How to Block Websites on iPhone: 3 Methods Compared

If you've already tried Screen Time, you know how this goes. You set it up, it works, and two days later someone tells you they can still get to everything. Screen Time was designed for parents managing a child's iPad. You're asking it to be Group Policy, and it's not built for that.

Yes, you can block a website on an iPhone, three different ways, in fact. Screen Time is built into iOS, free, and works on one device at a time. DNS filtering operates at the network layer, requires no device configuration changes for basic Wi-Fi filtering, and works as a stepping stone before committing to anything more involved. MDM is the fleet-wide option: enforced, centrally managed, and the only method that cannot be reversed by the person holding the phone.

The distinction matters because each method breaks down in a different place. Screen Time only filters Safari — any other browser the user installs is completely unaffected. DNS filtering stops the moment a user hits cellular data or has iCloud Private Relay active. Supervised MDM is the only approach that survives both of those scenarios, because the user cannot remove it without admin access.

This guide covers all three: step-by-step Screen Time setup (including the Safari-only gap and how to close it), DNS filtering and its real-world failure modes, the supervised-versus-unsupervised device split that determines what you can actually enforce, and a comparison table across every meaningful criterion. Both personal and business use cases are addressed. If you're on an iPad, the steps are identical.

TL;DR

What Web Filtering on iPhone Actually Does (and What It Doesn't)

Web filtering on iOS works by intercepting navigation requests. When a user tries to visit a blocked URL, the browser shows a blocked-content screen instead of the page. That's the whole mechanism — it acts at the point of navigation, not before it.

What it does not do: it does not remove a site from Google search results (they still appear), it does not block content inside apps (Instagram's built-in browser, Reddit's in-app browser, and similar in-app web views are all unaffected), and it does not encrypt or monitor traffic. Blocked sites still show up in search results — the filter catches the navigation attempt, not the appearance in a results list.

There are three layers where filtering can happen on iOS: device-level controls (Screen Time), network-level controls (DNS filtering), and management-level controls (MDM). Think of them as three independent layers you can stack, not three names for the same thing.

One more note before the how-to: everything in this article applies equally to iPad. Any time it says iPhone, iPad owners follow the exact same steps.

Three Methods to Block Websites on iPhone

The three methods for how to block websites on iPhone each work at a different layer — and each breaks down in a different place. Screen Time is fast and free but scoped to a single device. DNS filtering requires no device access for basic setup but has several real-world gaps. MDM is how to block site in iPhone across a fleet, with controls that the user cannot undo on a supervised device.

Each section below opens with when the method is the right call and when it falls apart — before the steps. Knowing where something breaks down is more useful than steps alone.

Method 1: Screen Time (Built-In, Free, Single Device)

When to use it: Personal device, family use, or a single work iPhone where you control the Apple ID and the device passcode. No additional software required.

When it breaks down: More than five or six devices (per-device manual setup becomes unmanageable), BYOD devices (employees can remove it), or anywhere you need settings to survive every iOS point release reliably.

Here's how to block a website on iPhone using Screen Time, and how to block websites on Safari on iPhone specifically:

1. Settings → Screen Time → turn on Screen Time
2. Set a Screen Time passcode — keep it separate from the device passcode, and store it in a password manager immediately
3. Content & Privacy Restrictions → toggle on
4. Content Restrictions → Web Content
5. Choose: "Limit Adult Websites" (automatic filtering plus a manual denylist) or "Allowed Websites Only" (allowlist — blocks everything except sites you explicitly approve)
6. Under "Limit Adult Websites": tap "Add Website" under "Never Allow" to block specific sites. This is how to block specific websites on iPhone and how to block certain websites on iPhone using a custom denylist.
7. Under "Allowed Websites Only": tap "Add Website" under "Always Allow" to approve only the sites users can reach

This path covers how to restrict websites on iPhone and how to block inappropriate websites on iPhone for a child or a school-issued device. It's also the standard path for how to block a website on Safari iPhone using iOS's built-in tools.

The Safari-only problem — and the fix: Screen Time's web content filter applies to Safari only. Chrome, Firefox, DuckDuckGo, and any other browser a user installs are completely unfiltered. This is the single most common Screen Time deployment failure. A user sets "Allowed Websites Only" in Safari, confirms it works, and then opens Chrome to reach every blocked site without restriction.

The fix has two parts. First, go to Content Restrictions → Apps and set the age rating to exclude third-party browsers, or block individual browser apps. Second, note that in-app browsers inside social media apps (Instagram, Reddit, and others) are also not filtered — the only way to block those is to block the parent app entirely. For step-by-step instructions on blocking apps alongside web filtering, see how to block an app on iphone.

Passcode advice: Use a random six-digit code you'll never guess from memory. Store it in a password manager before the device leaves your desk. On iOS 17+, there is no Apple ID recovery path for a forgotten Screen Time passcode — Apple removed that recovery option by design.

iOS 17 version note: Prior to iOS 17, a user could reset the Screen Time passcode using their Apple ID without admin involvement — a well-documented bypass vector. As of iOS 17, Apple closed this. Devices running iOS 16 or earlier should be updated before you rely on the Screen Time passcode for any meaningful enforcement.

Troubleshooting: If a user can still access blocked sites after you've set the web content filter, check whether a third-party browser is installed first — that's the cause in the majority of cases.

Method 2: DNS Filtering (Network-Level, No Device Configuration Required for Wi-Fi)

When to use it: You want to filter content across multiple iPhones without supervised mode. DNS filtering and blocking websites on iPhone at the network layer is a practical stepping stone before committing to MDM, or for a trusted team where strict enforcement isn't the requirement.

When it breaks down: How to block access to a website on iPhone via DNS is more fragile than it appears. Four specific failure modes:

• Cellular data bypasses Wi-Fi DNS filtering completely. The moment a user turns off Wi-Fi, filtering stops.
• iCloud Private Relay (active by default on iCloud+ accounts, iOS 15+) encrypts DNS queries and routes them through Apple's relay servers — your DNS filter never sees them. This is a silent failure: the filter appears to work on test devices and stops working on iCloud+ devices without any visible error.
• A manually installed DNS configuration profile can be removed by the user at any time via Settings → General → VPN & Device Management.
• A free VPN app overrides DNS settings entirely.

The fix for cellular: Push the DNS-over-HTTPS profile via MDM using the com.apple.dnsSettings.managed payload. This makes the DNS config managed and keeps it active on cellular — but it requires MDM, which leads directly to Method 3.

The fix for iCloud Private Relay: On managed devices, you can disable Private Relay via an MDM restriction profile. Without MDM, you can only ask users to turn it off manually — which they can reverse. Disabling Private Relay for DNS filtering compliance also removes the enhanced browsing privacy that feature provides for the user's other traffic. On company-owned supervised devices, this is an IT policy decision — and MDM gives you the central control to make and enforce it consistently, rather than relying on individual users to configure it themselves.

Practical setup for a small team: DNS filtering services that support iOS DoH profile generation let you generate an iOS .mobileconfig profile from a dashboard and push category-level blocking across devices — but on unmanaged devices, employees can remove this profile at any time. It works for a trusted team where you need a best-effort filter; it is not an enforcement layer.

Troubleshooting: If DNS filtering stops working after initially working, check whether iCloud Private Relay is enabled on the affected device — that's the most common silent failure mode.

Method 3: MDM (Fleet-Wide, Enforced, Scales to Any Number of Devices)

When to use it: You have multiple company-owned iPhones, need settings that cannot be bypassed, and cannot manually configure each device every time an iOS update ships. This is the right method if you're managing a fleet.

When it breaks down: On BYOD (employee-owned) devices. An employee can unenroll from an unsupervised MDM profile at any time — you can push a profile, but they'll just unenroll themselves in Settings.

MDM handles things Screen Time and DNS cannot:

• Pushes iOS restriction policies to every enrolled device simultaneously — no per-device login required
• Changes apply across the fleet from a single dashboard
• On supervised devices: the profile cannot be removed by the user
• Centralized compliance visibility across all enrolled devices

The supervised device requirement: Full MDM restriction enforcement requires supervised devices. Supervision cannot be enabled over the air on a device that's already been activated — it requires either a factory reset plus ABM enrollment, or a USB setup via Apple Configurator 2.

If devices were already distributed before MDM enrollment: unsupervised enrollment is possible over the air and gives you partial controls, but employees can remove the profile. The practical answer is to treat supervision as an onboarding decision — enroll new devices before distributing them. The organizational moment to do it right is before a device leaves your hands.

ABM is free: Apple Business Manager is available at no cost at business.apple.com. MDM software (the management layer that sits on top) has per-device costs, but ABM itself costs nothing. This surprises many SMB admins who assume any Apple enterprise tool requires a paid Apple program.

Timing note: ABM enrollment requires organization verification, which takes one to three business days. If you're on a two-to-four-week timeline, start ABM verification before anything else.

The only way to block websites on iPhone permanently — meaning the restriction cannot be reversed by the user — is supervised MDM enrollment. That's not a caveat; it's the answer to why every other method eventually fails for a determined user.

One pre-deployment step worth confirming: Get a signed acceptable use policy in place. It takes the organizational ambiguity out of any content restriction decision and gives IT a clean mandate to act on.

Supervised vs. Unsupervised Devices: What You Can Actually Enforce

Company-owned device or employee-owned? That question determines what you can actually enforce, and it matters before you spend time configuring anything.

Unsupervised (user-enrolled or BYOD):

• MDM profile can be removed by the user at any time via Settings
• Limited restriction set available — many controls silently fail to apply
• No enforcement of web content filtering that the user cannot undo

Supervised (company-owned, enrolled via ABM or Apple Configurator 2):

• Full restriction set available
• Profile cannot be removed without wiping the device
• Web content filtering policies are persistent and cannot be reversed by the user

As of iOS 16, supervised mode cannot be enabled over the air on a device that has already been activated. This remains true through iOS 18. Supervision requires either a factory reset with ABM enrollment, or USB setup via Apple Configurator 2. Devices already in users' hands cannot be supervised without going through that process.

If you want to block websites on iPhone without Screen Time — in a way that actually sticks — supervised MDM is the path that enforces it. Everything in this section applies equally to iPad: supervised iPads follow the same enrollment path through ABM.

If devices are employee-owned, your options are limited — the cleanest path is company-owned, supervised devices enrolled through ABM. For Apple-focused organizations, a solution with native Apple Business Manager integration — like apple device management at Trio MDM — handles supervised enrollment and policy deployment from a single dashboard.

Frame supervision as a one-time onboarding workflow decision, not ongoing work. The moment to get it right is before devices leave your hands — not after employees have been using them for six months.

How Trio MDM Helps You Block Websites Across an iPhone Fleet

For the MDM path to work as described above — supervised enrollment, fleet-wide policy enforcement, restrictions users cannot remove — you need an MDM platform. Trio MDM is built for exactly that workflow.

Manually configuring Screen Time on 20 iPhones takes hours — and any iOS point release can reset your work and send you back to the start of that queue. When the question is how to block websites on iPhone at fleet scale, the answer starts with a platform that pushes restriction policies to every enrolled device from one dashboard, with no per-device login required.

Trio MDM integrates directly with Apple Business Manager, supporting zero-touch enrollment via Automated Device Enrollment (DEP). New iPhones can be enrolled and configured automatically when they're first activated, before they ever reach an employee's hands.

For devices not already in ABM, Trio MDM supports supervised iOS enrollment via Apple Configurator 2 (USB method) and QR code enrollment for quick onboarding. That covers both scenarios: new devices coming in through ABM and existing devices you need to bring under management.

Trio MDM's Device List gives you a centralized inventory of every enrolled iPhone — compliance status, enrollment status, last check-in, and policy assignment — from a single hub. From the same dashboard, Trio MDM manages enrollment status, compliance visibility, and policy deployment across every enrolled device.

IT admins frequently ask how do you block apps on an iPhone across a full fleet — and how to block apps on iPhone sits alongside every other device policy in the same Trio MDM dashboard. For mixed-device organizations managing iPhones alongside Windows, Mac, Android, and Linux devices, Trio MDM operates as a unified endpoint management solution — one platform, every platform your organization runs on.

If you're ready to move beyond per-device Screen Time setup, start your free trial or book a demo to see how Trio MDM handles supervised enrollment and fleet-wide policy management for iOS.