How to Block Adult Content on All Devices: The 3-Layer System That Actually Works

Suppose you set up parental controls on your child's iPhone — Screen Time on, restrictions enabled, web filtering active. You feel like you've handled it. Then one afternoon you find out they've been watching things on their iPad using a Safari Private tab, or through a friend's account, or on the school Chromebook that doesn't have your settings. And now you're back at the beginning, except it's not the beginning anymore.

This scenario plays out in most families that rely on a single layer of content filtering. The problem isn't that the tools don't work. They do — partially. The problem is that each tool covers a different surface, and the gaps between surfaces are exactly where content gets through.

Blocking adult content effectively requires three overlapping layers: device-level controls (settings on each phone, tablet, and computer), network-level filtering (DNS configuration at your router, which covers every device on your Wi-Fi), and the conversation layer (because no technical system holds indefinitely without the child understanding why it exists). Each layer has weaknesses. Together, they close most of the gaps.

Here's how to set up all three — starting with what takes the longest to bypass and working outward to what catches the rest.

Layer 1 — Device-Level Controls (Apple Screen Time)

For iPhone and iPad, Apple's built-in Screen Time is the starting point. It's free, reasonably comprehensive, and integrated deeply enough into iOS that it can't be disabled by someone who doesn't know the Screen Time passcode.

To set it up: Go to Settings > Screen Time. If it's your child's device, tap This is My Child's [Device] during setup, or set a Screen Time passcode under Use Screen Time Passcode. The Screen Time passcode must be different from the device passcode — otherwise your child can change the settings themselves.

Under Content & Privacy Restrictions, enable the toggle, then tap Content Restrictions > Web Content. You have three options: Unrestricted Access, Limit Adult Websites, and Allowed Websites Only. For younger children, use Allowed Websites Only — a whitelist of sites you explicitly approve. For teenagers, Limit Adult Websites uses Apple's content classification to block known adult domains while allowing general browsing.

Also set App Store restrictions. Under Content Restrictions > Apps, you can limit which age-rated apps are visible and downloadable. For under-13, set to 4+ or 9+. For teenagers, 12+ is reasonable; 17+ apps include many social platforms and games you may not want.

For Mac: Open System Settings > Screen Time, enable it, and set a Screen Time passcode. Under Content & Privacy, the same Web Content options are available. This covers Safari — but not other browsers, which is why this layer alone isn't enough.

The weakness of device-level controls: They apply per device and per browser. A child who installs a third-party browser, uses Private mode aggressively, or accesses a different device entirely can often work around them. That's what Layer 2 is for.

Layer 2 — Network-Level Filtering (DNS at the Router)

DNS filtering works differently from device-level controls. Rather than restricting what a specific device can see, it changes how your entire home network resolves domain names — so that when any device on your Wi-Fi tries to access an adult site, the lookup fails at the network level, before any content is loaded.

This approach covers every device on your network simultaneously: iPhones, iPads, Macs, Windows laptops, gaming consoles, and smart TVs. You don't have to configure each device individually. You configure the router once.

Two free options that don't require technical expertise:

Cloudflare Family (1.1.1.3 / 1.0.0.3): Cloudflare's family-safe DNS resolvers block malware and adult content by default. In your router's admin panel (usually accessible at 192.168.1.1 or 192.168.0.1), find the DNS settings under your WAN or Internet configuration and replace the default DNS addresses with 1.1.1.3 (primary) and 1.0.0.3 (secondary). Save and restart the router.

OpenDNS FamilyShield (208.67.222.123 / 208.67.220.123): OpenDNS has offered free family DNS filtering since 2010. It blocks pornography, proxies, and anonymizer tools by default — the last category being important because it prevents children from using VPNs to bypass filtering. Configuration is the same as above: replace your router's DNS entries with these addresses.

The weakness of DNS filtering: It only covers your home Wi-Fi. A child on cellular data (4G/5G) bypasses the router entirely. This is where the device-level Screen Time controls close the loop — specifically, the Cellular Data restrictions in Screen Time, which let you disable cellular access to specific apps or browsers entirely.

Layer 3 — Third-Party Parental Control Apps

For families who want deeper monitoring, AI-based image filtering, or cross-platform management without router access (renters, families using school-managed devices), third-party parental control apps add coverage that Apple's built-in tools don't provide.

Canopy is the strongest option specifically for content filtering. Unlike URL-based blockers, Canopy uses machine learning to analyze images in real time — including images loaded inside apps like Safari, Instagram, or messaging apps. It catches explicit content that comes through non-web channels. It's available for iPhone, iPad, Mac, and Android. We covered it in more depth in our Canopy app review.

Bark takes a different approach: instead of hard-blocking content, it monitors text messages, email, and social platforms for signs of cyberbullying, self-harm ideation, or explicit content, then sends parents an alert. It's less restrictive and more suitable for teenagers who need some privacy but whose safety you're still watching for. Bark doesn't read every message — it looks for patterns — which makes it less invasive while still catching warning signs.

Circle manages content and screen time at the router level, with a dedicated hardware device that gives you per-device, per-app control over what each family member can access and when. It's more granular than DNS-only solutions and works on cellular through a companion app. It's also paid ($9.99/month after a hardware purchase), which moves it into a different tier from the free options above.

The right choice depends on your child's age and what you're protecting against. For younger children, Canopy's content filtering is the most thorough. For teenagers, Bark's monitoring-without-overreach approach often generates less resentment while still catching serious issues. Layer these on top of DNS filtering, not instead of it.

The Conversation Layer — What No App Can Replace

Technical controls work well until a motivated teenager decides to work around them. And a sufficiently motivated teenager, with access to the right friends or the right YouTube video, can usually find a way around any single layer of filtering.

Common Sense Media's research consistently finds that teens whose parents have ongoing conversations about digital media — not one-time talks, but regular, non-confrontational check-ins — are more likely to make safer choices online, even when they're in environments their parents can't control. The restrictions aren't just for when they're at home. The goal is to build judgment.

That conversation is harder for many parents than setting up DNS, but it's the only layer that travels with the child. Pew Research found that 35% of teens report using social media "almost constantly" — a figure that reflects how thoroughly phones are integrated into adolescent social life. Blocking content without context creates resentment, not understanding.

The conversation doesn't have to be formal. It can be: what do you see when you're on TikTok? What do your friends share? Are there things that make you uncomfortable? What would you do if you saw something that bothered you? These questions open the channel, and an open channel is what makes the technical controls actually work — because a child who trusts the conversation is more likely to come to you when a filter fails than to hide behind it.

For older teens who are developing their own relationship with social media, the goal shifts from protection to building intentional habits. This is where tools like Sip & Scroll fit in — not as a parental enforcement mechanism, but as something a young person chooses for themselves when they want to be more deliberate about how much time they spend scrolling. The selfie and sip ritual isn't a restriction. It's a pause that converts a reflex into a choice. Teenagers who arrive at that choice themselves tend to keep it.

Putting It Together

The 3-layer approach looks like this, stacked:

• Device level: Screen Time on every Apple device, with a passcode your child doesn't know. Web Content set to Limit Adult Websites (or Allowed Websites Only for younger children). Cellular access restricted for browsers on younger children's phones.
• Network level: Router DNS set to Cloudflare Family (1.1.1.3 / 1.0.0.3) or OpenDNS FamilyShield. This catches any device on your home Wi-Fi, including guests' phones and gaming consoles.
• App layer (optional): Canopy for real-time image filtering, Bark for teen monitoring without overreach, or Circle for router-level management with cellular coverage.
• Conversation layer: Regular, non-confrontational check-ins about what they're seeing and what they think about it. This is what makes all the other layers stick.

No combination eliminates all risk. But each layer closes a different gap. The device level catches the default paths. The DNS level catches everything on your network regardless of device. The app layer adds AI-based image detection that URL blockers miss. And the conversation layer is the only one that follows your child to their friend's house, to school, and eventually to adulthood.

Set up what you can today. Add layers as your child gets older and the risks evolve. And remember that the goal isn't a perfect cage — it's a scaffold that gives them time to develop the judgment to not need one.