How to block websites on Mac with Terminal and the hosts file

Block websites on Mac from Terminal

To block a website on a Mac from Terminal, edit /etc/hosts with sudo nano /etc/hosts, point each hostname to 0.0.0.0 (and to :: for IPv6), save, and flush the DNS cache. The Mac then answers lookups for that site with an address that goes nowhere, so the site won't load. It works in every browser that uses the system resolver, needs no app, and takes about two minutes.

When it fails, the cause is usually something the hosts file can't see: a browser using its own secure DNS, an open connection, iCloud Private Relay, or a subdomain you didn't list. Those are covered below.

If you'd rather not edit the file by hand around your working hours, Cactus for Mac, made by the author of this guide, adds and removes these entries on a weekly schedule for $19.99 once after a 7-day free trial.

Step by step: edit /etc/hosts

1. Back up the file

Open Terminal (in Applications → Utilities) and run:

sudo cp /etc/hosts /etc/hosts.backup

Enter your Mac password when asked. Nothing appears as you type, which is normal.

2. Open the hosts file

sudo nano /etc/hosts

You'll see a few default lines such as 127.0.0.1 localhost, 255.255.255.255 broadcasthost, and ::1 localhost. Leave them alone.

3. Add the sites you want to block

Use the arrow keys to move to the end of the file and add one line per hostname. Block both IPv4 and IPv6, and list the www. version separately:

# Blocked sites
0.0.0.0 youtube.com
0.0.0.0 www.youtube.com
0.0.0.0 m.youtube.com
0.0.0.0 youtu.be
:: youtube.com
:: www.youtube.com
:: m.youtube.com
:: youtu.be

Write only the hostname. No https://, no trailing slash, and no paths. The hosts file maps names to addresses, so youtube.com/shorts is not something it can block.

4. Save and exit

In nano, press Control-O, then Return to save. Press Control-X to exit.

5. Flush the DNS cache

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

This clears the answers macOS has already cached, so the new entries take effect now instead of later.

6. Quit and reopen your browsers, then test

Quit each browser with Command-Q, not just by closing the window. Open the blocked site again. To check what macOS resolves without a browser in the way, run:

dscacheutil -q host -a name youtube.com

The result should show 0.0.0.0 and ::. If it does and the site still loads in a browser, the browser is getting its answer somewhere else.

To add many lines without opening an editor, you can append them:

echo "0.0.0.0 reddit.com" | sudo tee -a /etc/hosts

Run the flush command again afterward.

Why the hosts file "doesn't work anymore"

Reddit threads like this one and this one say the trick stopped working on recent macOS. The file still works. What changed is how browsers and networks resolve names. Go through these in order.

The browser kept an old answer or an open connection

Browsers keep their own DNS cache and reuse open connections. A tab that was already connected can keep working after you edit the file. Chrome also uses HTTP/3 (QUIC) over UDP for many Google sites, which keeps connections alive in the same way. Quitting the browser fully is the reliable fix. In Chrome you can also open chrome://net-internals/#dns and click Clear host cache.

The browser uses its own secure DNS

Browsers with DNS over HTTPS can send lookups to their own resolver instead of asking macOS. Mozilla's DoH documentation describes a setting that exists specifically to make /etc/hosts work with DNS over HTTPS in Firefox, which tells you the two can conflict. Reports for Chrome vary. To rule it out, turn it off and test:

• Chrome: open chrome://settings/security and turn off Use secure DNS.
• Firefox: open Settings → Privacy & Security, find DNS over HTTPS, and choose Off.

Brave and Edge have a similar secure DNS setting in their privacy or security settings.

iCloud Private Relay, a VPN, or a proxy

If you pay for iCloud+ and use Private Relay, Safari's traffic goes through Apple's relays with encrypted DNS. Turn it off under System Settings → your name → iCloud → Private Relay to test (Apple's steps). VPNs and proxies that resolve names on their end can skip your hosts file in the same way.

You blocked the domain, not the subdomain

There are no wildcards in /etc/hosts. reddit.com does not cover old.reddit.com, and youtube.com does not cover m.youtube.com or youtu.be. Watch the address bar when the site loads, and add the exact hostname you see.

No IPv6 line

If you only add 0.0.0.0 lines, a lookup for the site's IPv6 address can still go out to DNS. Add a matching :: line for each hostname.

A typo or formatting slip

Each line needs an address, a space or tab, then the hostname. A missing digit in 0.0.0.0, a URL instead of a hostname, or a # at the start of the line (which makes it a comment) will stop it. 127.0.0.1 also works, but 0.0.0.0 avoids hitting a web server you might run locally.

How to undo it

To unblock a site, delete its lines:

sudo nano /etc/hosts

Remove the lines you added, save with Control-O, exit with Control-X, and flush the cache again. To restore the backup from step 1 instead:

sudo cp /etc/hosts.backup /etc/hosts
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

The limits of a hosts file block

The hosts file is a good tool for a permanent block on your own Mac. It has three limits worth knowing before you rely on it.

• No schedule. The block is on until you remove it. You can script it with launchd or cron, swapping files at set times, but you'll be writing and maintaining that script yourself, and it needs root.
• Easy to undo. Anyone with your admin password can reverse it in one command. That's fine for a technical block, but it adds little friction when you're the one you're trying to stop.
• Name-based only. It doesn't stop a browser using its own DNS, a relay, or a connection that is already open.

macOS also includes the pf packet filter, which can block traffic to specific IP addresses. It closes some of these gaps, but large sites change IPs often, so a rule list needs refreshing. If you want to read about it, start with man pfctl. It's more work than most people want for blocking a few distracting sites.

Doing the same thing on a schedule

If what you want is "block these sites every weekday from 9:00 to 17:00", the hosts file alone doesn't do that. This is where an app helps.

Cactus for Mac automates this exact approach on a schedule. A root helper writes the sites into /etc/hosts (mapped to 0.0.0.0 and ::), flushes the DNS cache, and adds pf firewall rules for the sites' IP addresses on ports 80 and 443, including UDP for QUIC. When a block starts, it drops connections to those addresses that are already open. It re-checks about every minute, so a hand edit to the file during a block gets put back. When the block ends, it removes its entries.

It has limits too. You get one recurring schedule (chosen weekdays, one time range, one site list). It blocks each domain plus www., with m.youtube.com added for YouTube and twitter.com for X, so other subdomains like old.reddit.com or youtu.be need their own entries. It can't block paths. Browser secure DNS, iCloud Private Relay, proxies, and some VPNs can still get around it, and the IP addresses it stores can go stale as sites change them. You can't end an active block early in Cactus, but a Mac administrator can still remove it.

How Cactus blocks websites has the full technical description. If you're blocking sites while coding agents run, see Cactus for coding agents. For every other method, including Screen Time and Chrome-only options, see how to block websites on Mac, and if you tried Screen Time first, why Screen Time isn't blocking websites.