BlockMyself - Browser Policy

Use policy when settings are too easy to change

Browser policy is useful when you need the browser to refuse certain changes from the daily account: DNS-over-HTTPS, URL blocklists, URL allowlists, extension installs, guest profiles, and developer tools.

Decide which browsers are allowed to remain installed.
Remove browsers that you do not intend to manage.
Apply policies from an administrator account, MDM, Group Policy, or system-level policy file.
Verify inside the browser's policy page.
Run the browser section of Test your setup.

Choose a browser strategy

Strategy	Use when	Main controls
One managed browser	You can remove all other browsers.	Default browser, URL policy, DoH off, extension blocklist, app-install restrictions.
Allowed-browser set	You need two or three browsers for work or school.	Apply policy to each browser and block installing unmanaged browsers.
Allowlist mode	Blocklists keep failing.	Block all URLs with `*` and allow only needed sites.
Network-first	Many devices or apps need coverage.	Router DNS enforcement plus browser DoH/DoT policy.

Google Chrome / Chromium policy

Chrome policies can be verified at chrome://policy. Restart Chrome after applying policy, then click Reload policies.

Recommended policies

DnsOverHttpsMode: off
URLBlocklist: domains or * for allowlist mode
URLAllowlist: required exceptions when using allowlist mode
ExtensionInstallBlocklist: *
ExtensionInstallAllowlist: only extensions the trusted person approves
BrowserGuestModeEnabled: false
IncognitoModeAvailability: disabled if private windows are a bypass in your setup

Verify

Open chrome://policy.
Click Reload policies.
Confirm each policy appears.
Confirm Status is OK.
Try to change Secure DNS, install an extension, open a blocked site, and use a guest profile.

Linux JSON example

For Google Chrome, place a managed policy file under /etc/opt/chrome/policies/managed/. For Chromium, many distributions use /etc/chromium/policies/managed/. Write each blocked site as a bare hostname: example-blocked.test blocks that domain and every subdomain. Do not add a scheme, a leading *. or a trailing /*; Chrome and Edge list such entries in chrome://policy but match nothing with them.

{
  "DnsOverHttpsMode": "off",
  "URLBlocklist": [
    "example-blocked.test"
  ],
  "ExtensionInstallBlocklist": ["*"],
  "BrowserGuestModeEnabled": false,
  "IncognitoModeAvailability": 1
}

Windows Registry example for Chrome

Save this as a .reg file and import it with reg import yourfile.reg from an elevated prompt, or double-click it as an administrator. You can also deploy the same settings by Group Policy or MDM. Replace the example domains with your own list.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
"DnsOverHttpsMode"="off"
"BrowserGuestModeEnabled"=dword:00000000
"IncognitoModeAvailability"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\URLBlocklist]
"1"="example-blocked.test"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist]
"1"="*"

Allowlist mode example

Allowlist mode is strict. It can break sign-in, updates, embedded content, payment flows, work tools, and school portals until you add the required domains.

{
  "URLBlocklist": ["*"],
  "URLAllowlist": [
    "example-needed-site.test",
    "https://accounts.google.com",
    "chrome://policy"
  ]
}

Microsoft Edge policy

Edge policies can be verified at edge://policy. Edge uses policy names similar to Chromium, with Microsoft policy locations.

Recommended policies

DnsOverHttpsMode: off
URLBlocklist and URLAllowlist
ExtensionInstallBlocklist: *
BrowserGuestModeEnabled: false
InPrivateModeAvailability: disabled if private browsing is a bypass

Windows Registry example for Edge

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
"DnsOverHttpsMode"="off"
"BrowserGuestModeEnabled"=dword:00000000
"InPrivateModeAvailability"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\URLBlocklist]
"1"="example-blocked.test"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist]
"1"="*"

Microsoft Family Safety web filtering is Edge-centered. If the daily user can install or use another browser, use app restrictions, standard-user accounts, and browser policy.

Firefox enterprise policies

Firefox policies can be verified at about:policies. There are two ways to set them, and the difference matters more than it looks.

On Windows, use the registry rather than the JSON file.

A policies.json file only applies to the one Firefox installation it sits next to. Since a standard user can install a second copy of Firefox into their own folder, or run a portable build, the JSON route is bypassed by downloading Firefox again. The registry keys under HKLM\SOFTWARE\Policies\Mozilla\Firefox apply machine-wide and can only be written by an administrator, so that is the version that holds. Set DNSOverHTTPS\Enabled to 0 and DNSOverHTTPS\Locked to 1.

The same bypass exists on macOS: a policies.json inside Firefox.app is defeated by downloading another copy of Firefox into a personal folder. On a Mac, deliver the policies as a configuration profile instead (managed preferences in the org.mozilla.firefox domain with EnterprisePoliciesEnabled set to true; Chrome uses com.google.Chrome, Edge com.microsoft.Edge), installed system-wide by the trusted person so it applies to every copy of that browser for every user. It is keyed to the app's bundle ID, so builds with a different one (Firefox Developer Edition and Nightly, Chrome Canary) are not covered; treat those as unmanaged browsers to block. The policies.json file below is still the right approach on Linux, and on Windows is only a fallback: the registry can express every policy and wins if both are present.

Common local paths

Windows: C:\Program Files\Mozilla Firefox\distribution\policies.json
macOS: /Applications/Firefox.app/Contents/Resources/distribution/policies.json (bypassable by a second copy of Firefox; prefer a configuration profile)
Linux: /usr/lib/firefox/distribution/policies.json or your distribution's Firefox install path
Linux, install-independent: /etc/firefox/policies/policies.json

Useful Firefox policies

DNSOverHTTPS: disable and lock DoH.
PrivateBrowsingModeAvailability = 1: remove private windows (Firefox 130 and ESR 128.3 or later; DisablePrivateBrowsing = true still works on older Firefox). This is the Firefox equivalent of the Chrome and Edge settings above, and without it private browsing stays available.
BlockAboutConfig: block about:config.
BlockAboutProfiles: block profile switching tools.
DisableDeveloperTools: remove developer tools.
ExtensionSettings: block extension installs or allow only approved extensions.

Firefox policies.json example

{
  "policies": {
    "DNSOverHTTPS": {
      "Enabled": false,
      "Locked": true
    },
    "PrivateBrowsingModeAvailability": 1,
    "BlockAboutConfig": true,
    "BlockAboutProfiles": true,
    "DisableDeveloperTools": true,
    "ExtensionSettings": {
      "*": {
        "installation_mode": "blocked"
      }
    }
  }
}

macOS, iOS, and MDM note

Apple devices are strongest when settings are enforced by a configuration profile, supervision, or MDM that the daily user cannot remove. A normal personal profile is only friction if the daily user can remove it.

Use Screen Time first for built-in content and app restrictions.
Use a standard daily account on Mac.
Use browser policy for Chrome, Edge, and Firefox if those browsers remain installed.
Use an Apple configuration profile or MDM for stronger DNS, web content, app restriction, and profile-removal controls.
Have the trusted person or organization own the MDM/admin account and recovery path.

Lock down the browser settings people usually change.

Use policy when settings are too easy to change

Choose a browser strategy

Google Chrome / Chromium policy

Recommended policies

Verify

Microsoft Edge policy

Recommended policies

Windows Registry example for Edge

Firefox enterprise policies

Common local paths

Useful Firefox policies

macOS, iOS, and MDM note

Official policy references

Chrome URLBlocklist and URLAllowlist

Chrome Enterprise policy list

Edge DnsOverHttpsMode

Microsoft Edge policies

Firefox policy reference

Firefox policy templates