Block websites on a Mac. Including the Terminal gap.
macOS Screen Time is decent and its weak point is specific: a child with an administrator account and access to Terminal can reverse most of it. Here's the setup that accounts for that.
Step 1: A separate, non-admin account for your child
Sharing your account with your child means sharing your permissions. Create a standard account:
- System Settings → Users & Groups → Add Account.
- Choose Standard, not Administrator.
- Give it its own password.
- Confirm your admin account has a strong password — a standard account with the admin password is an admin account.
Step 2: Screen Time content restrictions
- Log in to your child's account (or manage via Family Sharing from your own Mac).
- System Settings → Screen Time.
- Content & Privacy → turn on.
- Content Restrictions → Access to Web Content.
- Choose Limit Adult Websites, then Customize to add specific allowed or restricted sites.
- Back in Screen Time, turn on Lock Screen Time Settings and set a passcode.
As on iOS, "Limit Adult Websites" is a heuristic. It handles the obvious and misses plenty.
Step 3: Downtime and app limits
Under Screen Time, Downtime schedules hours when only allowed apps work, and App Limits caps categories like Social or Games. Both are worth setting and both are more reliable than the web filter.
Filtering that covers every Mac browser
Defenras blocks at the DNS layer on macOS — Safari, Chrome, Firefox, and anything else installed.
Get Defenras free →Step 4: The gaps macOS leaves open
Terminal
This is the one most guides skip. Terminal can change DNS settings, edit the hosts file, and install software. On a standard (non-admin) account it can't do the privileged parts — which is exactly why step 1 comes first.
If you want Terminal gone entirely, Screen Time → App Limits lets you set a zero-minute limit on it, and Content & Privacy → App Store restrictions limit what can be installed.
Other browsers
Screen Time's web filter covers Safari well and other browsers inconsistently. Either restrict which apps can run, or filter at the DNS layer so the browser doesn't matter.
Recovery mode
Booting into macOS Recovery can reset an account password. On Apple silicon Macs you can set a Recovery Lock, but for most families the practical answer is that physical access to the machine is a limit on what software can guarantee.
Step 5: DNS filtering
Defenras on macOS runs as a browser extension across Chrome, Edge, and Firefox alongside a DNS configuration, so:
- Every browser is filtered the same way.
- Rules follow the MacBook off your home network.
- Removal requires the parent PIN.
- Nothing about the browsing is logged.
If everyone uses one Mac under one login, none of this works cleanly — your restrictions become your restrictions too. Separate accounts take ten minutes to set up and make every subsequent control meaningful. It's the highest-leverage thing on this page.
The checklist
- Child has a Standard account with its own password.
- Your admin account password is strong and not shared.
- Screen Time on, with a passcode and a recovery Apple ID.
- Web content limited; app installation restricted.
- Downtime scheduled.
- Defenras installed and PIN-locked.
Frequently asked questions
Can my child bypass Screen Time on a Mac using Terminal?
Not from a standard account — the commands that would matter require admin authentication. From an administrator account, yes. That's the whole argument for separate accounts.
Does Screen Time on Mac sync with the iPhone?
Yes, if both use the same Apple ID and Screen Time sharing across devices is enabled. Limits then apply to combined usage rather than per device.
What about Safari extensions that unblock sites?
Restrict extension installation through Screen Time's app restrictions, and rely on DNS filtering that an extension can't override.
Is a separate child account really necessary?
For any control to hold, yes. On a shared login your restrictions apply to you, and your child inherits whatever permissions your account has.
Defenras blocks all of this — without collecting your child's data.
One app, every device, every browser. Adult content, gambling, vaping, scams, malware, social media — all blocked. PIN-locked. Free version available, no credit card.