Choose a level
Start with the lowest level that could work. Add stronger layers only where the weaker setup fails.
Guardrails
Built-in controls first: Screen Time, Family Link, Microsoft Family Safety, Chromebook sign-in limits, and basic app install controls.
Open Guardrails Level 2Friction
DNS filters, router settings, browser secure-DNS controls, hosts-file blocking, standard-user accounts, and policy tools.
Open Friction Level 3Lockout
Trusted-person handoff, separated admin accounts, recovery keys kept off-device, device management, and network enforcement.
Open LockoutPlatforms
Use the device page first. Then add the network and lockout layers that apply to your situation.
iPhone / iPad
Screen Time, web content restrictions, app install limits, account-change locks, and supervised-device options.
Android
Chrome filters, SafeSearch, Play approval, Private DNS, and app-install control. Family Link where the account is eligible; it supervises accounts under 18 only.
Chromebook / ChromeOS
Family Link, guest browsing off, sign-in restrictions, child-account web settings, and enterprise management options.
Windows
Microsoft Family Safety, standard-user daily accounts, Edge filtering, browser policy, AppLocker, and BitLocker notes.
Mac
Screen Time, content restrictions, standard daily account, separate admin, FileVault, and profile/MDM options.
Linux
DNS, hosts files, firewall rules, immutable files, browser policy, and sudo/root separation.
Router / gateway
Whole-home DNS filtering, DNS interception, DoT/DoH considerations, Pi-hole, AdGuard Home, NextDNS, and guest network cleanup.
Trusted person
Exactly what to hand off: passcodes, admin passwords, recovery emails, router logins, and recovery keys.
More step-by-step guides
Use these when the basic device pages are not enough, or when you want a concrete recipe instead of building your own setup from scratch.
Something got through
Already set something up and got round it? Pick the line that sounds like what happened and go straight to the fix.
Asked to hold a passcode?
Written for the other person. What you are agreeing to, what to refuse, and what to do when they ask for it back.
Start here
New to this? Four steps, about twenty minutes, and explicit permission to ignore everything else for now.
Allowlist mode
The strongest built-in block: nothing loads unless it is on the list, including inside other apps.
Accountability
Why browser history is an incomplete record, and how to keep one your trusted person actually holds.
Set up filtered DNS
Step by step for iPhone, Mac, Android and Windows, including the options that quietly defeat it.
Shrink the window
Change when and where the device is available, not just what it can reach. Often easier than another filter.
Lock the DNS profile
A DNS profile is four taps from being switched off. What it takes to stop that on iPhone, Mac, Android and Windows.
Test your setup
Browser, app install, DNS, mobile data, account recovery, and reset-path tests.
Setup recipes
Direct paths for iPhone, Android, Windows, Mac, technical users, and whole-home setups.
Recovery audit
Find the passwords, recovery codes, router logins, and reset paths that can undo the block.
Browser policy
Chrome, Edge, and Firefox policy examples for DoH, URL blocks, extensions, and guest/private modes.
Mobile data and hotspots
Close cellular, Private DNS, VPN, hotspot, and carrier-account gaps.
Apps and platforms
Search, YouTube, social apps, chat apps, stores, TVs, consoles, and in-app browsers.
Router recipes
UniFi, OpenWrt, pfSense, OPNsense, consumer routers, Pi-hole, and AdGuard Home checklists.
Urge plan
A practical plan for the moment when you want to bypass your own setup.
Trusted handoff worksheet
A printable inventory for passcodes, admin passwords, recovery paths, and refusal rules.
Glossary
Plain-language definitions for DNS, DoH, VPNs, MDM, recovery keys, and other technical terms.
What to do first
- Pick the device you actually use when you bypass.
- Complete the built-in guide for that device in Guardrails.
- Test the block in every browser and account that still exists with Test your setup.
- Add the DNS, router, and policy steps in Friction.
- Move passcodes, admin credentials, recovery keys, and router logins to the trusted person when you need Lockout.