different rules.
Personal or family Chromebook
- Bought by you, set up with a personal Google account
- The first account to sign in became the owner
- You can use Family Link, DNS settings and the router
School issued Chromebook
- Enrolled and managed by the school's administrators
- Most settings are locked and should not be changed
- Ask the school how it filters at home; your router filter can add a layer on your Wi-Fi
School IT teams control filtering on managed Chromebooks through their admin console. If you work in a school, look for a guide on blocking websites on managed school Chromebooks rather than this home guide.
Chromebook blocking methods compared
ChromeOS is locked down by design, so some methods used on other computers, such as editing the hosts file, are not available. The options below are what works on a home Chromebook.
No hosts file: editing system files on ChromeOS needs developer mode, which wipes the device and turns off key security protections. It is not a sensible way to block sites on a family Chromebook.
Step 1: set up Family Link on the child's account
Family Link lets a parent supervise a child's Google account. When the child signs in to the Chromebook with that account, the parent's Chrome site settings apply.
Use the Family Link app on your phone to create an account for a child under the age of consent, or add supervision to an existing teen account.
Add the child as a person on the Chromebook's sign-in screen. You will be asked for a parent's password to confirm supervision.
In the Family Link app, select the child and find the Google Chrome site settings. Recent versions put them under Controls, then Content restrictions.
Pick one of the three levels below, depending on the child's age.
Under the manage sites option, add domains to block or approve. A domain entry covers the whole domain, while a single site entry covers just that address.
Require your approval before the child installs apps or extensions, so a proxy extension or VPN app cannot be added quietly.
When the child hits a blocked site, they can ask for access and you get a request in the Family Link app. Signed-in supervised Chrome also turns off incognito mode for the child.
Family Link menus are updated often, and the same settings can also be reached from a web browser on your own computer. If a label in these steps does not match what you see, look for the child's Chrome or content settings in the current version.
Step 2: close the owner setting loopholes
Family Link only works while the child is signed in with the supervised account. If the Chromebook allows guest browsing or new accounts, the child can simply browse without supervision. Google's own help recommends closing both.
The owner is the first account that signed in after setup or the last Powerwash. Only the owner can change these settings.
Open Settings from the clock area and look for the section that manages other people or sign-in. Labels change between ChromeOS versions; the Settings search box finds it.
Guest sessions are not supervised, so switch guest browsing off.
Allow only the accounts you list, such as yours and the child's supervised account.
If the child knows the owner password, they can undo all of this. If the child became owner by signing in first, a Powerwash and a fresh setup with your account first is the usual fix.
Step 3: add category filtering with DNS
Family Link blocks the sites you list plus explicit content. A DNS category filter adds whole groups of sites, such as gambling, proxies or malware, for every app on the Chromebook, including Android apps.
Custom name servers
Open Settings, Network, then your Wi-Fi network. In its network section, switch name servers to custom and enter the filter's addresses. Repeat for each network.
Chrome secure DNS
In Chrome's privacy and security settings, the secure DNS option can use a custom provider. Point it at your filter's encrypted address, so Chrome does not send lookups elsewhere.
Router instead
Setting the filter on the home router covers the Chromebook and everything else at home with no change to the Chromebook. See how to block websites on a router.
Custom name servers apply per network, so a Chromebook taken to a friend's house or on holiday uses that network's DNS. Chrome's secure DNS with your filter's address follows the Chromebook to any network. Background on encrypted DNS is in DNS over HTTPS and web filtering.
Android apps, Linux and other ways onto the web
A modern Chromebook is more than a browser. Many models run Android apps from the Play Store, and some can run a Linux environment. Each of these is a separate route to the internet.
The common thread is DNS. Whichever route an app takes, it still has to look up a domain name, which is why a category DNS filter on the router or in Chrome's secure DNS setting covers so much of the Chromebook at once.
Blocking distractions on your own Chromebook
Not every reader is a parent. Adults use Chromebooks for work and study at home and want to block distracting or risky sites for themselves.
Focus hours
A DNS filter with a schedule can switch Social Networking, Streaming Media and Gaming off during working hours, then back on in the evening.
Safety first
Block Malware / Phishing / Suspicious and Parked / For-Sale Domains all the time. This protects against many fake login pages.
Work managed profile
If your employer manages your Chrome profile, its policies apply alongside yours. Ask IT before changing DNS on a work device.
Self-imposed blocks are easy to switch off, which is fine: the point is a moment of friction, not a lock. A schedule in a DNS filter works well here, because the block lifts by itself at the end of the day and you are not tempted to remove it entirely. Small businesses that run Chromebooks for staff can apply the same idea to the whole office network; see web filtering for small offices.
Why categories matter more than lists
New gambling, adult and proxy sites appear every day. A list in Family Link only stops the names you added. A category filter looks every domain up in a database that is kept current.
59 categories
Choose groups such as Adult, Gambling, Dating, Gaming, Social Networking and VPN / Proxy / Anonymizers.
New sites daily
About 300,000 newly registered domains categorized every day, then rechecked after a week and a month.
Wide coverage
120 million categorized domains. The 20 million most visited cover 99.99% of web traffic and usage.
The approach is set out in how to block websites by category. Proxy sites deserve special attention on a child's Chromebook; see how to block proxy sites.
Common Chromebook workarounds, and the fix for each
Children talk to each other, and the same tricks travel from school to home quickly. Most are closed by the owner settings and a DNS layer.
| Workaround | Why it works | How to close it |
|---|---|---|
| Guest mode | Guest sessions are not supervised | Turn off guest browsing as the owner |
| A second Google account | Other accounts do not carry Family Link rules | Restrict sign-in to listed people |
| Proxy and unblocker sites | They fetch blocked pages through another domain | Block the VPN / Proxy / Anonymizers category with daily updates |
| VPN apps or extensions | They tunnel traffic past DNS and router filters | Require approval for apps and extensions, block the VPN category |
| Phone hotspot | Leaves the home router's filter | Family Link still applies; use Chrome secure DNS pointed at your filter |
| Powerwash and set up again | Resets owner and settings | Set the Chromebook up again with your account first so you stay owner; supervision follows the child's account |
| Translation and cache pages | Show a blocked page through another site | Category filtering on the original domain and the proxy category |
For the related problem of AI chat tools on a child's Chromebook, see how to block AI chatbots.
Recommended home setups
How strict to be depends on age. These are starting points to adapt to your household rules.
Test it like a child would
Try guest and new accounts
From the sign-in screen, check that guest browsing and adding a person are not available.
Try blocked sites and proxies
Sign in as the child and open a blocked site, then a search for unblocker sites.
Try installing an extension
The install should ask for a parent's approval.
Check homework sites
School portals, video lessons and reference sites should still load.
Category ideas by age are in parental controls filtering. For safe search results across all search engines, see the SafeSearch enforcement guide.
Our managed DNS filter for home Chromebooks
Our managed DNS filter runs on the same web filtering database we license to security vendors. Set it on your router, or give the Chromebook a private encrypted DNS link for Chrome's secure DNS setting so it is filtered on any network.
Category switches
Turn categories on and off in seconds, with always allow and always block lists on top.
Homework schedules
Switch gaming and social categories off on school nights. See time schedules.
Activity reports
See which categories were blocked and when, without reading anyone's messages.
Category filtering decides which websites load. It does not read messages, record keystrokes or judge a child's wellbeing. Treat it as one layer alongside conversations at home and the school's own safeguarding process.
Chromebook website blocking FAQ
How do I block a website on my child's Chromebook?
Sign the child in with a Google account supervised through Family Link. In Family Link, open the child's Chrome settings, choose a filter level and add sites to the blocked list. As the Chromebook owner, turn off guest browsing and restrict sign-in so the child cannot use an unsupervised session.
Can I edit the hosts file on a Chromebook?
Not in normal use. ChromeOS protects its system files, and the only way to edit them is developer mode, which wipes the device and turns off important security protections. Use Family Link, DNS or the router instead.
Why can my child still open blocked sites on the Chromebook?
The usual reasons are guest mode, a second unsupervised account, a site on a domain you did not block, or a VPN or proxy. Turn off guest browsing, restrict sign-in to listed users, block by category and block the VPN / Proxy / Anonymizers category.
Does changing DNS on a Chromebook apply to every Wi-Fi network?
No. Custom name servers are set per network, so you need to repeat the setting for each network the Chromebook uses. A filter on the home router covers the home network without touching the Chromebook.
Should I change settings on a Chromebook issued by my child's school?
No. A school Chromebook is managed by the school's administrators and most settings are locked. Ask the school about its filtering at home, and add your own filtering on the home router if you want an extra layer.
Do browser blocking extensions work on a Chromebook?
They can, but on an unmanaged Chromebook the user can usually remove or disable them. For a child, Family Link's site settings and a DNS or router filter are harder to switch off.
Other device guides: Android, Windows 11 and Mac.
Category filtering for your home network
Tell us what devices you have and what you want to block. We will suggest a setup. Product teams can license the database itself.
Chromebook, ChromeOS, Chrome and Google Family Link are trademarks of Google LLC. They are named only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by Google LLC.