Guide

How to close search and the AI apps on your child's iPad, Mac or PC.

Everything below is free. Start with the ten-minute change that covers every screen in the house at once, then spend twenty minutes per device closing the doors it cannot see. We are paid nothing by anybody named on this page — it is just written down in the order it actually goes.

First, one decision

Name what they may reach, not what they may not.

This is the whole guide in one line, and it is the step people skip. A blocklist is a list you will be adding to for the rest of your child's childhood; an allowlist is a list you write once.

A blocklist compared with an allowlist On the left, a blocklist naming chatgpt.com, gemini.google.com, claude.ai and google.com, with more arriving behind it. On the right, an allowlist naming app.gnappo.app and the school's site, with everything else refused. BLOCKLIST chatgpt.com gemini.google.com claude.ai google.com …and whatever launched last week a list with no end ALLOWLIST app.gnappo.app your school's site the reading app they use everything else refused, including the ones that do not exist yet a list you write once

Under about twelve, use the allowlist. There is no real argument for anything else. Over that, an allowlist starts to collide with actual schoolwork — a teacher links to a site nobody anticipated, a project needs three sources — and the honest trade is a blocklist plus the knowledge that it leaks. If you go that way, § the names to block is the starting list, and you will be adding to it.

The fastest version

One setting on the router, and every screen in the house is covered.

A filtering DNS service is the phone book your home asks before it can reach anything. Point your router at one that refuses to look up the names you have told it to refuse, and the iPad, the laptop, the games console and a visiting friend's phone are all behind it at once. Ten minutes, free, and nothing to install.

How a filtering DNS sits between the house and the internet An iPad, a laptop and a phone all ask the router; the router asks the filtering DNS, which allows app.gnappo.app through and refuses chatgpt.com — refusing it for the installed app as well as for the browser. iPad laptop console filtering DNS set once, on the router app.gnappo.app ✓ chatgpt.com ✕ refused for the app as well as the browser

Which one to use

We have no relationship with any of these and are paid nothing by them. They are listed because they are free, they are what this job actually needs, and they differ in one way that matters.

NextDNS — the one that fits this page

Free up to a generous monthly limit; you make an account. It carries a named list of services you switch off — ChatGPT, Gemini, Claude and the rest are on it — plus forced SafeSearch, a block on the proxy and VPN sites children use to get around filters, and your own list of domains. And it installs as a profile on the device, so a laptop stays filtered at a friend's house and a phone stays filtered on mobile data.

Cloudflare for Families — the ten-second one

Put 1.1.1.3 and 1.0.0.3 in your router's DNS boxes. No account, nothing to manage, free forever. ⚠️ It filters adult content and malware. It does not block ChatGPT and it does not block Google. A good floor under the house; not the thing this page is about, and worth knowing before you set it and stop.

AdGuard DNS, Control D, OpenDNS

The same shape as NextDNS and all with usable free tiers: categories you toggle, a list of your own, and a device profile. Pick on which dashboard you find easier to read — you will be back in it the first time a teacher sets homework on a site you blocked.

Setting it

  1. Open your router's admin page and change the router password first.

    Usually 192.168.1.1 or 192.168.0.1 in a browser, and the password is often still printed on a sticker underneath. A child who can reach that page can undo everything below in one click, and a great many of them know it.

  2. Find the DNS boxes and replace what is in them.

    They live under Internet, WAN or DHCP depending on the make. Put your chosen service's two addresses in, save, and restart the router. Every device that joins the wi-fi from then on uses it without being touched.

  3. Or skip the router and install the device profile instead.

    NextDNS, AdGuard and Control D all offer one for iPhone, iPad, Mac, Windows and Android. It is a few more minutes per device and it is strictly better: it follows the device off your wi-fi, onto mobile data, and to every house it visits.

  4. Add the names, or switch the categories on.

    The § names to block below is the starting list. On NextDNS and its equivalents you can toggle most of them as named services instead of typing hostnames, which is one fewer thing to keep up to date.

Four ways round it, and you should know all four before you rely on this. A browser with DNS-over-HTTPS turned on does its own lookups and walks straight past a router setting — Chrome and Firefox both can, which is the single biggest hole here and the reason the device-profile route above is worth the extra minutes. Mobile data does not touch your router at all. A VPN app replaces your DNS wholesale, which is why blocking the VPN and proxy category matters as much as blocking the assistants. And blocking a domain blocks all of it — refuse google.com and Classroom, Docs and Drive go with it, so block the assistant hostnames rather than the whole company.

So do this first, and then still do the steps below. DNS cannot stop a new app being installed, cannot do a clean allowlist on a young child's iPad, and cannot survive a browser that resolves names itself. The two layers together are what actually holds: the router or the profile catches everything on every screen, and Screen Time or Family Safety closes the doors the router cannot see.

iPad and iPhone

Screen Time, in six taps.

Written against iPadOS and iOS 18. If a menu name has moved, Apple's own page is linked at the foot of this section and it is the one to trust.

  1. Settings → Screen Time.

    If you have never set it up, turn it on and choose This is My Child's iPad. If it is already on, go straight to the next step.

  2. Set a Screen Time passcode — a different one from the device passcode.

    This is the single most important tap on the page. A child who knows the passcode that unlocks the iPad knows the passcode that undoes everything below. Use four digits they have never seen you type, and give Apple a recovery email while you are there.

  3. Content & Privacy Restrictions → turn it on.

    Nothing below it works until this is on.

  4. Content Restrictions → Web Content → Allowed Websites.

    The list arrives with a handful of Apple's own suggestions. Delete the ones your child does not need, then Add Website for each one they do — app.gnappo.app, the school's site, anything a teacher actually sets. Everything not on the list is refused, including sites that do not exist yet.

  5. Still under Content Restrictions: set Installing Apps to Don't Allow.

    Without this the whole thing comes apart in ninety seconds: web restrictions apply to Safari and to apps that use Apple's web view, so a browser your child downloads afterwards is a way round. No installs, no way round.

  6. Delete the browsers and AI apps that are already on it.

    Chrome, Firefox, and the ChatGPT, Gemini, Claude, Copilot, Perplexity and Meta AI apps if any are there. Blocking a website does not remove an app that is already installed and signed in.

Apple's own instructions: Use parental controls on your child's iPhone, iPad and iPod touch.

Mac

The same switches, plus one that matters more.

Written against macOS Sequoia. On a Mac the account your child uses decides whether any of this survives the afternoon, so that is where this starts.

  1. Give your child their own account, and do not make it an administrator.

    System Settings → Users & Groups → Add Account, and leave it as Standard. A child with administrator rights can turn off everything below and there is no setting that stops them. If they are already using the admin account, this step is the whole job — move them.

  2. Log in as them, then System Settings → Screen Time.

    Or set it from your own account through Family Sharing, if your child has an Apple Account in your family group.

  3. Lock Screen Time Settings, with a passcode they do not know.

    Same rule as the iPad, same reason.

  4. Content & Privacy → Content Restrictions → Access to Web Content → Allowed Websites Only.

    Then add app.gnappo.app and the handful of others they genuinely need.

  5. Remove Chrome, Firefox, Edge and any desktop AI app.

    Apple's web filtering covers Safari. A second browser sitting in Applications is a door beside the one you just locked — and on a Mac your child cannot reinstall it without an administrator password, which is exactly what step one bought you.

Apple's own instructions: Set up Screen Time on Mac.

Windows PC

Microsoft Family Safety, set from your own phone.

Written against Windows 11. Most of this happens on the web rather than on the PC, which means you can change it later without asking your child for their laptop back.

  1. Make sure your child signs in to the PC with their own child account.

    A shared account, or your account, means there is nothing to apply the rules to. Settings → Accounts → Family → Add someone, and add them as a family member.

  2. Go to family.microsoft.com and open your child's name.

    Or use the Family Safety app on your own phone. This is the console for everything that follows.

  3. Content filters → Web and search → turn on Filter inappropriate websites and searches.

    This also forces SafeSearch on and — the part that matters here — blocks browsers other than Microsoft Edge while it is on. That is deliberate on Microsoft's part: the filter is enforced inside Edge, so the other browsers are stopped rather than left as a way round.

  4. Then turn on Only use allowed sites and add the ones your child needs.

    app.gnappo.app, the school's site, and whatever else is genuinely required. Everything else is refused. There is a blocked-sites list on the same screen if you have chosen the blocklist route instead.

  5. Apps and games → block any AI or browser app already installed.

    The web filter does not uninstall a desktop app. Anything already on the machine — ChatGPT, Copilot as a standalone app, Chrome — needs blocking here or removing from the PC.

Microsoft's own instructions: Set up content filters for your family.

The other devices in the house

Android, Chromebook, and everything with no settings screen.

Android phone or Chromebook

Google Family Link, on your phone. It covers app installs, site blocking and SafeSearch in Chrome. ⚠️ If the Chromebook came from the school it is probably managed by them, in which case their settings win and Family Link may not apply at all — ask the school what is on it before assuming.

A console, a smart TV, a friend's phone

None of them have a Screen Time to set, which is exactly what § the fastest version is for: anything that joins your wi-fi is behind the router's DNS whether it has parental controls of its own or not.

If you chose the blocklist

The names to start with — and why it will not be enough.

Only for a child old enough that an allowlist gets in the way of real schoolwork. Type these in wherever your platform keeps its blocked list, and expect to add to it.

General-purpose AI

chatgpt.com · chat.openai.com · gemini.google.com · claude.ai · copilot.microsoft.com · perplexity.ai · meta.ai · grok.com · character.ai · poe.com · deepseek.com

Open search

google.com · bing.com · duckduckgo.com · yahoo.com · search.brave.com · yandex.com · ecosia.org · startpage.com

This list was accurate the day it was written and will not stay that way. New assistants launch monthly, several of the ones above answer on more than one hostname, and a child who wants around a blocklist needs one name nobody thought of. That is not an argument against doing it — it is the argument for the allowlist in § First, one decision, and for the second half of it being a product your child would rather use anyway.

Read this part

What none of this does.

Every guide like this one should end here, and most of them do not.

  • It does not reach a device you do not control.A friend's phone, a library PC, a sibling's laptop, a school Chromebook that the school manages. The rules stop at the edge of what you own.
  • It will not hold a determined fifteen-year-old forever.It is a speed bump, and speed bumps work on the ninety per cent of moments that are convenience rather than intent. Anybody promising you more than that is selling something.
  • It is not a substitute for saying why.Four in ten children say no adult has ever talked to them about using AI safely. A child who understands the reason will hold the line in the places your settings cannot reach, which is most of them.
  • And it works far better with something on the other side of it.Closing every door and leaving nothing open makes the rules the enemy. Leave one thing open that answers their questions properly, and the rest stops being a fight.

Then leave one door open.

Age-banded answers, a floor of guardrails no setting can switch off, and a written account of every day on your side of it. Gnappo is in a closed beta — tell us about your child and we will write when there is room.

Ask for a place