How to Block Websites on a Mac
macOS has two built-in ways to block websites, Screen Time and the hosts file, and two that scale better: a filtering DNS server and MDM profiles for managed Macs. Here is how each works, step by step, and what slips through.
Four ways to block websites on macOS
Each method works at a different level of the Mac. The lower the level, the more apps and browsers it covers, and the harder it is for a user to switch off.
Screen Time
Built-in content limits per user. Best for a child's account on a family Mac.
Hosts file
A system file that sends chosen domains nowhere. Good for a few named sites.
Filtering DNS
Blocks whole categories for every app on the Mac or the whole network.
MDM profiles
Locked settings pushed to company or school Macs. Users cannot remove them.
What each method covers, and how it is bypassed
Use this as a quick scorecard. The bar shows roughly how hard each method is to get around for a determined user without admin rights.
| Method | Covers | Categories | Usual bypass | Resistance |
|---|---|---|---|---|
| Screen Time | The managed user, built around Safari | Adult limit plus your own lists | Other browsers, another user account, a known Screen Time passcode | Medium |
| Hosts file | All apps using system DNS | No | Admin edits, browser secure DNS, unlisted subdomains | Low |
| Filtering DNS in Network settings | All apps on that network connection | Yes | Admin changes DNS, VPN, Private Relay for Safari | Medium |
| Encrypted DNS profile | All apps, every network | Yes | Removing the profile if not managed, VPN | High |
| MDM profiles and restrictions | Company Macs, locked | Yes, with a filter service | Personal devices outside MDM | Very high |
Method 1: block websites with Screen Time
Screen Time is the easiest option for a family Mac. Set it on the child's own macOS user account, or from a parent's device through Family Sharing.
- 1
Open Screen Time
Choose Apple menu, System Settings, then Screen Time. If you manage a child through Family Sharing, pick the child's name from the menu at the top.
- 2
Turn on Content & Privacy
Open Content & Privacy and switch it on. Set a Screen Time passcode the child does not know, or they can change everything back.
- 3
Open the web content section
Depending on the macOS version this section is labelled Store, Web, Siri & Game Center Content or App Store, Media, Web & Games. Find the setting for access to web content.
- 4
Choose a level
Pick one of the three levels below. For older children, Limit Adult Websites plus your own restricted list is the usual choice.
- 5
Customize the lists
Select Customize to add sites to the restricted list or the allowed list. Enter the domain, and test it from the child's account afterwards.
Strengths
- Free and built in
- Passcode protected
- Can follow the child across Apple devices with Family Sharing
- Time limits and app limits in the same place
Gaps
- Designed around Safari; check other browsers on your macOS version
- No category choice beyond adult content
- Only covers the Screen Time user
- Reported misses on some adult sites
Tip: if you allow only Safari, use Screen Time app limits or remove other browsers, so the web limits cannot be skipped by opening a different browser.
Method 2: block websites with the hosts file
The hosts file maps names to addresses before any DNS server is asked. Pointing a domain at 0.0.0.0 makes it unreachable for apps that use the system resolver. You need an administrator account.
- 1
Open Terminal
Find it in Applications, Utilities, or search for it with Spotlight.
- 2
Edit the file as administrator
Open /etc/hosts in a text editor with sudo, as shown below, and enter your password.
- 3
Add one line per name
Use the address, a space, and the domain. Add www and any other subdomains on separate lines, because wildcards are not supported.
- 4
Save and flush the DNS cache
Save the file, then clear the cache so the Mac forgets earlier answers. Quit and reopen the browser.
Strengths
- Works across browsers that use system DNS
- No account or service needed
- Survives restarts
Gaps
- Every subdomain by hand
- Any admin user can undo it
- Browsers with their own secure DNS can skip it
- No categories, no new sites
Method 3: use a filtering DNS server
A filtering DNS server checks each domain against a categorized database and blocks the ones in categories you chose. You can set it on the Mac, or on the router so every device benefits.
- 1
Open Network settings
Choose Apple menu, System Settings, Network, then Wi-Fi or Ethernet. Select Details next to the connected network.
- 2
Replace the DNS servers
Open the DNS tab, remove existing entries with the minus button and add the filter's addresses with the plus button. Click OK.
- 3
Repeat per network or use a profile
Plain DNS settings are per network. An encrypted DNS configuration profile applies on every network and keeps lookups private.
- 4
Choose categories in the filter
Block, for example, Adult, Gambling, Malware / Phishing / Suspicious and VPN / Proxy / Anonymizers, and add always allow entries for sites you need.
Encrypted DNS settings on macOS 11 and later can be installed as a configuration profile. On a personal Mac the user can remove it in System Settings; on a managed Mac the MDM can lock it. For the trade offs between DNS and other filtering layers, see DNS filtering vs web filtering.
Method 4: MDM for company and school Macs
When an organization owns the Macs, mobile device management is the way to make blocks stick. The MDM pushes profiles the user cannot remove.
DNS Settings profile
Points the Mac's DNS at an encrypted category filter on every network. Available on macOS 11 and later.
Content filter settings
Apple's device management includes content filter configuration for the built-in adult filter and allow lists, or for a filter provider's app.
App restrictions
Allow only approved browsers, block VPN apps and stop users installing software that would skip the filter.
Standard accounts
Users without admin rights cannot change DNS, edit hosts or remove profiles. This one step closes most gaps.
Ask your MDM provider which payloads it supports and how it handles the encrypted DNS setting. Our article on MDM web content filter data covers how category data fits into managed device setups.
Common ways around a Mac block
Most bypasses fall into a few groups. Knowing them helps you pick the right layer instead of making lists longer.
Admin rights
Admins can undo hosts entries, DNS and Screen Time if they know the passcode. Give everyday users standard accounts.
A second browser
Screen Time web limits are built around Safari. Limit or remove other browsers, or rely on DNS, which covers them all.
Browser secure DNS
Some browsers can send DNS over HTTPS to their own provider. Point it at your filter or turn it off. See DNS over HTTPS and filtering.
iCloud Private Relay
Private Relay changes how Safari traffic leaves the Mac. Apple lets users turn off Limit IP Address Tracking per network, and networks that need filtering can block the relay.
VPN apps
A VPN tunnels everything past local DNS. Block installation and the VPN / Proxy category. See blocking VPN apps.
Unlisted domains
Services load from many domains, and blocked sites move to new names. Category filtering with daily updates handles both.
Troubleshooting a block that does not hold
When a site still opens, resist the urge to add more entries straight away. Find out which layer missed it first.
| What you see | Probable cause | Fix |
|---|---|---|
| Blocked in Safari, open in another browser | Screen Time limits only, or the other browser uses its own secure DNS | Restrict the other browser with app limits, or move the block to DNS |
| Hosts entry has no effect | Old answer cached, or the edit was not saved with sudo | Check the file again, run the flush command, restart the browser |
| Website blocked, app still works | The desktop app uses other domains | Block the service's related domains or its category |
| Works at home, not at a cafe | Plain DNS was set only for the home Wi-Fi | Use an encrypted DNS profile that applies on all networks |
| Filter stops after an app install | A VPN or proxy app started routing traffic | Remove it, block the VPN / Proxy category, use a standard account |
| Some safe sites blocked | Screen Time's adult limit is cautious with some sites | Add them to the allowed list, or use category filtering with allow entries |
Recommended setups: family Mac, home office, company Macs
The best combination depends on who owns the Mac and who uses it. These three setups cover most situations.
How to test after any change
- 1
Sign in as the user the rules are for, not as the admin, and flush the DNS cache.
- 2
Open a blocked site in Safari and in every other installed browser, including a private window.
- 3
Check that the sites the person needs every day still load, especially school, work and banking sites.
- 4
If you use a DNS filter, confirm the blocked lookup appears in its activity log.
For guidance on which categories households usually choose, see parental controls filtering. For forcing safe results in search engines, read the SafeSearch enforcement guide.
Category blocking on a Mac
Screen Time and hosts only know what you tell them. A category filter starts from a database that already knows which of millions of domains are adult, gambling, proxy or malware sites.
59 categories
Web filtering categories from Adult to Weapons, plus AI / LLM Tools.
120 million domains
Categorized and validated, with several categories per domain where relevant.
Daily new domains
About 300,000 newly registered domains categorized each day.
Rechecked
New sites checked again after a week and after a month as content appears.
See the method in how to block websites by category, or look up any domain with the domain lookup tool. The adult content category page explains what that category includes.
Screen Time or DNS filtering: which should you use?
Many people ask which of the two is better. They solve different problems, so on a family Mac the honest answer is usually both.
Choose Screen Time when
- You want time limits and app limits as well as site limits
- The child uses Safari and has their own account
- You need an allow list for a young child
- You want settings that follow the child to an iPad
Choose DNS filtering when
- You need categories such as gambling, proxies or malware
- Several browsers or apps are in use
- The same rules should apply to every device at home
- You want logs showing what was blocked
Why both: Screen Time manages the person and their time, while a DNS filter manages the sites themselves. Together they cover the child's account, other browsers and every other device on the home network, including consoles and smart TVs that have no settings of their own.
Our managed DNS filter for Macs
Our managed DNS filter runs on the same database we license to security vendors. Set it on the office or home router, or give a Mac a private encrypted DNS link that works on any network.
Choose categories
Switch categories on or off per site, network or profile. Changes apply in seconds.
Schedules
Block social or gaming categories during school or work hours only.
Reports
Activity logs and monthly reports show what was blocked and when.
Mac website blocking FAQ
How do I block a website on a Mac without an app?
Use Screen Time's content settings to restrict specific sites, or add the domain to the /etc/hosts file with an administrator account. Both are built into macOS. For whole categories, set a filtering DNS server in Network settings or on the router.
Does Screen Time block websites in Chrome and Firefox on a Mac?
Screen Time's web limits are built around Safari. Behaviour in other browsers has varied between macOS versions, so test each browser you allow, or restrict other browsers with app limits so Safari is the only option.
Why does the hosts file not block a site on my Mac?
Usually the DNS cache still holds the old answer, a browser uses its own encrypted DNS, or the site loads from a subdomain you did not list. Flush the cache, check the browser's secure DNS option and add each subdomain on its own line.
Can iCloud Private Relay get around a DNS filter?
Private Relay changes how Safari traffic leaves the Mac, which can bypass network DNS filtering. Apple lets networks that need filtering signal this, and users can turn off Limit IP Address Tracking per network. Managed Macs can have it controlled by MDM.
What is the best way to block websites on company Macs?
Use your MDM to push a DNS Settings profile pointing at a category filter, a content filter configuration and app restrictions, and make sure staff use standard accounts. A network DNS filter in the office adds a second layer.
Will blocking websites on a Mac also block them on an iPhone?
Screen Time settings for a child in Family Sharing can apply across their Apple devices when sharing across devices is on. Hosts file and Mac DNS settings only affect that Mac.
Related guides: block websites on iPhone and iPad, block websites on a router and block websites on Windows 11.
Category filtering for every Mac you manage
Tell us how many Macs and networks you look after. We will suggest a filter setup, or a database licence if you are building a product.
Talk to usMac, macOS, Safari, Screen Time, iCloud, iPhone and iPad are trademarks of Apple Inc. They are named only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by Apple Inc.