Set it up
Change when and where, not just what
A different kind of lever from everything else here, and often the one that does the most work.
Shrink the window
Schedules, keeping the phone out of the bedroom, and deleting rather than filtering. The layer people skip because it is not technical.
Urge plan
What to do in the moment, written down before you need it.
Trusted person
The thing that makes any of it hold. Who to ask and what to agree.
Close the gaps that remain
Each of these exists because a simple setup fails in a particular way. Read the one that matches what got through.
Build it for me
Generate the setup rather than configuring it by hand: a configuration profile for iPhone, iPad and Mac, or a blocking script for Windows, Mac and Linux.
Set up filtered DNS
The actual steps per platform, and the settings that matter. Start here if a page told you to "add filtering DNS" and you want the how.
Friction
Filtering DNS, hosts files, standard accounts, and the settings that block workarounds.
Allowlist mode
When category filtering keeps not being enough. The strongest built-in block, and the only one that fails closed.
Mobile data and hotspots
When it works at home and not on cellular. Private Relay, tethering, carrier controls.
Apps and platforms
Search, video, social, app stores, TVs, consoles, and browsers hidden inside other apps.
Browser policy
Locking Chrome, Edge and Firefox, including their own encrypted DNS, which quietly defeats everything else.
Routers and gateways
Whole-home filtering, DNS interception, guest networks, Pi-hole and AdGuard Home.
Make it hard to undo
The part most setups skip, and the reason most of them stop working within a month.
Lockout
Handing over passcodes, separating admin accounts, and controlling the recovery paths.
Trusted person
Who to ask, what they hold, and what to agree before you need it.
Asked to help
The page to send them. Written for the person holding the passcode, not the person setting it up.
Lock the DNS profile
Stopping the filter being switched off, on iPhone, Mac, Android and Windows.
Recovery audit
Finding the passwords, backup codes and reset paths that can quietly undo everything.
Handoff worksheet
A printable inventory to fill in together, including what they should refuse.
Accountability
Why browser history is an incomplete record, and how to keep one you cannot edit.
Check it, and use it
Something got through
Symptom first. Pick the sentence that matches what happened and go to the one page that fixes it.
Test your setup
Find what still gets through: browsers, app installs, DNS, mobile data, reset paths.
Urge plan
What to do in the moment you want to undo all of this. Worth reading before you need it.
Glossary
Plain-language definitions for DNS, DoH, VPNs, supervision, recovery keys and the rest.
The three levels, if you want the model
Most of the site sorts into one of three tiers. You do not need to read them in order, but it helps to know which one you are currently relying on.
1. Guardrails
Built-in controls. Easy to maintain; only hard to undo when someone else holds the passcode.
2. Friction
DNS, policy and network layers. Harder to route around.
3. Lockout
Someone else holds what you would need to reverse it.