Block websites on Windows 11. Four methods, ranked.

Windows gives you more ways to block a website than any other consumer OS, and most of them are trivially reversible by anyone with an admin account. Here's the ranking that matters.

Before anything else: give your child a standard account

This is the step that determines whether everything else works. If your child's Windows account is an administrator, they can undo every method below.

1. Settings → Accounts → Other users.
2. Select your child's account → Change account type.
3. Set to Standard User.
4. Confirm your own account has a password that isn't blank.

Method 1: Microsoft Family Safety (built in, free)

1. Go to family.microsoft.com and add your child's Microsoft account.
2. Open their profile → Content filters → Web and search.
3. Turn on Filter inappropriate websites.
4. Add specific sites under Blocked sites, or use Only use allowed websites.

The catch: Microsoft's web filtering only works in Microsoft Edge. Turning it on automatically blocks other browsers from launching — which sounds thorough until your child installs a portable browser that runs from a folder without installing.

Method 2: The hosts file

Free, immediate, and easy to reverse.

1. Open Notepad as administrator.
2. Open C:\Windows\System32\drivers\etc\hosts.
3. Add a line per site: 127.0.0.1 example.com and 127.0.0.1 www.example.com.
4. Save and flush the cache: ipconfig /flushdns in Command Prompt.

Realistically: this is a speed bump. It needs a line per subdomain, doesn't handle sites reachable by IP, and any admin user can delete the lines. It also doesn't scale — a real adult-content blocklist is millions of domains.

Method 3: Router-level DNS

Covers every device in the house including the PC, and can't be changed from the PC itself. Its limits are the usual ones: home network only, and a laptop that leaves the house leaves the filter behind.

Method 4: DNS filtering on the device

The version that travels with a laptop and covers every browser.

On Windows, Defenras runs as a browser extension for Chrome, Edge, and Firefox, backed by a system-level DNS configuration. Practically:

• Blocklists cover adult content, gambling, vaping, scams, and malware out of the box.
• Your own domains can be added from the parent dashboard.
• Rules follow the laptop onto any network.
• Removing it requires the parent PIN.
• No browsing history is collected — the filter is a blocklist check, not an inspection log.

Closing the Windows-specific gaps

• Portable browsers. Firefox Portable and similar run from a USB stick or Downloads folder with no install. Standard user accounts plus DNS-level filtering handle these; a browser-only blocker doesn't.
• Second accounts. Requires admin to create, which is why the standard-account step comes first.
• Safe mode. Starts with third-party services disabled. Requires the admin password to reach on a properly configured machine.
• WSL and virtual machines. On a technical teenager's PC, a Linux VM is an unfiltered computer inside the filtered one. Check whether Hyper-V or WSL is enabled if this sounds like your household.