Block a website on a Mac with the hosts file

You fixed the phone. Then you opened the laptop, and there it all was.

There is already a website blocker on your Mac. It came with the machine, it has no subscription and no settings screen, and you edit it by typing sudo nano /etc/hosts into Terminal. It is nine lines long and only three of them do anything.

The hosts file is a lookup table of names. Apple's manual page for it says the file is read by mDNSResponder, the process that answers name lookups for the whole machine, and that its contents supply results for getaddrinfo. That is the function a browser calls when you type a name into the address bar. It is also what the Electron app calls, and the updater you forgot you installed.

So point www.reddit.com at an address that goes nowhere and the site stops loading. Not in one browser. In all of them, and in everything else on the machine, because almost nothing on a Mac does its own asking. Hole three is about the handful of things that do.

Nine lines of text, older than the web, and it outruns most of the extensions. I am as surprised as you are.

Four minutes in Terminal, and it is done

Open Terminal. Command and Space, type terminal, Return. It also lives in Applications, Utilities.
Open the file as root. Type sudo nano /etc/hosts and press Return. It asks for your login password, and nothing appears while you type it, not even dots. Normal, not a broken keyboard.
Arrow past the last line, then paste the block below. Leave what is already in the file alone. localhost and broadcasthost are load-bearing.
Save and close. Control and O, Return to confirm the filename, Control and X. On macOS nano is a symlink to pico, so a screen that says pico is the right screen.
Flush the caches, then quit the browser properly. Run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder, then Command and Q. Closing the window is not quitting, and a browser still running is still holding the old answer.
Check it rather than believing it. Run dscacheutil -q host -a name www.reddit.com. If it prints ip_address: 0.0.0.0, the file is working. That line is the truth serum for everything below.

What sudo is doing

The file belongs to root, which is why double-clicking it and editing in TextEdit gets you nowhere. sudo runs the one command after it as root, using your own login password, then stops asking for a few minutes. Read the whole line before you press Return. That habit is worth more than this article.

Paste this block, then swap in your own names

Two lines per site, one for each address family. Most of these names answer over both IPv4 and IPv6 now, and a block that covers only one is a block with a hole in it.

# Blocked, 26 Aug 2026. Delete this whole block to undo.
0.0.0.0  reddit.com www.reddit.com old.reddit.com new.reddit.com sh.reddit.com np.reddit.com i.redd.it
::1      reddit.com www.reddit.com old.reddit.com new.reddit.com sh.reddit.com np.reddit.com i.redd.it
0.0.0.0  youtube.com www.youtube.com m.youtube.com
::1      youtube.com www.youtube.com m.youtube.com
0.0.0.0  x.com www.x.com twitter.com www.twitter.com mobile.twitter.com
::1      x.com www.x.com twitter.com www.twitter.com mobile.twitter.com
0.0.0.0  instagram.com www.instagram.com
::1      instagram.com www.instagram.com

An address, then every name that resolves to it, separated by spaces or tabs. Anything after a # is ignored, which is where the dated comment goes so future-you can find the block and delete it in one selection.

0.0.0.0 rather than 127.0.0.1, because 127.0.0.1 is your own Mac. Both refuse the connection instantly, but if you ever run anything on port 80 or 443, only one of them can hand you your own dev server instead of an error.

Keep the list short. Four sites you mean beats forty you copied. If you would rather not touch Terminal at all, there are three other ways to do this on a Mac, each with a leak of its own.

When it does not work, it is nearly always one of these four

The browser was open. Browsers keep their own name cache in memory and hold connections open. Quit properly, then try again.
You blocked one name and typed another. reddit.com and www.reddit.com are two names with two answers. Run the test line against the exact name in the address bar, not the one you meant.
You edited a copy. If you opened the file by any route that did not involve sudo, the change went somewhere else, because your account cannot write to that file. Nothing warns you.
You pasted a URL instead of a name. The file wants www.reddit.com, bare. No https://, no trailing slash, no path.

If the test line says 0.0.0.0 and the browser still shows you the site, stop blaming the file. The browser is the one being clever.

Hole one: it matches names, and a site is more names than you think

There are no wildcards. You cannot write *.reddit.com. The format has been an address followed by a list of names since 4.2BSD, and nobody has added a pattern language to it, because it was never meant to be a blocker. It is an address book.

Checked on 26 August 2026, all seven Reddit names in that block resolve separately. Seven doors, one building. Miss one and you will find it, because the site is more motivated to be reachable than you are to be unreachable.

Patchable, mostly. The fix is bookkeeping, not cleverness: when a block slips, look at what is in the address bar, add that name, flush, carry on. Three rounds and the list is real. Expect collateral too. Blocking www.youtube.com kills the embedded video in the work document as well, because there is only one internet and the file cannot tell why you are asking.

Hole two: it cannot tell the time, so it is on all day or not at all

The file is a switch with two positions. No field for hours, no weekday column, no schedule. That is not an oversight, it is what an address book is.

So you pick one of two bad outcomes. Either the site is gone at two in the afternoon when a colleague sends a link, or it is not blocked in the evening, when you needed it gone. The usual compromise is to edit the file twice a day, which is the loophole with extra steps.

An undo you perform every morning is not an undo. It is a routine, and routines get faster.

Not patchable. Nothing you can type in that file gives it a clock. Apple's own scheduler does know the time, but on this machine it is not the same feature it is on your phone.

Hole three: anything that resolves names on its own never sees the file

The file answers lookups the Mac performs. Anything that performs its own goes straight past it.

One case is an IP address typed into the address bar. No name, no lookup, nothing for the file to answer. Almost nobody memorises an IP address to reach a feed at midnight, so that one stays theoretical.

The other is a browser told to do its own encrypted name lookups. Chrome keeps that setting in Settings, Privacy and security, Security, under Use secure DNS. Firefox keeps it in Settings, Privacy & Security, near the bottom, under DNS over HTTPS. The symptom is easy to read: the block holds in Safari and fails in exactly one other browser. The dscacheutil line is how you prove it, because if the Mac says 0.0.0.0 and the browser disagrees, the browser is not asking the Mac.

Patchable, mostly. Turn that setting off in the browser you use for the thing you are trying not to do. Which is a preview of the next hole, and the whole argument of the case against browser extensions: a defence you can switch off from inside the browser has a switch on it.

Hole four: you are root, and undoing this takes fifteen seconds

Here is the undo in full, because a blocker you cannot remove is a trap rather than a tool. sudo nano /etc/hosts, hold Control and K until the block is gone, Control and O, Return, Control and X, then the flush line. Fifteen seconds. No waiting period, no second opinion, no cost.

And you know it by heart now, because you just did it forwards.

That is the real problem with this method, and it has nothing to do with DNS. The file cannot be harder to remove at eleven at night than at eleven in the morning, because it does not know what time it is and does not know who is typing. It is not a lock. It is a note you left yourself, in a file only you read.

Not patchable. Every workaround here is really a workaround for having administrator rights on your own laptop, and those cures are worse than the disease.

The four holes, on one page

The hole	Patchable?	What it costs you
Exact names only, no wildcards	Mostly	Bookkeeping. Add the name that got past you, each time.
No clock, no schedule	No	Editing the file twice a day, or blocking nothing.
Browsers doing their own lookups	Mostly	One setting, in one browser. Two minutes.
You have the password	No	Fifteen seconds, at the worst possible moment.

The two you cannot patch are the same hole

A text file cannot tell the time, and it cannot tell which version of you is typing. The person who set this up on Sunday afternoon and the person deleting it on Wednesday at midnight have the same password, and the Mac is right to believe them both.

Anything that closes those two has to know what hour it is, and has to be something other than you.

It can be a person. Tell one friend you did this, and the fifteen-second undo starts costing you an explanation. That works better than it has any right to, and it is free.

Or it can be something built for the job, which is where we admit we make one. Scrappy is a small dog who stands in front of the apps you name. Three rules and no fourth: quiet hours, a daily limit, an open limit, so the door knows what time it is. He gets less patient the more you knock, polite at first and eventually just shouting. Getting past him costs a treat, treats come from walking about two thousand steps, and we do not sell them and never will.

He works on the phone. He does not work here yet.

The Mac version is what we are building next, and this article is the reason: the hosts file is free, real and genuinely effective, and it still loses to one person with a password and a bad evening. When it ships it will be the same three rules and the same dog. It has not shipped yet, and until it does, the file plus the two patchable holes is the best free thing on this machine.

What he'd do

Paste the block, then run the test line. Four minutes, and the test is the part everyone skips. dscacheutil -q host -a name www.reddit.com tells you what is true. The browser only tells you what it remembers.
Do not try to guess every name today. Add the one that got past you, the evening it gets past you. Four names that are correct beat forty you copied and never checked.
Tell one person you did it. The file has no clock and no lock. A person has both, and that is the only friction here that costs nothing.

He works the phone shift for now.

Free to start, one whole rule, every safety rail. The Mac one has not shipped yet.

Get Scrappy on the App Store

Checked against

macOS 26.2, build 25C56, on 26 August 2026. /etc/hosts read as shipped: 213 bytes, nine lines, root-owned, mode 644, no system-integrity flag on it. man 5 hosts read for the format and for the mDNSResponder and getaddrinfo wording quoted above.
The names were checked rather than assumed. dscacheutil -q host -a name was run against all sixteen names in the paste block. Every one resolved separately.
dscacheutil -flushcache confirmed against the tool's own usage output, and killall -HUP against man killall. Neither was run, and the file was not edited, because both need root and this was not a throwaway machine. Those two steps are documented, not walked.
Whether an IPv4-only entry is enough for a name that also answers over IPv6 was not tested. The block above covers both families so the question never arises.
The browser settings in hole three were located in each browser's own settings layout. What each one does with the hosts file was not measured, which is why that section hands you a test rather than a claim.

The free Mac website blocker you already own, and its four holes