Portcullis — layered porn blocking you can't undo on a whim

Why one blocker isn't enough

Every blocker has a hole. A browser extension is removed with two clicks. A DNS filter is switched off in settings. A hosts file is edited by anyone who can type sudo. On its own, each one stops you for about forty seconds.

Layering changes the arithmetic. To get through, you have to defeat all of them, each needing a different trick, while a part of you is already arguing that this is stupid and you should stop. That argument is the thing we're buying time against — most urges fade within about twenty minutes if you don't act on them.

What each layer actually does

Layer	Covers	Getting past it
Hosts file 76,000+ adult domains	Every browser and every app on the computer — Safari, Chrome, Firefox, anything	Admin password, then a 48-hour wait
Browser policy Top 1,000 by traffic	Chrome and Edge, including private windows	Admin password
DNS filter NextDNS, free tier	Phone and laptop, on wi-fi and mobile data	Device settings, or a PIN someone else holds
App blocker AppBlock strict mode	Apps and browsers on the phone	Strict mode: PIN, charger, or a cooldown

The honest version: none of this is unbreakable, and anyone who tells you their blocker is unbreakable is selling something. You own the machine; with enough determination you will get through. The point is that every route takes several deliberate steps and a wait, and urges don't survive that.

Install it

Step-by-step guide with screenshots → every screen you'll see, for Mac, Windows, Android and iPhone.

Start with the computer you use most. Each part works on its own, so you can stop after one layer and still be better off than before.

macOS

Use the app. It does everything below for you, and the setup guide has a picture of every screen.

Download Portcullis for Mac. It goes into your Downloads folder. Open Downloads (in Finder, or the arrow at the top right of your browser) and double-click Portcullis-Mac.zip. A Portcullis icon appears.
Drag the Portcullis icon into Applications (on the left of the Finder window), then double-click it in Applications.
macOS will say it can't open it. Click Done — not Move to Bin. Then click the Apple logo at the top left of the screen → System Settings → Privacy & Security, scroll to the very bottom, click Open Anyway and type your Mac password. You only do this once.
A page opens in your browser. Click Turn on and type your Mac password when asked. That's the block on, for every browser and app.
Click the Set up tab and follow it to lock Chrome and set up your phone.

Prefer not to use the app? Do it by hand instead

This does the same as the app using Terminal, a built-in Mac program where you type commands. You'll copy each grey box and paste it in — you don't need to understand the commands.

Download the project. Open your Downloads folder. If you see portcullis-blocker-main.zip, double-click it. You should now have a folder called portcullis-blocker-main in Downloads.
Open Terminal. Hold ⌘ Command and press Space, type Terminal, and press Return. A window with a line of text and a blinking cursor opens.
Point Terminal at the folder. Click Copy on the grey box below, click in the Terminal window, paste with ⌘ Command + V, and press Return:
```
cd ~/Downloads/portcullis-blocker-main
```
Nothing seems to happen — that's right. If it says No such file or directory, type cd and a space, drag the portcullis-blocker-main folder from Finder onto the Terminal window, and press Return.
Block it everywhere. Copy this, paste it into Terminal the same way, and press Return:
```
sudo bash mac/install-hosts.sh
```
It shows Password: — type the password you use to log in to your Mac and press Return. Nothing appears while you type — not even dots. That's normal; it's still typing. When it finishes you'll see a line saying the block is in place.
Turn on the watchdog, which puts the block back if it's removed. Copy, paste, press Return, and type your password again if asked:
```
sudo bash mac/install-guard.sh
```
Lock Chrome. In Finder, open Downloads → portcullis-blocker-main → mac, and double-click Portcullis.mobileconfig. Click OK. Then Apple logo (top left) → System Settings → General → Device Management, double-click Portcullis, click Install and enter your password. Pictures of each screen.
Check it works (optional). Copy, paste, press Return, and watch it remove the block and the watchdog put it back:
```
sudo bash mac/test-guard.sh
```
You can close Terminal afterwards.

Windows

Not yet tested on a real Windows PC. The parts that can be tested automatically are, and your settings are backed up before anything changes — but if you try it, it's a first version. Everything it does can be undone (see removing it).

Use the app. The setup guide has a picture of every screen.

Download Portcullis for Windows. It goes into your Downloads folder.
Unzip it and move it to Documents. Open File Explorer (the yellow folder on the taskbar) → Downloads. Right-click Portcullis-Windows.zip → Extract All… → Extract. A new Portcullis-Windows folder appears — drag it onto Documents in the list on the left. Keep it there; the app runs from it.
Double-click Portcullis.cmd in that folder. If a blue box says Windows protected your PC, click More info, then Run anyway.
A page opens in your browser. Click Turn on, and click Yes when Windows asks if it may make changes. If you don't see that box, it's flashing in the taskbar at the bottom of the screen.
Close Chrome and Edge completely and reopen them. Then click the Set up tab for your phone.

Prefer not to use the app? Do it by hand instead

This uses PowerShell, a built-in Windows program where you type commands. You'll copy each grey box and paste it in — you don't need to understand the commands.

Download the project. Open File Explorer → Downloads, right-click portcullis-blocker-main.zip → Extract All… → Extract.
Open PowerShell as administrator. Click the Start button, type PowerShell, and on the right click Run as administrator. Click Yes. A dark window with a blinking cursor opens.
Point PowerShell at the folder. Click Copy on the grey box below, then right-click inside the PowerShell window to paste, and press Enter:
```
cd $HOME\Downloads\portcullis-blocker-main\portcullis-blocker-main
```
If it says it cannot find path, type cd and a space, drag the portcullis-blocker-main folder that contains the windows folder onto the PowerShell window, and press Enter.
Block it everywhere. Copy this, right-click in PowerShell to paste, and press Enter:
```
powershell -ExecutionPolicy Bypass -File .\windows\install.ps1
```
It blocks the sites in every browser and app, and stops Chrome and Edge getting around it.
Turn on the watchdog, which puts the block back if it's removed. Copy, paste and press Enter:
```
powershell -ExecutionPolicy Bypass -File .\windows\install-guard.ps1
```
Close Chrome and Edge completely and reopen them. You can close PowerShell.

Phone — both platforms

DNS filtering covers every app on the phone, on wi-fi and on mobile data. It's free.

Make your own NextDNS account at nextdns.io. Free covers 300,000 lookups a month, which is plenty for one phone. Use your own account — never someone else's ID, or your browsing is recorded in their dashboard.
Parental Control → Categories → add Porn. Not the Privacy tab; that's only ads and trackers. Add any sites you personally want gone under Websites, Apps & Games.
Settings → Logs: turn logging off or set the shortest retention, unless you want the record.
Android: Settings → Network & internet → Private DNS → enter yourid.dns.nextdns.io.
iPhone: go to apple.nextdns.io in Safari, pick your profile, tap Download, then Settings → Profile Downloaded → Install.

AppBlock — the strongest phone layer

DNS filtering stops sites. It can't stop an app. AppBlock adds that, and its Strict Mode is the part that matters: once on, you can't edit your blocks, pause them, or uninstall the app until you satisfy whatever unlock you chose — a PIN, plugging in a charger, a timer, or a cooldown.

Android

Uses device-admin permission to prevent uninstall, and can block access to device settings. This is the stronger of the two implementations.

iPhone

Has "Disable App Uninstalling", but some users report it being bypassed via Screen Time. Treat it as friction, not a lock.

Set the unlock to a cooldown of several minutes rather than a PIN you know. A PIN you can remember is not an obstacle at 1am.

Is it safe? What is it actually doing?

Fair question, and you shouldn't take anyone's word for it — including mine. Here's exactly what it touches and how to check.

No account. No sign-up. No telemetry. Nothing is sent anywhere. The scripts are plain text you can read in a few minutes. The only network request in the whole project downloads a public blocklist from GitHub.

What it changes	Why	How to check
Your `hosts` file	Points blocked domains at nothing	It's a text file. Everything is between two marker comments; your own entries are left alone and backed up first.
Chrome/Edge policy	Blocks the top 1,000 sites, turns off browser DNS	Open `chrome://policy` and read every value it has set.
A background task	Puts the block back if it's removed	One small script, `guard.sh` or `guard.ps1`. It writes a log of everything it does.

What it does not do

No record of what you browse. It can't see your browsing; it only knows a blocked name was asked for.
Nothing is uploaded, and there is no server. It keeps working with the wi-fi off.
No hidden master password or backdoor. The removal path is documented below, and it's the only one.

The one real privacy trade-off

If you use the DNS layer, NextDNS sees the domains your devices look up. That is how filtering works — something has to answer the question. They're a paid-subscription business rather than an ad one, logging is optional and you choose the retention, but it is a genuine trade and you should make it knowingly. Skip that layer if you'd rather not; the rest still works.

How to remove it

Documented on purpose. A tool that hides its own exit isn't trustworthy, and you'll legitimately need this one day — a new laptop, a work machine, a changed mind.

It's deliberately slow: you ask once, wait 48 hours, then do the same thing again to confirm. The setup guide shows every screen.

Mac: open Terminal (hold ⌘ Command, press Space, type Terminal, press Return). Click Copy below, paste into Terminal (⌘ Command + V), press Return, and type your Mac password — nothing shows while you type, which is normal:
```
sudo bash /Applications/Portcullis.app/Contents/Resources/mac/uninstall-hosts.sh
```
It replies that removal has been requested and tells you when you can come back. Do exactly the same 48 hours later to finish. Changed your mind? Do it with --cancel on the end. (Set up by hand instead of with the app? Use sudo bash mac/uninstall-hosts.sh from the project folder.)
The Chrome lock comes off separately: Apple logo (top left) → System Settings → General → Device Management → click Portcullis → the − button.
Windows: click Start, type PowerShell, click Run as administrator, then Yes. Click Copy below, right-click in PowerShell to paste, and press Enter:
```
cd $HOME\Documents\Portcullis-Windows
powershell -ExecutionPolicy Bypass -File .\app\windows\uninstall.ps1
```
Do the same 48 hours later to finish — this also removes the Chrome and Edge lock. Changed your mind? Add -Cancel to the end of the second line. (Set up by hand? From the project folder, use .\windows\uninstall.ps1 in the second line instead.)
Phone: on Android, set Private DNS back to Automatic. On iPhone, Settings → General → VPN & Device Management → NextDNS → Remove Profile.

If one site you need is blocked by mistake, don't remove everything. Take it off your list in the app — or, if it's on the built-in adult list, sudo bash mac/allow-site.sh example.com from the project folder unblocks just that one after an hour.

What it can't reach

Other devices — a tablet, a work laptop, a console. Each needs its own setup.
VPNs — a VPN app doesn't defeat the hosts file, but it does defeat DNS filtering.
Content inside big platforms — Reddit, X and Telegram serve it from the same address as everything else. Blocking the whole site is the only lever.
You, if you're determined enough. It's your computer and your password. This buys you twenty minutes and a cooling-off period, not impossibility.

The layer that actually changes the ceiling isn't software. It's another person: someone who holds the Screen Time passcode, or just someone who knows you're doing this and asks how it's going. Every technical layer here is friction. A person is accountability.