How to Block a Website on a Mac, in Every Browser at Once
A browser extension blocks a website in that browser only. Open a different browser, or use an app that fetches the same address in the background, and the block does nothing. To cover everything on the Mac you need to block below the browser, which means either editing a system file by hand or using a firewall app.
Here are the three methods that work everywhere, and the one that does not.
Method 1: a firewall app
The method built for this. A firewall app can block a name for every app on the Mac, and macOS enforces it in the system itself.
In MiniFirewall: open Blocks, press plus, choose Website, type the name, and choose Every app on this Mac. Before saving, it tells you what else the block covers, because blocking example.com also covers www.example.com, mail.example.com and everything else beneath it. That warning matters, since the difference between blocking one page and blocking a company’s entire mail system is easy to miss.
You can also block a website for one app only, which leaves the same site reachable elsewhere. That is narrower and inherently less reliable, because the firewall has to work out which website each connection belongs to and some apps make that hard. When it applies, the app says so rather than pretending.
Cost: you have to install something. Benefit: works in every browser and every app, blocks are reversible in one click, and nothing needs the Terminal.
Method 2: the hosts file
macOS keeps a file at /etc/hosts that maps names to addresses. Point a name at 127.0.0.1 and requests for it go nowhere.
It is free and it does work system-wide. The limits are real:
- It cannot handle subdomains. Blocking
example.comdoes not blockwww.example.com. You list every name individually. - It is all or nothing. No way to allow one app and block another.
- Modern browsers can bypass it. Several look up names through their own encrypted service by default, which does not consult the hosts file at all.
- A mistake here is hard to diagnose. A stray character can break name lookups in ways that look like a broken internet connection weeks later.
If you go this route, keep a note of what you added and why. Future you will not remember.
Cost: the Terminal, administrator rights, and no subdomain handling. Benefit: free, no software.
Method 3: your router or a DNS service
Most routers, and DNS services like those offered for family filtering, let you block names for every device on the network at once. If the goal covers phones and tablets as well as the Mac, this is the efficient place to do it.
Cost: covers the whole network whether you wanted that or not, and does not follow you to other networks. Benefit: one change protects every device, including ones you cannot install software on.
What does not work everywhere: browser extensions
A content blocker in Safari, Chrome or Firefox is excellent at what it does and covers exactly one browser. Everything else on the Mac, including apps that quietly fetch from the same address, is untouched.
That is fine when the goal is a cleaner browsing experience. It is not a block.
Which method should I use?
| Goal | Method |
|---|---|
| Stop one website across every browser and app on this Mac | Firewall app |
| Stop it for one app but not others | Firewall app, scoped to that app |
| Stop it on every device in the house | Router or DNS service |
| Stop it, free, and you are comfortable in a Terminal | Hosts file |
| Tidier browsing, one browser | Content blocker extension |
Why does blocking a website also block its subdomains?
Because that is almost always what you meant. A company does not serve everything from one name; it spreads across www, api, cdn, mail and more. Blocking only the bare name would leave most of it reachable and give you a false sense that you had done something.
The corollary is that a block is wider than it looks, so a tool should tell you before you confirm rather than after. Blocking example.com covers every name ending in it, including ones you may depend on.
How do I undo it?
This is worth checking before you block anything. In a firewall app, a block should be pausable rather than only deletable, so you can turn it off, confirm that was the cause, and turn it back on without retyping anything.
If you used the hosts file, undoing means editing the file again and removing the line, which is why the note to yourself matters.
Sources
- Apple, Block connections to your Mac with a firewall, on what the built-in firewall does and does not cover
- Apple, NEFilterDataProvider, the system service that lets a firewall app block by name