# Block Websites on Mac with Terminal and the Hosts File > Block websites on a Mac from Terminal by editing /etc/hosts. Exact commands, IPv6 and www entries, DNS flush, why it often fails, and how to undo it. Canonical: https://usecactus.app/guides/block-websites-mac-terminal-hosts-file Last updated: 2026-10-17 Editing /etc/hosts is the oldest free way to block a site on a Mac. It still works in 2026, but only if you add the right entries, flush the DNS cache, and rule out browser secure DNS. ## Block websites on Mac from Terminal To block a website on a Mac from Terminal, edit `/etc/hosts` with `sudo nano /etc/hosts`, point each hostname to `0.0.0.0` (and to `::` for IPv6), save, and flush the DNS cache. The Mac then answers lookups for that site with an address that goes nowhere, so the site won't load. It works in every browser that uses the system resolver, needs no app, and takes about two minutes. When it fails, the cause is usually something the hosts file can't see: a browser using its own secure DNS, an open connection, iCloud Private Relay, or a subdomain you didn't list. Those are covered below. If you'd rather not edit the file by hand around your working hours, [Cactus for Mac](https://usecactus.app/), made by the author of this guide, adds and removes these entries on a weekly schedule for $19.99 once after a 7-day free trial. ## Step by step: edit /etc/hosts ### 1. Back up the file Open **Terminal** (in Applications → Utilities) and run: ```bash sudo cp /etc/hosts /etc/hosts.backup ``` Enter your Mac password when asked. Nothing appears as you type, which is normal. ### 2. Open the hosts file ```bash sudo nano /etc/hosts ``` You'll see a few default lines such as `127.0.0.1 localhost`, `255.255.255.255 broadcasthost`, and `::1 localhost`. Leave them alone. ### 3. Add the sites you want to block Use the arrow keys to move to the end of the file and add one line per hostname. Block both IPv4 and IPv6, and list the `www.` version separately: ```text # Blocked sites 0.0.0.0 youtube.com 0.0.0.0 www.youtube.com 0.0.0.0 m.youtube.com 0.0.0.0 youtu.be :: youtube.com :: www.youtube.com :: m.youtube.com :: youtu.be ``` Write only the hostname. No `https://`, no trailing slash, and no paths. The hosts file maps names to addresses, so `youtube.com/shorts` is not something it can block. ### 4. Save and exit In nano, press **Control-O**, then **Return** to save. Press **Control-X** to exit. ### 5. Flush the DNS cache ```bash sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder ``` This clears the answers macOS has already cached, so the new entries take effect now instead of later. ### 6. Quit and reopen your browsers, then test Quit each browser with **Command-Q**, not just by closing the window. Open the blocked site again. To check what macOS resolves without a browser in the way, run: ```bash dscacheutil -q host -a name youtube.com ``` The result should show `0.0.0.0` and `::`. If it does and the site still loads in a browser, the browser is getting its answer somewhere else. To add many lines without opening an editor, you can append them: ```bash echo "0.0.0.0 reddit.com" | sudo tee -a /etc/hosts ``` Run the flush command again afterward. ## Why the hosts file "doesn't work anymore" Reddit threads like [this one](https://www.reddit.com/r/MacOS/comments/14kl3bm) and [this one](https://www.reddit.com/r/MacOS/comments/1gmzrgu) say the trick stopped working on recent macOS. The file still works. What changed is how browsers and networks resolve names. Go through these in order. ### The browser kept an old answer or an open connection Browsers keep their own DNS cache and reuse open connections. A tab that was already connected can keep working after you edit the file. Chrome also uses HTTP/3 (QUIC) over UDP for many Google sites, which keeps connections alive in the same way. Quitting the browser fully is the reliable fix. In Chrome you can also open `chrome://net-internals/#dns` and click **Clear host cache**. ### The browser uses its own secure DNS Browsers with DNS over HTTPS can send lookups to their own resolver instead of asking macOS. Mozilla's [DoH documentation](https://wiki.mozilla.org/Trusted_Recursive_Resolver) describes a setting that exists specifically to make `/etc/hosts` work with DNS over HTTPS in Firefox, which tells you the two can conflict. Reports for Chrome vary. To rule it out, turn it off and test: - **Chrome:** open `chrome://settings/security` and turn off **Use secure DNS**. - **Firefox:** open **Settings → Privacy & Security**, find **DNS over HTTPS**, and choose **Off**. Brave and Edge have a similar secure DNS setting in their privacy or security settings. ### iCloud Private Relay, a VPN, or a proxy If you pay for iCloud+ and use Private Relay, Safari's traffic goes through Apple's relays with encrypted DNS. Turn it off under **System Settings → [your name] → iCloud → Private Relay** to test ([Apple's steps](https://support.apple.com/guide/mac-help/use-icloud-private-relay-mchlecadabe0/mac)). VPNs and proxies that resolve names on their end can skip your hosts file in the same way. ### You blocked the domain, not the subdomain There are no wildcards in `/etc/hosts`. `reddit.com` does not cover `old.reddit.com`, and `youtube.com` does not cover `m.youtube.com` or `youtu.be`. Watch the address bar when the site loads, and add the exact hostname you see. ### No IPv6 line If you only add `0.0.0.0` lines, a lookup for the site's IPv6 address can still go out to DNS. Add a matching `::` line for each hostname. ### A typo or formatting slip Each line needs an address, a space or tab, then the hostname. A missing digit in `0.0.0.0`, a URL instead of a hostname, or a `#` at the start of the line (which makes it a comment) will stop it. `127.0.0.1` also works, but `0.0.0.0` avoids hitting a web server you might run locally. ## How to undo it To unblock a site, delete its lines: ```bash sudo nano /etc/hosts ``` Remove the lines you added, save with **Control-O**, exit with **Control-X**, and flush the cache again. To restore the backup from step 1 instead: ```bash sudo cp /etc/hosts.backup /etc/hosts sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder ``` ## The limits of a hosts file block The hosts file is a good tool for a permanent block on your own Mac. It has three limits worth knowing before you rely on it. - **No schedule.** The block is on until you remove it. You can script it with `launchd` or `cron`, swapping files at set times, but you'll be writing and maintaining that script yourself, and it needs root. - **Easy to undo.** Anyone with your admin password can reverse it in one command. That's fine for a technical block, but it adds little friction when you're the one you're trying to stop. - **Name-based only.** It doesn't stop a browser using its own DNS, a relay, or a connection that is already open. macOS also includes the `pf` packet filter, which can block traffic to specific IP addresses. It closes some of these gaps, but large sites change IPs often, so a rule list needs refreshing. If you want to read about it, start with `man pfctl`. It's more work than most people want for blocking a few distracting sites. ## Doing the same thing on a schedule If what you want is "block these sites every weekday from 9:00 to 17:00", the hosts file alone doesn't do that. This is where an app helps. Cactus for Mac automates this exact approach on a schedule. A root helper writes the sites into `/etc/hosts` (mapped to `0.0.0.0` and `::`), flushes the DNS cache, and adds `pf` firewall rules for the sites' IP addresses on ports 80 and 443, including UDP for QUIC. When a block starts, it drops connections to those addresses that are already open. It re-checks about every minute, so a hand edit to the file during a block gets put back. When the block ends, it removes its entries. It has limits too. You get one recurring schedule (chosen weekdays, one time range, one site list). It blocks each domain plus `www.`, with `m.youtube.com` added for YouTube and `twitter.com` for X, so other subdomains like `old.reddit.com` or `youtu.be` need their own entries. It can't block paths. Browser secure DNS, iCloud Private Relay, proxies, and some VPNs can still get around it, and the IP addresses it stores can go stale as sites change them. You can't end an active block early in Cactus, but a Mac administrator can still remove it. [How Cactus blocks websites](https://usecactus.app/how-cactus-blocks) has the full technical description. If you're blocking sites while coding agents run, see [Cactus for coding agents](https://usecactus.app/for-coding-agents). For every other method, including Screen Time and Chrome-only options, see [how to block websites on Mac](https://usecactus.app/guides/how-to-block-websites-on-mac), and if you tried Screen Time first, [why Screen Time isn't blocking websites](https://usecactus.app/guides/screen-time-not-blocking-websites-mac). ## Questions ### How do I block a website on Mac using Terminal? Run sudo nano /etc/hosts, add lines such as 0.0.0.0 youtube.com and :: youtube.com for each hostname, save, then flush the DNS cache with sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. Quit and reopen your browser before testing. ### Why is my hosts file not blocking websites on Mac? Common causes are a missing www or other subdomain, no IPv6 entry, a browser using its own secure DNS, iCloud Private Relay, a VPN, or a connection that was already open. Quit the browser fully and test again with secure DNS turned off. ### Should I use 0.0.0.0 or 127.0.0.1 in the hosts file? Either blocks the site. 0.0.0.0 is the usual choice for blocking because it isn't your own machine, so it won't hit a web server you run locally on 127.0.0.1. ### Can I block a whole domain with a wildcard in /etc/hosts? No. The hosts file has no wildcards, so each hostname needs its own line, for example youtube.com, www.youtube.com and m.youtube.com. ### How do I undo a hosts file block on Mac? Open /etc/hosts with sudo nano again, delete the lines you added, save, and flush the DNS cache. If you made a backup first, copy it back over /etc/hosts instead. ## Keep reading - [How to block websites in Arc, Brave, and Firefox on Mac](https://usecactus.app/guides/block-websites-arc-brave-firefox-mac): How to block websites in Arc, Brave, and Firefox on a Mac: per-browser extensions and policies, why Brave Shields is not a site blocker, and one fix for all. - [How to block websites on a schedule on Mac](https://usecactus.app/guides/block-websites-on-a-schedule-mac): Block websites during work hours on a Mac. What Screen Time can and can't schedule, what changed in macOS 27, and which scheduled website blockers fill the gap. - [How to block websites on Chrome on a Mac](https://usecactus.app/guides/how-to-block-websites-on-mac-chrome): How to block websites on Mac Chrome with an extension, Chrome's URLBlocklist policy, or a Mac-level blocker, plus why Screen Time and Secure DNS trip people up.