How to block adult websites on your laptop

Before you start

One DNS change filters every browser on your laptop, Incognito included, which a blocker extension can't do. It takes about 10 minutes.

Step 1: Point your laptop at a family DNS (5 minutes)

This is the one step that works in every browser and every app on the laptop.

Windows 11

1. Open Settings > Network & internet, then Wi-Fi (or Ethernet if you're plugged in).
2. Click Hardware properties. Next to DNS server assignment, click Edit.
3. Change Automatic (DHCP) to Manual and turn on IPv4.
4. Set Preferred DNS to 1.1.1.3 and Alternate DNS to 1.0.0.3.
5. Under DNS over HTTPS, choose On (manual template) and paste https://family.cloudflare-dns.com/dns-query. Turn Fallback to plaintext off.
6. Click Save.

Mac

1. Open System Settings > Network and click Wi-Fi (or the connection you use).
2. Click Details next to your network, then DNS.
3. Under DNS Servers, click + and add 1.1.1.3, then click + again and add 1.0.0.3.
4. Click OK.

Each connection keeps its own DNS, so if you also use Ethernet, set it there too.

Worth knowing. On a Mac with iCloud Private Relay turned on, Safari skips a DNS you typed into Network settings. Either turn Private Relay off for your home network (System Settings > Wi-Fi > Details > Limit IP Address Tracking), or rely on Screen Time's filter in Step 2 for Safari.

Chromebook

1. Click the time at the bottom right, then Wi-Fi, then your network.
2. Open Network and find Name servers.
3. Choose Custom name servers and enter 1.1.1.3 and 1.0.0.3.

There's no Save button. It saves when you close the window. It's set per Wi-Fi network, so repeat it for any network you use often.

Then keep your browser from going around it

Two browsers can skip your new filter if you've changed one setting:

• Chrome: under Settings > Privacy and security > Security > Use secure DNS, leave it on the default. Choosing Cloudflare (1.1.1.1), Google or a custom provider there sends every lookup around your filter.
• Firefox: under Settings > Privacy & Security > DNS over HTTPS, leave it on the default or turn it off. In its default mode Firefox steps aside when it notices a family filter. If you picked a provider yourself, it ignores your filter completely.

Worth knowing. Chrome's engineers built its default setting to keep family filters working. It only upgrades your connection to the same provider you already use, which is why picking a different one is the trap.

Step 2: Turn on your laptop's built-in filter

Mac: Screen Time

On macOS Tahoe 26, go to System Settings > Screen Time > Content & Privacy, turn it on, then App Store, Media, Web, & Games > Safari > Limit Adult Websites. Click Customize to add sites to the Restricted list.

Notice the label says Safari. People consistently report that Chrome and Firefox on a Mac get past it, which is why Step 1 matters more on a Mac than on an iPhone.

Windows: Microsoft Family Safety

Windows has a real filter, but it only works if someone else runs it. Family Safety lets a family organizer turn on Filter inappropriate websites and searches for a member, and Microsoft says only the organizer can change it, even when the member is an adult.

So if you have a friend willing to be the organizer, they can add you to a family group at account.microsoft.com/family and switch the filter on for you.

Worth knowing. Family Safety's filter only works in Microsoft Edge. To stop you switching browsers, it blocks the others. It does that from a list of browser versions, and in June 2025 Microsoft admitted brand-new versions of Chrome weren't on the list yet, so they slipped through.

Step 3: Make it hard to undo

Everything above can be switched off by whoever has the laptop's admin password. On your own laptop, that's you.

The strongest fix is a little drastic, and it works. Use a standard account for everyday life, and give the admin password to someone you trust. Changing DNS settings then needs their password, not yours.

If that's too much, at least set the filter up on a calm afternoon. Strict settings get chosen in daylight and undone late at night. Doing it while you're steady makes the default the strict one.

What this won't catch

A DNS filter covers a lot of ground. Here's what's still outside it.

• Reddit and X stay open. So do Telegram and Discord. A filter judges a whole site, and these sites are mostly not adult. None of the filters we tested touched them.
• A different Wi-Fi. On a Mac or Chromebook the DNS is set per network. A café's Wi-Fi starts unfiltered until you set it there too.
• VPNs. A VPN sends your lookups somewhere else, and your filter goes with them.
• A browser where you chose your own DNS provider. See the end of Step 1.

What a blocker can't do

A filter can stop the site from loading. It can't stop you sitting there afterwards with the laptop open and the urge still going.

That's the minute that matters. Close the lid and try urge surfing for three minutes with your headphones in. Urges rise and then ease, often within minutes. Noticing that once is worth more than any setting. If the same hour keeps catching you, read You're not broken, you're in a loop.

Those hours are what Sherpa, the app we're building, is for. It's a few weeks out.

Tonight, if the laptop's still open after midnight, close the lid and leave the room for three minutes. Get a glass of water. Come back and see if the pull is still the same size.