How to Block a Website on Chrome (That Actually Holds)
Here is the thing almost every "how to block a website on Chrome" guide leaves out, and it changes which method you should pick: blocking a site inside Chrome is the weakest form of blocking there is. Chrome is one application on a computer that ships with at least one other browser already installed. Windows 11 comes with Edge. macOS comes with Safari. Firefox is a two-minute download, and there are portable browsers that run from a folder in Downloads without installing anything at all. A block that lives inside Chrome is defeated by not using Chrome.
That doesn't make the Chrome-level methods worthless. If you are blocking a site for yourself because you keep opening it out of habit, a Chrome extension is exactly the right amount of friction. If you are setting something up for a six-year-old who has never heard of Firefox, Chrome-level controls are fine. But if you are trying to enforce a rule against a motivated ten-year-old, you need the block to live below the browser - in the operating system, or on the network.
This guide gives you both. First the Chrome-native methods, from the easy one to the strongest one (which most consumer articles never mention). Then the browser-independent methods that actually hold. Then a comparison table, the bypasses for each, and a section on blocking sites for your own focus.
The three levels of blocking
It helps to picture where a block can sit, because that single fact predicts how long it will survive.
Browser level. The rule lives inside Chrome - an extension, a Chrome profile setting, a Chrome policy. Only Chrome obeys it. Every other browser on the machine ignores it completely.
Operating system level. The rule lives in Windows or macOS - a hosts file entry, Screen Time, a filtering app running as a system service. Every browser on that computer obeys it, because they all ultimately ask the OS to resolve and fetch the address. Survives installing a new browser. Survives Incognito. Travels with the laptop to school.
Network level. The rule lives on your router or your DNS provider. Every device on your Wi-Fi obeys it - laptops, tablets, consoles, a friend's phone. But it stops applying the instant a device leaves your network or switches to a phone hotspot.
The order of durability is consistent: network and OS beat browser, and OS beats network for anything portable. Ideally you use two layers - one on the device, one on the network - so that each covers the other's blind spot.
Chrome-level method 1: a blocking extension
This is the method every guide leads with, and it is the least durable one. It is still genuinely useful in the right situation.
The Chrome Web Store has a large category of site-blocking extensions - search it for "block site" and you'll find several with millions of users. I'm deliberately not naming one here: extensions get sold, abandoned, or quietly change hands, and a site-blocker has permission to see every page you visit, so an extension that changes owner is a real privacy problem, not a theoretical one. Check the listing's last-updated date, the review count, and the developer's website before you install anything with that level of access.
The setup is broadly the same across all of them:
- Open the Chrome Web Store and search for a site blocker in the extensions category.
- Check who publishes it, when it was last updated, and what permissions it requests. Site blockers legitimately need "read and change your data on all websites" - which is exactly why the publisher matters.
- Click Add to Chrome, then Add extension.
- Open the extension's options page and add the domains you want blocked.
- If it offers a password or a "locked mode", set one. If it doesn't, assume the block is advisory.
Three caveats you need to know before you rely on this:
Extensions do not run in Incognito by default. A new Incognito window has no extensions loaded at all unless you explicitly allow them. To turn it on, go to chrome://extensions, click Details on the extension, and switch on Allow in Incognito. If you skip this, Ctrl+Shift+N defeats your block instantly. (If you'd rather remove Incognito entirely, see how to disable Incognito mode - it's a policy setting, not a checkbox.)
Any user can remove any extension. Two clicks at chrome://extensions - toggle it off, or hit Remove. There is no extension password that survives this, because the removal happens in Chrome's own UI, outside the extension's control. The only way to make an extension unremovable is to force-install it via enterprise policy, which is method 3 below.
A second Chrome profile has no extensions. Clicking the avatar in the top right and adding a new person gives you a clean Chrome with none of your extensions installed.
Good for: your own focus, a young child, reducing accidental drift. Not enforcement.
Chrome-level method 2: a supervised Google account via Family Link
If the person you're blocking for is a child with their own Google account, Family Link is the sanctioned way to control Chrome, and it's meaningfully stronger than an extension because the child can't uninstall it from the device.
- Install Family Link on your phone and add your child's Google account to your family group. If they're over the age threshold for your country they have to accept the supervision request on their device.
- Make sure that account is the one signed into Chrome on the computer - the controls follow the Google account, not the machine.
- In Family Link, select your child, then Controls > Content restrictions > Google Chrome.
- Choose Try to block explicit sites (blocklist mode) or Only allow approved sites (allowlist mode).
- Under Manage sites, add the domains you want blocked or approved.
What this actually covers: Chrome, signed in as that supervised account, on any device. On a Chromebook this is genuinely strong control, because Chrome OS is the whole machine and there is no second browser to escape to - see parental controls for Chromebook for the Chromebook-specific setup.
What it doesn't cover: on Windows or Mac, Family Link controls Chrome and nothing else. Edge, Safari and Firefox are untouched. Signing out of Chrome, or using a different Chrome profile that isn't the supervised one, also sidesteps it. Family Link on a laptop is a Chrome control, not a computer control - it is very easy to assume otherwise.
Chrome-level method 3: Chrome policy (URLBlocklist and URLAllowlist)
This is the strongest Chrome-native option and the one consumer guides skip, presumably because it's labelled "enterprise". It works fine on a home computer. Chrome has a documented policy system, originally for schools and businesses, that lets you set rules Chrome enforces itself - no extension involved, nothing the user can toggle off in Chrome's settings.
The two policies that matter here are URLBlocklist (a list of URL patterns Chrome refuses to load) and URLAllowlist (exceptions carved out of the blocklist). They replaced the older URLBlacklist / URLWhitelist names, and I'd treat those legacy names as gone rather than relying on them.
Why it's the best Chrome-native method:
- It applies to every Chrome profile on the machine when set machine-wide, including new profiles.
- It applies in Incognito, unlike an extension.
- It cannot be turned off from inside Chrome's settings. Removing it requires administrator rights on the computer.
- Combined with a wildcard entry, it can run Chrome in allowlist mode: block everything, then permit a named set of sites.
The pattern format is documented by Google and is the same on both platforms. example.com blocks that domain and its subdomains. * blocks everything, which is the entry you use as the base of an allowlist. Individual paths work too, so you can block a section of a site without blocking the whole thing.
Setting it on Windows
On Windows, Chrome reads these policies from the registry, under the Chrome policy key inside HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome. URLBlocklist is a subkey containing string values numbered 1, 2, 3 and so on - one URL pattern per value. URLAllowlist works the same way.
Before you touch the registry, read this. A wrong edit in the wrong part of the registry can leave a machine unable to boot. If that sentence makes you uneasy, skip this method - a hosts file entry or Microsoft Family Safety gets you most of the way with none of the risk. If you continue, open Registry Editor, right-click the key you're working in, choose Export, and save a backup first. Create a Windows restore point too.
The safer route, and the one I'd actually recommend: Google publishes official Chrome ADMX policy templates as part of its Chrome Enterprise bundle, along with a full policy reference listing every policy name and its accepted values. Installing the templates lets you set URLBlocklist through the Group Policy Editor (gpedit.msc, under Administrative Templates > Google > Google Chrome) with a proper UI, no manual registry typing, and no chance of a stray keystroke landing somewhere destructive. Get the templates and the policy list from Google's own Chrome Enterprise documentation - it's authoritative and kept current, which no blog post can promise.
Note that Group Policy Editor isn't present on Windows Home editions. On Home, the registry route or the ADMX-free alternatives below are your options.
Setting it on macOS
On a Mac, Chrome reads the same policies from the managed preferences for com.google.Chrome. You can write them with the defaults command in Terminal, or - better - deploy a .plist / configuration profile containing URLBlocklist as an array of strings. The configuration profile route is tidier and survives more cleanly than loose defaults writes.
Whichever way you go, verify it rather than assuming. Open Chrome and go to chrome://policy. Every policy Chrome has actually picked up is listed there with its current value and status. If your entry isn't on that page, Chrome isn't enforcing it. Click Reload policies after a change. This page is the single most useful thing about this method - it removes all the guesswork.
The honest limit
Chrome policy is still Chrome. It is a very strong block in Chrome, and it does absolutely nothing in Edge. Edge has its own equivalent policy set under its own key, so a thorough Windows setup means configuring both - and then Firefox, if it's installed. That's the moment most parents realise they'd rather block once at the OS level.
Browser-independent method 1: the hosts file
The hosts file is a plain text file the operating system checks before it asks a DNS server where a domain lives. Point a domain at 127.0.0.1 and every browser on that computer - Chrome, Edge, Firefox, a portable browser, Incognito, all of them - fails to reach it.
On Windows the file is at C:\Windows\System32\drivers\etc\hosts and you must open it with Notepad run as administrator or the save silently fails. On a Mac it's /etc/hosts, edited with sudo nano /etc/hosts. Add one line per domain in the form 127.0.0.1 example.com, save, then flush the DNS cache: ipconfig /flushdns on Windows, or sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS.
Two things trip people up. First, hosts files don't support wildcards - *.example.com does nothing. You have to list example.com, www.example.com, m.example.com and any other subdomain individually. Second, Chrome's built-in secure DNS (DNS-over-HTTPS) can route lookups past your machine's resolver entirely; turn it off under Chrome Settings > Privacy and security > Security if a hosts block appears not to work.
Free, effective, per-computer. Undone in sixty seconds by anyone with the administrator password - which is why the single highest-value thing you can do on a family Windows PC is make your child's account a Standard user, not an Administrator. We walk through the whole procedure in detail in the hosts file guide; the mechanics are identical for any site.
Browser-independent method 2: router and DNS filtering
Instead of blocking on each device, block at the point every device passes through.
Router blocking is built into most consumer routers under a name like Parental Controls, Access Restrictions or Website Blocking. Log in at 192.168.1.1 or 192.168.0.1 and add your domains. Quality varies wildly by manufacturer, and plenty of older routers only match unencrypted traffic, which means they quietly fail against modern HTTPS sites.
DNS filtering is the more reliable version. Sign up with a filtering DNS provider - OpenDNS Home, CleanBrowsing and NextDNS all have free or cheap home tiers - point your router's DNS servers at theirs, and manage your block list from their dashboard. Category filtering comes along for free, so you get adult-content blocking without listing sites one at a time.
Strengths: covers every device at once, including ones you can't install software on. Weaknesses: it applies to the adults in the house too, it evaporates on a phone hotspot or at a friend's house, and a device with a manually-set DNS of 8.8.8.8 walks straight around it. Treat network filtering as a second layer, never the only one, on anything portable.
Browser-independent method 3: built-in OS controls
Microsoft Family Safety (family.microsoft.com) gives you a per-child web filter under Content filters > Web and search, where you can add blocked sites and turn on category filtering. The critical caveat: Microsoft enforces this by making Chrome and Firefox refuse to launch under that child account, funnelling them into Edge where the filter works. Some families find that acceptable and some find it unusable - either way, know it before you turn it on. Our Family Safety setup guide covers the details.
macOS Screen Time is the better-behaved of the two. Under System Settings > Screen Time > Content & Privacy > Store, Web, Siri & Game Center Content, set Access to Web Content to Limit Adult Websites and click Customize to add specific sites under Restricted. Then set Allowed Websites Only if you want allowlist behaviour, and finally Lock Screen Time Settings with a passcode that is not your login password. Screen Time applies system-wide on that account, not just in Safari.
Browser-independent method 4: allowlist software
The last category is third-party software that enforces at the system level - a service running underneath the browsers rather than inside one of them. The distinction that matters when comparing these tools is whether they work as a blocklist ("stop these sites") or an allowlist ("only these sites work"), and whether they hook into the OS or install a browser extension. Anything that ships primarily as a Chrome extension has all the weaknesses described in method 1, whatever the marketing says.
3Eyes sits in this category: it's allowlist-first for Windows and Mac and enforces at system level rather than per-browser, so installing Firefox doesn't change anything about what loads. The parent app is iOS-first.
Comparison: which method to use
| Method | Works outside Chrome? | Difficulty | Bypass difficulty | Cost |
|---|---|---|---|---|
| Chrome extension | No | Very easy | Trivial - remove it, or open Edge | Free |
| Family Link (Windows/Mac) | No | Easy | Easy - use another browser | Free |
| Family Link (Chromebook) | N/A - Chrome is the OS | Easy | Hard | Free |
| Chrome policy (URLBlocklist) | No | Hard | Hard without admin rights | Free |
| Hosts file | Yes, that computer | Medium | Easy with admin rights, hard without | Free |
| Router blocking | Yes, whole network | Medium | Medium - hotspot, or leave the house | Free |
| DNS filtering | Yes, whole network | Medium | Medium - change device DNS, or hotspot | Free tier |
| Microsoft Family Safety | Yes - by blocking other browsers | Easy | Medium | Free |
| macOS Screen Time | Yes, that account | Easy | Medium - needs the passcode | Free |
| System-level allowlist software | Yes, that computer | Easy | Hard | Paid |
Read it top to bottom and the pattern is the same one from the start of this article: the further down the stack the block sits, the longer it lasts.
Blocklist or allowlist? The decision that matters most
Every method above can be run in one of two modes, and choosing between them matters more than choosing between the tools.
A blocklist says "everything works except these." It is unbounded work. There is no end to the list of sites that host the thing you're trying to block - proxies, mirrors, alternate front-ends, a new domain every week. And crucially it fails open: anything you didn't think of is permitted by default. Every mistake you make lands on the permissive side.
An allowlist says "nothing works except these." It fails closed. A site you've never heard of is blocked because you've never heard of it, which is precisely the property you want. It also ends the arms race - there's nothing to keep up with, because new domains don't help.
The fair objection is that allowlists are strict, and for an older child they can be genuinely frustrating. A fourteen-year-old doing homework hits a legitimate site you didn't anticipate, and the block becomes a reason to resent you rather than a rule they accept. If you go this route with a teenager, you need a fast, low-drama way for them to request a site and for you to approve it - if a request takes you two days, they will find a way around the whole system, and they'll be right to.
Rough guide: for a child under about ten, allowlist. For a teenager, a blocklist plus category filtering plus an honest conversation usually holds better than a wall they resent. And for a specific compulsive problem - one game, one app, one site eating every evening - a targeted block on that one thing is better than either.
How kids get around each method, and the fix
| Bypass | Why it works | Fix |
|---|---|---|
| Open Edge, Safari or Firefox | Chrome-level blocks apply to Chrome only | Block at OS or network level |
| Portable browser from Downloads | Runs without installing, no admin rights needed | OS-level block; allowlist app installs |
| Incognito window | Extensions are off by default in Incognito | Allow the extension in Incognito, or use policy/OS-level blocking |
| New Chrome profile | Fresh profile, no extensions | Machine-wide policy instead of an extension |
| Remove the extension | Two clicks at chrome://extensions | Force-install by policy, or don't rely on extensions |
| Phone hotspot | Bypasses your router and DNS entirely | On-device blocking; manage the phone separately |
| Change device DNS to 8.8.8.8 | Ignores your filtering DNS provider | Standard user account; lock network settings |
| Chrome's secure DNS (DoH) | Resolves names in-browser, past the hosts file | Turn off Use secure DNS; block DoH resolvers at the router |
| Edit the hosts file back | Trivial with admin rights | Make the child a Standard user |
| Web proxy or VPN | Tunnels around DNS and router filtering | Allowlist mode; block VPN installs - see can a VPN bypass parental controls |
| Mirror sites and alternate front-ends | The content is served from a domain you never listed | Allowlist mode - this one is unwinnable with a blocklist |
Notice how many rows are answered by "allowlist mode" or "Standard user account". Those two changes are worth more than any particular tool.
Blocking a site for yourself
A large share of people searching this are not parents. They're trying to stop opening the same site forty times a day, and the requirements are completely different: you have the admin password, so nothing can truly stop you. The goal isn't enforcement, it's friction - making the habitual action take enough deliberate steps that the habit breaks.
What works, roughly in order of how much friction it adds:
A Chrome blocking extension with a schedule. Blocked during working hours, open in the evening. This is the right tool for the job, and the fact that you can disable it in two clicks is fine - the point is that the automatic reach stops working, not that escape is impossible.
Two browsers, two roles. Chrome for work with the block installed, a second browser for everything else. Deciding to switch browsers is a conscious act, which is most of the benefit.
A separate Chrome profile for work. Its own extensions, its own logins, its own history. Switching profiles is a deliberate step, and the work profile can be genuinely clean.
The hosts file. Blocks the site everywhere on the machine, including whatever browser you reach for absent-mindedly. Editing it back requires the admin password and about a minute of typing, which is enough friction to notice yourself doing it.
A separate DNS profile or router-level block during work hours. Heaviest option, affects everything on the network, and unlike the others it also catches your phone.
One honest note: none of this addresses why the pull exists. Blocking works best as scaffolding while you change what you do at the moment you'd normally reach for the site, not as a permanent substitute for it.
Frequently asked questions
How do I block a website on Chrome without an extension? Use Chrome's URLBlocklist policy - registry-based on Windows (ideally via Google's official ADMX templates and Group Policy Editor), managed preferences for com.google.Chrome on macOS. It applies to every Chrome profile including Incognito and can't be switched off inside Chrome's settings. Verify at chrome://policy.
Will blocking a site in Chrome block it in Edge? No. Chrome extensions, Chrome policies and Family Link's Chrome controls apply only to Chrome. Edge, Firefox and Safari are unaffected. To cover every browser you need an OS-level method: the hosts file, macOS Screen Time, or system-level filtering software.
Do Chrome extensions work in Incognito? Not by default - a new Incognito window loads no extensions. You have to go to chrome://extensions, open the extension's Details, and turn on Allow in Incognito. Miss this and Ctrl+Shift+N walks around your block.
Can my child just delete the blocking extension? Yes, in two clicks at chrome://extensions, unless the extension was force-installed via enterprise policy. No extension can protect itself from being removed through Chrome's own UI.
Is there a way to block all websites except a few in Chrome? Yes - set URLBlocklist to * and then list the permitted sites in URLAllowlist. macOS Screen Time offers the same shape with its Allowed Websites Only setting, and Family Link with Only allow approved sites.
Why does the site still load after I blocked it? Three usual causes: the browser's secure DNS is bypassing your hosts file or router; you blocked example.com but not www.example.com or m.example.com; or the block is browser-specific and you're testing in a different browser. Test in a fresh Incognito window after clearing the DNS cache.
Does blocking a site on the computer block it on phones? No. Every method here is per-device or per-network. A phone on cellular data is unaffected and needs managing separately with iOS Screen Time or Family Link.
Do I need admin rights to block a website? For the durable methods, yes - hosts file, Chrome policy, Screen Time locking and filtering software all require administrator access. That cuts both ways: if your child's account has admin rights, they can undo all of them. Make their account a Standard user first.
Related guides
- How kids bypass parental controls - and what actually stops them
- How to disable Incognito mode in every browser
- How to block YouTube on a computer, Mac or Chromebook
- How to Block AI Chatbots on a Computer
If you'd rather not maintain block lists across four browsers and two operating systems, 3Eyes enforces an allowlist at system level on Windows and Mac - 14-day free trial, up to 4 children.