How to block websites on a Chromebook. Including the loopholes.

Chromebooks are the most common school device in North America — and the most commonly misunderstood. Here's what actually blocks a site on ChromeOS, and what your child can get around in about ten seconds.

Most parents assume a Chromebook is locked down because it came from the school. It usually is — on the school network, under the school's managed account. Take it home, sign in with a personal Google account, and most of that protection evaporates.

There are four separate ways to block a website on a Chromebook. They are not equally effective, and three of them have gaps your child will find.

Option 1: Family Link supervision (built in, free)

If your child is under 13 and using a personal Google account, Family Link can restrict sites in Chrome.

1. Open the Family Link app on your phone.
2. Tap your child's profile → Controls → Content restrictions → Google Chrome.
3. Choose Try to block explicit sites, or Only allow approved sites for a strict allowlist.
4. Under Manage sites, add specific domains to block.

The gaps: "Try to block explicit sites" is Google's own SafeSearch-style heuristic — it misses a large amount of content. Family Link supervision also loosens automatically when your child turns 13, and it only governs Chrome. Any other browser installed from the Play Store on a Chromebook sidesteps it entirely.

Option 2: A Chrome extension

Blocking extensions are easy to install and easy to remove. Unless the Chromebook is enterprise-enrolled with force-installed extension policy, your child can open chrome://extensions and toggle it off, or simply use Guest mode where extensions don't load at all.

Turn off Guest browsing

On a personally-owned Chromebook, sign in as the owner account (the first account ever added to the device), then:

1. Settings → Security and Privacy → Manage other people.
2. Turn off Enable Guest browsing.
3. Turn on Restrict sign-in to the following users and list only your child's account.

On a school-managed Chromebook you can't change this — the school's admin console owns the setting.

Option 3: Block at the network level

Router-level DNS filtering catches every device on your Wi-Fi, including the Chromebook, regardless of browser or profile. It's the strongest home-network option and it costs nothing beyond setup time.

The limitation is obvious: it stops at your front door. Coffee shop Wi-Fi, a friend's house, a phone hotspot — none of it is covered. For a device your child carries between home and school, network filtering alone is half a solution.

Option 4: Device-level DNS filtering (what we'd do)

The approach that survives all of the above is filtering DNS on the device itself, so the block travels with the Chromebook.

Defenras handles this two ways on ChromeOS:

• The Defenras Chrome extension — blocks in Chrome directly, and can be pinned so removal requires your PIN.
• Defenras on the Android layer — most modern Chromebooks run Android apps. Installing Defenras from the Play Store sets a device-wide private DNS profile that applies to every browser and app on the machine, Guest mode included.

Because the filtering happens at the DNS layer, there's no browsing history to collect. Defenras never sees which sites your child visits — it only answers "is this domain on the blocklist?" and refuses to resolve it if so.

What to do in what order

1. Disable Guest browsing and restrict sign-in to your child's account. Five minutes, closes the biggest hole.
2. Install Defenras on the Chromebook and PIN-lock it.
3. Add Family Link on top if your child is under 13 — the screen time limits are genuinely useful even though the content filtering is weak.
4. Set your router's DNS as a backstop for every other device in the house.