BlockMyself - Script builder

What this is good at, and what it is not

Its real advantage

A hosts file is consulted before a browser's own encrypted DNS, so unlike DNS filtering it is not bypassed by turning on Secure DNS or switching resolver. That is the most common way people defeat a filter, and it does not work here. It also needs no account, works offline, and sends nothing to anyone.

Its real limit

There are no wildcards. Each line matches one exact hostname, so a site you block may still load on a subdomain you did not list. This is precise rather than comprehensive, which makes it excellent for a specific list of sites and a poor choice as your only layer.

The lock is the administrator password, not the file.

The script can make the file unwriteable, but an administrator can always undo that in a couple of commands. This only becomes a control if your daily account is a standard account and someone else holds the administrator password. If you are an administrator on your own machine, treat this as a speed bump you have chosen, which is still worth having.

Build your script

1. Which computer?

You will run this in PowerShell as an administrator.

2. Sites to block

One per line. Just the domain. The script adds both the bare domain and its www. form for you.

3. Options Lock the file afterwards so a standard user cannot edit it Also generate browser policy that turns off each browser's own encrypted DNS

The second one matters if you also use a filtering DNS service, because a browser resolving names itself walks straight past it. It is not needed for the hosts file, which browsers respect either way.

Your script

Download the script

How to run it

Save the download as blockmyself-hosts.ps1.
Click Start, type PowerShell, right-click it and choose Run as administrator.
Run it: powershell -ExecutionPolicy Bypass -File .\blockmyself-hosts.ps1
Have the trusted person type the administrator password, and make your daily account a standard account.

One Windows-specific warning. Microsoft Defender treats some hosts-file edits as a threat and, when it acts, resets the whole file rather than the offending line. It is triggered by blocking Microsoft's own domains, which this script does not do. If you later add Microsoft domains yourself, expect the file to be silently wiped at some point.

Read it before you run it. It edits one system file, takes a backup first, and marks its own section so it can be removed cleanly. The undo script below reverses it.

The script

How to undo it later

Keep this. You will want it eventually, and improvising it while frustrated is how people damage a system file.

Block a list of sites on a computer.

What this is good at, and what it is not

Its real advantage

Its real limit

Build your script

Your script

What to pair this with

On a phone instead?

Add filtered DNS

Make it hold