Most guides to blocking websites on Linux stop at "add a line to /etc/hosts". That works, but it didn't help me much, because the person I was trying to stop was me. These are the things I tried or looked at over the years, what each was good for, and where each one gave way.
Editing /etc/hosts
This is where I started. A line like this in /etc/hosts sends the site nowhere:
0.0.0.0 twitter.com
0.0.0.0 www.twitter.com
It works on every distro and costs nothing, and the block holds until you remove it. The trouble is that removing it is easy: open the file, delete the line, and the site is back.
So I made the file immutable with chattr +i /etc/hosts. After that, even root can't edit it without first running chattr -i. It's only one more command, but on an ordinary day that extra step was often enough to make me stop and think. On a bad day it wasn't.
From there it grew into a pile of small shell scripts that made the block more annoying to undo: putting the lines back if they disappeared, setting the flag again, and so on. It helped, but every script could be undone by the same person who wrote it.
You'll also need to list every subdomain yourself, and browsers that use DNS-over-HTTPS skip the hosts file entirely unless you turn that off.
Good for: a quick, permanent block on a few sites.
A DNS filter (Pi-hole, NextDNS, OpenDNS)
These block domains for every device on the network, and they come with large ready-made blocklists, including adult content. NextDNS can apply rules on a schedule. I used OpenDNS for a while, and we run Pi-hole at home now. The setup takes some effort, but it's worth it.
A filter only works while traffic goes through it, though. On a laptop, changing the DNS server, or connecting from somewhere else, gets around it. And since most of these are built for blocking ads, nothing stops you from switching the filter off.
Good for: blocking across a household, or a whole category of sites.
Browser extensions (LeechBlock NG and others)
I looked at LeechBlock NG, which runs in Firefox and Chrome. It can block by schedule, limit time per site, and show a delay page before a site loads. It's the most flexible option for the sites themselves.
But it only covers the browser it's installed in. An incognito window, another browser, another profile, or two clicks in the add-ons menu, and the blocks are gone. It can't do anything about desktop apps either.
Good for: gentle limits when a nudge is all you need.
Blocker apps for Linux
There are a few open-source apps for this, such as Open Turkey and Focuser. They combine the hosts file, browser policies and killing processes, put things back if you undo them, and some make you pass a typing challenge before you can turn them off.
The commercial blockers mostly don't run on Linux. Cold Turkey has no Linux version, and Freedom is only a browser extension there. Plucky does run on Linux; it's free but closed source, and you set it up from the terminal. I tried it before building my own, and it didn't fit my Linux and Firefox setup well.
The gap they all share is root. If you can run sudo, you can stop the service, edit the files or uninstall the app, so any of them can be undone in a minute when you really want to.
Good for: blocking sites and apps on a schedule, if you trust yourself to leave it on.
Accountability software
Accountable2You runs on Linux. It reports your activity to a partner rather than blocking anything. I tried it too, and like Plucky it didn't suit my setup. It also needs an X11 session; under Wayland, which is now the default on Ubuntu and Fedora, its monitoring is limited. Covenant Eyes doesn't support Linux at all.
Good for: when knowing someone else will see is the deterrent.
When you need something you can't switch off
That gap, being able to switch everything off in a weak moment, is why I built glocker. It blocks sites and apps on a schedule like the apps above, and adds three things:
- It takes away my sudo during the hours I choose, so I can't stop the service, edit the hosts file or uninstall it. During my allowed hours sudo works as normal.
- Uninstalling is slow on purpose. I have to type a sentence that's revealed one character at a time, and start again if I slip.
- Someone else can notice. With the optional hosted dashboard, if glocker stops reporting, an accountability partner gets an email. The usage data is encrypted before it leaves the machine.
It runs on Debian, Ubuntu, Fedora, Arch and Omarchy, on X11 and Wayland, and it's open source. It has gaps too: it doesn't stop DNS-over-HTTPS in Firefox or in a browser it doesn't manage, or a second device. The technical notes list them. I plan to close them one by one, but it works for me as it stands.
Which one should you use?
- A nudge is enough: LeechBlock NG.
- You want to block a category across the house: a DNS filter like NextDNS or Pi-hole.
- You want sites and apps blocked on a schedule, and you'll leave it on: a blocker app.
- You know you'll switch it off in a weak moment: something that takes away sudo, like glocker, possibly with a partner who's told when it goes quiet.
Top comments (0)