Home / Block guides / Windows 11

How to Block Websites on Windows 11

Five ways to block websites on a Windows 11 PC, from a two minute hosts file edit to company wide policies. Each method below shows what it covers, how people get around it, and the exact steps.

hosts (run as administrator)

# C:\Windows\System32\drivers\etc\hosts
0.0.0.0  example-casino.com
0.0.0.0  www.example-casino.com
# one line per name, no wildcards

Which method fits your situation

Start from who uses the PC and how many sites you need to block. A parent with one laptop and an IT admin with eighty laptops need very different tools.

One PC, a few sitesHosts fileQuick, built in, no account needed. Manual for every domain.

Child's accountFamily content filtersAdult site filtering and allow lists, tied to the child's Microsoft account and Edge.

Whole categoriesFiltering DNSBlocks groups of sites, including new ones, for every browser on the PC.

Office PCs on a domainGroup PolicyBrowser block lists pushed from a server to Pro, Enterprise and Education PCs.

Cloud managed laptopsIntuneThe same browser and DNS policies, delivered over the internet to managed devices.

Windows 11 blocking methods side by side

None of these methods is complete on its own. The matrix shows which traffic each one sees and the usual weak point.

Method	All browsers	Apps	Categories	Survives admin user	Common bypass
Hosts file	Yes, mostly	Yes	No	No	Browser secure DNS, editing the file, subdomains
Family content filters	Edge, others blocked	Separate app rules	Adult filter only	Yes, child account	Signing in as another user, other devices
Filtering DNS on the PC	Yes	Yes	Yes	No, unless locked	Changing DNS, VPN, browser secure DNS
Group Policy browser lists	Managed browsers only	No	No	Yes	Unmanaged portable browsers
Intune policies	Managed browsers	With extra tools	With a filter service	Yes	Personal devices, unenrolled PCs

The single biggest factor is whether the person using the PC is a standard user or an administrator. An administrator can undo any setting on this page, so give children and staff standard accounts.

Step by step: each method on Windows 11

Menu names below match current Windows 11 releases. Microsoft moves settings between updates, so if a label differs on your PC, search for it from the Start menu.

Method 1: block websites with the hosts file

Any edition, one PC, a short list of domains

Open Start, type Notepad, right click it and choose Run as administrator.
In Notepad choose File, Open, and go to C:\Windows\System32\drivers\etc. Set the file type filter to All files and open hosts.
At the bottom, add one line per domain, starting with 0.0.0.0, a space and the domain name.
Add the www version and any other subdomain separately, since wildcards are not supported.
Save the file. If Windows refuses, Notepad was not started as administrator.
Open Terminal and run the flush command so Windows forgets old answers, then restart the browser.

ipconfig /flushdns

Covers

Every browser and app that uses normal Windows name lookups

Weak spots

No wildcards or categories
Browsers with secure DNS turned on can skip it
Any administrator can edit it
Some security software resets changes to this file

Method 2: Microsoft family content filters

Children's accounts at home

Give the child their own Microsoft account and add it to your family group.
Sign in to the family dashboard with your own account and select the child.
Open Content filters, then the web and search section.
Turn on the filter for inappropriate websites and searches.
Add sites to the blocked list, or turn on the option that allows only listed sites for younger children.
Make sure the child signs in to Windows with their own account, not a shared one.

Covers

Adult content and your own lists in Edge, with other browsers blocked when the filter is on
Search filtering

Weak spots

Microsoft documents the web filter as an Edge feature
Other users on the same PC are not covered
Settings sync can take a few minutes

Method 3: set a filtering DNS server

Any edition, whole categories, every browser

Open Settings, then Network & internet.
Select Wi-Fi or Ethernet, then the connection or its hardware properties.
Next to DNS server assignment, select Edit and change Automatic (DHCP) to Manual.
Turn on IPv4 and enter the filter's preferred and alternate addresses. Do the same for IPv6 if your filter provides IPv6 addresses.
If your filter supports encrypted DNS, choose the encrypted option and turn off fallback to plain text so lookups stay with the filter.
Repeat for each Wi-Fi network the PC uses, since the setting can be per network.

Covers

Every app and browser using Windows DNS
Whole categories, including new sites

Weak spots

An administrator can change it back
VPN apps send DNS through the tunnel
Browser secure DNS can override it

Method 4: Group Policy for business PCs

Pro, Enterprise and Education editions

Install the administrative templates for the browsers you allow. Each major browser publishes its own policy templates.
Open the Group Policy Management Console on your domain controller, or gpedit.msc on a single PC.
Find the browser's policy for blocking a list of URLs, enable it, and enter domains or patterns.
For a strict allow list, block everything with an asterisk and list permitted sites in the matching allow policy.
Disable or restrict the browser's own secure DNS setting so lookups go to your filtering resolver.
Run gpupdate /force on a test PC and confirm the policy in the browser's policy page.

Covers

Managed browsers on domain joined PCs
Users cannot change the policy

Weak spots

Browser URL lists have entry limits, around 1,000 for some browsers
Unmanaged or portable browsers ignore it
Not available on Home edition

Method 5: Intune for cloud managed laptops

Business PCs enrolled in device management

In the Intune admin center, create a configuration profile for Windows using the settings catalog.
Search for your browser's URL block list and allow list settings and fill them in.
Add settings that control the browser's secure DNS so it cannot bypass your resolver.
Deploy a DNS or endpoint filter agent, or encrypted DNS settings, for laptops that leave the office.
Block installation of unapproved browsers with your application control policy.
Assign the profile to a pilot group, check results, then widen it.

Covers

Laptops anywhere they connect
Central reporting of policy status

Weak spots

Only enrolled devices
Browser lists alone do not do categories
Policy changes take time to reach devices

Microsoft's endpoint security products also include web content filtering features in some licence tiers. Check Microsoft's current documentation for which licences include them and which browsers they cover.

How blocks on Windows 11 get bypassed

These are the gaps people find most often. Each has a fix, and most fixes are about accounts and DNS rather than longer lists.

Administrator account

An admin can edit hosts, change DNS and remove policies. Use a standard account for daily work and keep the admin password private.

Browser secure DNS

Browsers can send DNS over HTTPS to their own provider. Turn it off by policy or point it at your filter. See DNS over HTTPS and web filtering.

VPN and proxy

A VPN app routes everything past local settings. Block the VPN / Proxy category and app installs. Read how to block proxy sites.

Portable browsers

A browser run from a USB stick ignores Group Policy. Application control and a DNS filter cover it.

Subdomains and mirrors

Hosts and URL lists only match what you typed. Category filtering catches related domains and new mirrors.

Phone hotspot

Tethering to a phone changes the network. PC level DNS or a filter agent keeps rules in place on any network.

Block by category instead of by name

Every method above except DNS filtering asks you to name the sites. That works for five sites, not for the thousands of gambling, adult or proxy sites that exist, many of them registered this week.

59 categoriesPick groups, not sitesAdult, Gambling, VPN / Proxy / Anonymizers, Social Networking, Gaming and more.

Daily updatesNew sites coveredAbout 300,000 newly registered domains categorized every day, rechecked after a week and a month.

120 million domainsDeep coverageThe 20 million most visited domains cover 99.99% of web traffic and usage.

You can see how this works in practice in how to block websites by category, and check how any site is classified with the URL checker.

Windows 11 in a business: a layered setup

For a company, the aim is a policy that holds on every laptop without depending on each user's settings. Most small and mid sized teams settle on three layers.

1. Network

A category DNS filter on the office router or firewall covers every device in the building, including guests and printers.

2. Device policy

Group Policy or Intune locks browser settings, secure DNS and app installs, so users cannot switch the filter off.

3. Off network

An encrypted DNS link or agent applies the same categories at home, in hotels and on a phone hotspot.

Pair the technical setup with a written acceptable use policy. Our guide to web filtering software for business covers policy choices, and blocking social media at work covers one of the most common requests.

The category option: our managed DNS filter

Our managed DNS filter uses the same web filtering database we license to security vendors. Set it on the router for the office, or give each Windows laptop a private encrypted DNS link for use away from the office.

Category switches

Turn categories on and off per site or network. Changes apply in seconds.

Bring your lists

Import existing allow and block lists, including hosts format. See importing allow and block lists.

SafeSearch

Force safe search results and restricted video modes at the DNS level for every browser.

Troubleshooting: the site still opens

When a block does not hold, the cause is almost always one of a handful of things. Work down this table before adding more entries to a list.

Symptom	Likely cause	What to do
Blocked in one browser, open in another	The second browser uses its own secure DNS, or the rule is a browser policy only	Check the browser's security settings for secure DNS, or move the block to DNS level
Main site blocked, app still works	The app talks to other domains, such as content or API domains	Block the service's related domains, or its whole category
Block works after restart, then stops	A VPN or proxy starts with Windows	Remove the app, block VPN / Proxy / Anonymizers, restrict installs
Hosts entry ignored	File saved as hosts.txt, or saved without admin rights	Check the file has no extension and that the edit is really there, then flush DNS
Policy shows in settings but not applied	Profile signed in with a personal account, or policy not yet synced	Check the browser's policy page and the device's sync status
Some pages of a site blocked, others not	The rule names a path, which DNS methods cannot see	Block the whole domain, or use browser URL policies for paths

How to test a block on Windows 11

A quick test from the user's own account tells you more than any settings page. Sign in as the person the rule is for, not as the administrator.

Step 1Flush and restartRun ipconfig /flushdns and reopen the browser so old answers are gone.

Step 2Two browsersOpen the blocked site in the default browser and in a second installed browser.

Step 3Private windowTry a private window, which skips cached pages and some extensions.

Step 4Allowed sitesConfirm that work, school and banking sites still load without errors.

Step 5Check the logWith a DNS filter, look for the blocked lookup in the activity log.

Suggested home setups by age

Families rarely need the business tools. What changes with age is how strict the list is and how much the child can change on their own.

Under 10

Child account with family filters and an allow list of approved sites. Filtering DNS on the router as a backstop. No admin rights on the PC.

10 to 13

Family adult filter on, plus a router DNS filter blocking Adult, Gambling, VPN / Proxy and Malware. Social networks on a homework schedule.

Teenagers

Router DNS filter for adult and harmful categories, SafeSearch forced, fewer per site rules. Talk through the reasons; teens find workarounds quickly.

For more on how category choices map to ages and household rules, see parental controls filtering and the VPN and proxy category, which closes the most common escape route.

Windows 11 website blocking FAQ

What is the easiest way to block a website on Windows 11?

For one or two sites on one PC, the hosts file is the quickest: add a line pointing the domain to 0.0.0.0 and flush the DNS cache. For many sites or whole categories, set a filtering DNS server on the PC or on the router.

Does the Windows hosts file block websites in every browser?

It applies to every browser and app that uses the normal Windows name lookup. A browser with its own DNS over HTTPS setting turned on can skip the hosts file, and the hosts file has no wildcards, so each subdomain needs its own line.

Do Microsoft family content filters work in Chrome or Firefox?

Microsoft's help pages say the web and search filters work in Microsoft Edge. When the filters are on, other browsers can be blocked so they cannot be used to get around the filter.

Can I use Group Policy on Windows 11 Home?

The Local Group Policy Editor is included with Pro, Enterprise and Education editions, not Home. On Home, use the hosts file, family settings or a DNS filter instead.

How do companies block websites on all Windows 11 laptops?

Usually with a combination of a network or DNS filter for everything, browser policies pushed with Group Policy or Intune, and an endpoint agent or encrypted DNS setting for laptops that work away from the office.

How do I unblock a site I added to the hosts file?

Open the hosts file as administrator, delete the line or put a # at the start of it, save the file and run ipconfig /flushdns in a terminal.

Related blocking guides

NetworkBlock websites on a routerCover every device on the Wi-Fi at once.

AppleBlock websites on a MacScreen Time, hosts and MDM.

MobileBlock websites on AndroidPrivate DNS and family controls.

Need categories on every Windows PC?

Tell us how many PCs and sites you manage. We will suggest a filter setup, or a database licence if you build your own product.

Talk to us

Windows, Microsoft Edge and Intune are trademarks of Microsoft Corporation. They are named only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by Microsoft Corporation.