Screen Time
- System Settings › Screen Time › Content & PrivacyTurn it on.
- Find Access to Web ContentChoose Limit Adult Websites, then Customize, and add the sites to block under Restricted.
Screen Time's web filter covers Safari and some other browsers, but not every app. It's built for parental controls.
The hosts file
Add a line like 0.0.0.0 example.com for each domain, save, then run the second command to clear the DNS cache. It works in every app, but you need a separate line for each subdomain, and browsers using DNS over HTTPS can skip it.
sudo nano /etc/hostssudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderBlocklists in a firewall
A firewall sees the hostname of each connection, so it can block a domain in every app, including ones that use their own DNS. In Drippy's Firewall room, turn on ad, tracker and malware lists or add the URL of any hosts file. They refresh daily.
To block one domain for one app, open the app's page in Drippy and turn off that domain's switch. See where each app connects.
Questions
Does editing /etc/hosts block subdomains?
No. Each hostname needs its own line, so ads.example.com and example.com are separate.
Why does a blocked site still load?
The browser may use DNS over HTTPS, which skips the hosts file, or the page is cached. Try a private window, or use a firewall that matches hostnames.