How to block a website on a Mac in every browser at once

You blocked Reddit in Chrome. You are reading Reddit in Safari.

Nothing malfunctioned. A browser extension is a small program that runs inside one browser, and Safari is not that browser. Neither is Firefox, which came with a work project you finished in March. Neither is Brave, or Arc, or the browser hiding inside Slack that opens links without asking anybody's permission. A Mac has no front door. It has one door per app, and you keep acquiring doors.

Which means the useful question is not which blocker to install. It is which layer a blocker sits at, because the layer settles the coverage before you have picked a product, a price or a logo. There are four layers on a Mac, and everything in this category is one of them:

• Inside one browser. Extensions. Reaches exactly the browser it was installed in, and nothing else on the machine.
• The system's name lookup. Screen Time's web list, and the hosts file. Reaches every app that asks macOS to turn a name into an address, which is nearly all of them.
• Your network. The router, or a filtering DNS service. Reaches every device in the building and stops dead at the front door, which is why it is not one of the four below.
• The socket. A network filter or a local VPN installed on the Mac itself. Reaches traffic that never asks macOS anything.

Below: one method each from layers one, two and four, plus the hosts file, because it is free and it is already installed. Worst coverage last would be a strange way to write this, so we will start with the one that covers the most and costs nothing.

Apple already put a blocklist on your Mac and did not mention it

Screen Time on a Mac has a web content section that almost nobody opens, because it is filed under a heading that sounds like it is meant for somebody else's children. It is a plain list of sites that will not load. Here is the whole procedure.

1. Open System Settings, then Screen Time. If Screen Time is off, turn it on. It will start collecting usage for this user account, which you can ignore.
2. Click Content & Privacy, and switch the toggle at the top on. Nothing below it is editable until you do. This is where most people quietly give up.
3. Click Content Restrictions, then Web Content. Three options: Unrestricted, Limit Adult Websites, Allowed Websites.
4. Choose Limit Adult Websites. Two lists appear. One is sites that are always allowed. The other is sites that are never allowed, and that is the one you want.
5. Add Website, type the domain, repeat. About twenty seconds per site. Six sites is four minutes including the part where you argue with yourself about the sixth.

The third option, Allowed Websites, is the nuclear one: nothing loads except the sites on your list. It is unusable as a daily setting and genuinely excellent for a Sunday afternoon when something is due on Monday.

Why this is not a Safari feature

Every listicle files this under "Safari" and moves on. They are wrong, and you can check it in one line. Open Terminal and run:

otool -L /usr/sbin/mDNSResponder | grep WebFilter

mDNSResponder is the process every app on your Mac goes through to turn reddit.com into an IP address. On macOS 26.2 that command prints a line: the resolver itself is linked against Apple's WebFilterDNS framework. The block is not applied by a browser. It is applied one floor below all of them, at the moment the name is looked up.

Which is why this method is worth four minutes, and why the leaks in it are the interesting part.

Leak one: it is not locked. Screen Time only resists you once you turn on Lock Screen Time Settings and set a passcode. Do that on a Mac and macOS itself puts up a warning: "It is not recommended to use a Screen Time passcode with an administrator account." Then it offers to convert your account to a standard one, and tells you that you will need to create a separate administrator account to be the computer's admin. It is right, and almost nobody accepts the offer, and that is the actual reason this method fails.

Leak two: it is per user account. Screen Time settings belong to the user who is logged in. A second account on the same Mac is a clean Mac. If you have one for testing, or an old one you never deleted, it is sitting there with no restrictions on it at all.

Leak three: a browser that does its own name lookup never asks macOS. This is the one that quietly voids the whole method, and it has a switch in every browser.

Where each browser hides its own DNS switch

Encrypted DNS is a good privacy feature. It is also a browser deciding to resolve names by itself, over HTTPS, without going anywhere near mDNSResponder. A browser doing that never meets the filter you just configured. Five browsers, five places to check:

Set each of them to follow the operating system, or off. Chrome, to its credit, ships a message for the case where it has spotted parental controls on the machine and switched itself off already, so you may find the row greyed out and explained. Arc and the other Chromium browsers keep the same setting in the same place under a different scheme name.

Do this before you build the Screen Time list, not after. Otherwise you will test the list in the one browser that was never going to obey it, conclude that Screen Time is broken, and go and pay for something.

The hosts file does the same job with the lid off

Same layer, no Apple involved, and it belongs to the whole machine rather than to one login. Three commands.

sudo nano /etc/hosts
# add one line per site:
0.0.0.0 www.reddit.com

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

Two minutes, including typing your password twice. 0.0.0.0 rather than 127.0.0.1 because it fails instantly instead of waiting for something on your own machine to answer.

Its leaks are honest ones. It matches names exactly, so reddit.com, www.reddit.com and old.reddit.com are three separate lines and you will forget the third. It catches every app, not just browsers, so the desktop client you forgot about stops working too and you spend ten minutes blaming your wifi. And undoing it is the same three commands with one line deleted, which you will remember perfectly at midnight.

Worth doing anyway, and worth doing properly: the full version, with sudo explained and the four ways it quietly stops working.

An extension is the nicest of these and the weakest

Extensions win on everything except the thing you came for. They understand URLs rather than names, so you can block one subreddit and keep the rest. They can put a timer on a site instead of a wall. They can show you a nice page instead of a connection error. If you want fine control over one browser, nothing else on this list comes close.

Then: it covers one browser, it is administered from inside the browser it is meant to police, and turning it off is a menu and a toggle. Downloading a second browser takes about thirty seconds on a decent connection, and does not feel like breaking a rule, because technically you did not break one.

Use one on top of a lower layer, never instead of one. The long version of this argument, with the diagram: a browser extension is two clicks from off.

The paid apps filter the socket instead of the name

Freedom, Cold Turkey and the rest of that shelf sell you layer four. They install something with system privileges that inspects connections as they are made, which is why they catch the browser doing its own encrypted DNS, the app you forgot about, and the site you reached by typing a raw IP address. Coverage is not the problem with these. Coverage is the thing you are paying for.

The leak is somewhere else entirely: you installed it, so you are its administrator, and every one of them knows it. That is why the good ones sell you a locked mode with no off switch, and why the locked mode is the part people never turn on, because it is genuinely frightening to hand over a machine you need for work.

If you want the sledgehammer, take it seriously: what Freedom and Cold Turkey actually cost you in daily friction.

The four, side by side

Read the third column downward. That is the whole article.

All four locks have the same key in them

Sort those four by strength and you get a ladder. Sort them by how long the off switch takes and you get roughly the same ladder, which is not a coincidence. It is the entire mechanism. Nothing on that list stops you. Each one adds seconds, and then some of them add a password, and one of them adds a small speech from macOS about administrator accounts.

You can make it cost something social. Give the Screen Time passcode to somebody in the house, let them type it, and watch how well that works and how much you hate asking. You can make it cost time: set the filtering app's lock to a duration you cannot shorten, and accept that Tuesday afternoon will occasionally be ruined by it. Both of these work. Both are unpleasant in ways people quietly stop tolerating after a fortnight.

Or you can make it cost something small and specific and slightly silly, which is the approach we took, so this is the part where we admit we build one. Scrappy is a small dog who stands in front of the apps you name. He knows three rules and no others: quiet hours, a daily limit, and a limit on how many times you may open a thing. Knock once and he is polite. Keep knocking and he gets less polite, and the fourth answer is one word.

Getting past him costs a treat, and treats come from walking, roughly two thousand steps for one, and buy you five honest minutes. You cannot buy treats. We will never sell them. Apps you have marked absolute get you nothing at all: he will not take the treat, and he will look at you.

He is on the phone today. The Mac version, which is what this whole article has been circling, is being built and is not out yet, and it will do this same thing at the same layer rather than as an extension, because everything above is the reason an extension will not do. Until it lands, the honest advice is the four minutes of Screen Time and the two minutes of hosts file, and the browser switches turned off first.