Website blocker without an extension on Mac

How to block websites on Mac without an extension

To block websites without an extension, block them at the Mac level instead of inside the browser. The hosts file, a DNS filter, or a system-level blocker app works in every browser, in private windows, and in browsers you install later, because the block happens before the browser connects. Screen Time also needs no extension, but Apple documents its website list for Safari.

1. Screen Time for a free restriction in Safari.
2. The hosts file for a free, manual block that covers most browsers.
3. A DNS filter for a block that also covers other apps on the Mac.
4. A system-level blocker app for timed or scheduled blocks that are harder to undo.

Why browser extensions are easy to get around

An extension lives inside one browser, and the browser lets you manage it. That leaves four easy exits:

• The toggle. Every browser has an extensions page where one click turns the blocker off.
• Private windows. Chrome and Firefox don't run extensions in private windows unless you allow it, and guest profiles start with none.
• Another browser. An extension in Chrome does nothing in Safari. As one Reddit user put it: "i can easily avoid most of these blockers by using another web browser that isn't chrome."
• Updates. A browser or extension update can quietly break the block.

Some Mac blockers that look like standalone apps still work this way. Cold Turkey installs an extension in each browser on a Mac. Focus, 1Focus, and Opal control browsers through macOS Automation, so they cover only the browsers they support. 1Focus, for example, doesn't support Firefox. That is fine if it fits how you browse, but it is worth knowing before you buy. The Cold Turkey alternative guide goes into that tradeoff.

Option 1: Screen Time

Screen Time is built in and needs no extension. It is the right first step if you only use Safari.

1. Open System Settings, click Screen Time, then Content & Privacy, and turn it on.
2. Open App Store, Media, Web, & Games. On macOS 14 Sonoma this is called Store, Web, Siri & Game Center Content.
3. Under Safari, choose Limit Adult Websites, click Customize, and add each domain to the Restricted list.
4. Turn on Lock Screen Time Settings if you want a passcode in the way.

Apple's web content settings guide names these as Safari settings and doesn't say whether other browsers are covered. Reports from Chrome, Firefox, and Brave users are mixed at best. On macOS 27, Apple reorganized Screen Time settings, so check Apple's guide for your version if the names differ. The Safari website blocker guide covers Safari-only options in more depth.

Option 2: Edit the hosts file

The hosts file maps names to addresses before your Mac asks a DNS server. Pointing a domain at 0.0.0.0 makes it fail to load in most browsers.

1. Open Terminal and run sudo nano /etc/hosts.
2. Add one line per hostname, for example 0.0.0.0 youtube.com and 0.0.0.0 www.youtube.com. Each subdomain needs its own line.
3. Save with Control-O, exit with Control-X, then clear the DNS cache with sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.
4. Restart your browsers and test.

It is free and covers every browser that uses the system resolver. It has no schedule and no timer, and any admin can undo it in a minute. Browsers with their own secure DNS can also skip it. The Terminal and hosts file guide covers the details and the common reasons it seems not to work.

Option 3: Use a DNS filter

A DNS filter such as NextDNS blocks domains when your Mac looks them up. You point the Mac (or your router) at the service and add domains to a denylist. It covers browsers and other apps on that Mac, and a router setup covers every device on the network.

The tradeoffs are similar to the hosts file. Changing the Mac's DNS settings removes the block, and a browser using its own secure DNS can bypass it. Scheduling is limited. NextDNS's Recreation Time schedule applies to the services in its parental-control list, and applying it to your own domains has been requested in its help center.

Option 4: Use a system-level blocker app

A dedicated app does the hosts or firewall work for you and makes it harder to reverse.

• SelfControl is free and open source. It blocks with the hosts file and the macOS packet filter, and a block can't be stopped until its timer ends, even after a restart. It has no schedule, so you start each block by hand.
• Cactus for Mac blocks with the hosts file and the packet filter on a recurring schedule you set once, such as every weekday from 09:00 to 17:00. It works in every browser without an extension and has no off switch during a block. It costs $19.99 once.
• Chronoid is a time tracker with a website blocker that runs system-wide through a privileged helper. It schedules by start time, end time, and weekdays, and lets you pause it.

Cactus blocks each domain you add and its www. version, plus m.youtube.com for YouTube and twitter.com for X. Other hosts, such as youtu.be or old.reddit.com, go in as separate entries, and it blocks whole sites rather than paths. It has one schedule, doesn't block apps, and is Mac only. How Cactus blocks websites explains the hosts and packet filter layers and how a Mac administrator can remove it.

What can still get around a block without an extension

A Mac-level block is harder to dodge than an extension, but it isn't absolute. Check these if a site still loads:

• Browser secure DNS. Chrome's Use secure DNS and Firefox's DNS over HTTPS resolve names themselves and may not read the hosts file. SelfControl's FAQ warns that Firefox's DNS over HTTPS can make blocks unreliable.
• iCloud Private Relay. Safari traffic goes through Apple's relays, so firewall rules aimed at a site's addresses may not match. Turn it off for a test if Safari is the odd one out.
• VPNs, proxies, and Tor. Traffic goes to the proxy, not the site, so address-based rules miss it, and remote DNS skips the hosts file.
• Admin access. Anyone with an admin password can edit system files, change the clock, or remove the app.
• Shared servers. Blocking by address can now and then break another site that uses the same servers. SelfControl's FAQ notes the same effect.

Compare the options

Which one should you use?

If you only use Safari and want a free block, start with Screen Time. If you want a free block in every browser and don't mind Terminal, edit the hosts file. If you want blocks that start on their own at set hours in every browser, use a system-level blocker with a schedule. If you also switch between Arc, Brave, and Firefox, the Arc, Brave, and Firefox guide covers each one.

Whatever you pick, test it in every browser you use, in a private window, and after a restart.