How to Block Porn on Android: Private DNS, Chrome, Samsung

Updated 2026-10-19

The most reliable free way to block porn on Android is a family-filter Private DNS. Open Settings, find Private DNS, choose the provider hostname option and enter family-filter-dns.cleanbrowsing.org or family.cloudflare-dns.com. That one setting filters every browser and most apps on Wi-Fi and mobile data, and the rest of this guide adds the layers that make it harder to undo in a weak moment.

No single setting is a wall. A filter lowers how often adult content is one tap away, and the extra steps below lower it further. If you only want a short checklist, the blocker setup guide walks through the same ideas as a tool.

Before you start: what blocking can and can't do

A block changes your phone so that adult sites don't load. It doesn't change why you reached for the phone. Many people who keep relapsing describe the same pattern: the filter holds in the daytime, and the trouble starts late, when you are tired, bored or lonely and you know exactly how to switch it off.

So plan for two jobs. The first is making access harder, which is what steps 1 to 6 do. The second is having something to do in the minutes when the urge is loud, which is covered near the end. If you are comparing every free option across phones, laptops and routers, the free porn blocker guide covers all of them. This page stays on Android.

You will need about 20 minutes, your phone, and ideally one other person (a partner, friend, parent or sibling) who can hold a PIN or password for you. Having someone else hold the lock is the single biggest upgrade to any of the setups below.

Step 1: Turn on a family-filter Private DNS

Private DNS is an Android feature (Android 9 and newer) that encrypts the lookups your phone makes whenever it needs to find a website. Family-filter providers use that lookup stage to refuse to answer for adult domains, so the page never loads. Because it works at the system level, it applies to Chrome, Samsung Internet, Firefox, in-app browsers and most apps, not just one browser.

You have two free providers to choose from. Either works, and you only enter one hostname.

CleanBrowsing Family Filter: family-filter-dns.cleanbrowsing.org. CleanBrowsing describes this filter as blocking adult sites, and its published guides say it also enforces SafeSearch on major search engines and blocks many proxy and VPN domains used to get around filters.
Cloudflare 1.1.1.1 for Families (malware and adult content): family.cloudflare-dns.com. Cloudflare lists this as the hostname that blocks both malware and adult content. Its sibling, security.cloudflare-dns.com, blocks malware only, so don't pick that one by mistake.

If you can't decide, start with CleanBrowsing for the extra SafeSearch and proxy coverage, and switch to Cloudflare if a site you need gets blocked by mistake or your connection feels slow.

On a Pixel or stock Android

Open Settings.
Tap Network & internet.
Tap Private DNS. On some versions it sits under Advanced first. If you can't see it, use the search bar in Settings and type "Private DNS".
Choose Private DNS provider hostname.
Type the hostname exactly, for example family-filter-dns.cleanbrowsing.org, with no https:// in front.
Tap Save.

Google's own help page lists the choices as Off, Automatic and Private DNS provider hostname. You want the third one.

On a Samsung Galaxy (One UI)

Open Settings.
Tap Connections.
Tap More connection settings.
Tap Private DNS.
Choose Private DNS provider hostname, enter the hostname, and tap Save.

On Xiaomi, Redmi, POCO, OnePlus, Realme, Vivo and Oppo

The setting is the same, but each brand moves it around. Common places to look:

Xiaomi, Redmi, POCO (MIUI or HyperOS): Settings > Connection & sharing > Private DNS.
OnePlus (OxygenOS): Settings > Wi-Fi & network > Private DNS.
Realme and Oppo (Realme UI, ColorOS): Settings > Wi-Fi & network (or Connection & sharing) > Private DNS.
Vivo (Funtouch OS): Settings > Other networks and connections > Private DNS.

These paths change between software versions, and we can't check every model, so treat them as a starting point. The reliable shortcut on any phone is to open Settings, tap the search box and type "Private DNS". If it still doesn't appear, your phone may be on Android 8 or older, which doesn't support the feature. In that case, skip to the router step and the Chrome and Play Store steps.

Check that it worked

Restart your browser, then visit a test page that the provider publishes for this purpose. Cloudflare's documentation names nudity.testcategory.com for adult filtering and malware.testcategory.com for malware filtering. If the page fails to load, the filter is working. If it loads, check the hostname for typos, make sure Private DNS shows "Private DNS provider hostname" rather than "Automatic", and try turning mobile data off and on again.

Step 2: Turn on SafeSearch and tidy up Chrome

Private DNS does the heavy lifting, but search results are another door, so turn on Google's SafeSearch as well.

Open Chrome and go to google.com/safesearch.
Sign in to your Google account if asked.
Choose Filter. Google's help page describes Filter as hiding explicit results.
If you see a lock icon at the top right of that page, someone else manages the setting for this account and you can't change it. For you, that is a feature: it's what a lock looks like when a trusted person holds it.

A few notes about Chrome on Android:

Chrome has no built-in adult-site blocker. The "Safe Browsing" setting protects you from dangerous sites such as phishing pages. It doesn't filter adult content, so don't rely on it for this.
Incognito mode doesn't skip Private DNS. Incognito only stops the browser saving your history. The lookups still go through your phone's DNS setting, so a family filter still applies. Many people assume private tabs get around a filter, and they don't.
Chrome's own "Secure DNS" setting can override the system one. In Chrome, look under Settings > Privacy and security for a "Use secure DNS" option. Leave it on the default, which follows your phone's setting, or choose the same family provider. If it points at a non-filtering provider, Chrome will skip your filter. The exact wording can differ by Chrome version.
Remove browsers you don't need. A browser with its own built-in DNS or VPN feature can step around the system filter. Keep one or two you trust and uninstall the rest.

SafeSearch on its own is easy to switch back, so think of it as a backup to Step 1 and not a replacement.

Step 3: Add Google Family Link, or a trusted person holding the lock

Google Family Link is Google's parental-control app. Google's help pages describe it as a tool a parent uses to manage a child's or teen's Google Account. For Chrome it offers three levels: allow all sites, try to block explicit sites, or only allow approved sites. Parents can also add specific sites to an approved or blocked list.

How you use it depends on your situation.

If you're under 18 and a parent or guardian is on your side, Family Link is the proper tool. Google's help page says a child under 18 needs a parent's approval to stop supervision. Setup happens on the supervised phone: Settings > Google > All services > Parental controls, then follow the prompts. After that, the parent changes settings from their own Family Link app. You don't owe anyone a long explanation. "I want help with screen time and late-night scrolling" is a real reason, and it's enough.

If you're an adult, Family Link isn't designed for adult self-supervision, and Google's documentation is written about parents and children. You can still borrow the idea. The principle is that someone other than you holds the password, PIN or admin access. A few ways to apply that without Family Link:

Ask a partner, friend or relative to create the PIN for your Play Store restrictions (Step 5) and keep it.
Ask them to set the password for the Google account that holds your SafeSearch lock, or to be the one who holds the recovery details.
Agree in advance what you'll do if you want to change a setting: for example, you message them, wait 24 hours, then decide.

That last rule matters more than the technology. A lock you can open in two taps at 1 a.m. is a speed bump. A lock that needs a text to another person and a day of waiting gives the urge time to fade.

Step 4: Samsung options, and the safe mode problem

Samsung phones add a few extras, and they also have a gap that people on Reddit describe.

Useful Samsung options:

Private DNS (Step 1) is the most important one. The path is Settings > Connections > More connection settings > Private DNS.
Digital Wellbeing and parental controls: Settings > Digital Wellbeing and parental controls lets you set app timers and a focus mode. These help with endless scrolling and late-night phone time more than with blocking, and the wording varies by One UI version.
Samsung Internet's own settings: if you use it, check the settings inside the browser for any custom DNS or VPN-style options, and turn off anything that would route around your filter.

The safe mode bypass. Samsung's support page explains that Safe mode is a diagnostic mode that runs the phone on its basic software and disables most third-party apps. It's meant for finding out whether a downloaded app is causing a problem. You open it from the power menu by long-pressing "Power off" and tapping "Safe mode", or by holding Volume Down while the phone starts. You leave it by restarting.

People in recovery communities describe using it to get around app-based blockers: if a blocker is a downloaded app, safe mode switches it off for a while, and some people use that window to remove it.

Here is how to make that harder to use against yourself:

Lean on system settings, not just apps. Private DNS is a system setting and not a downloaded app, so it should stay in place during safe mode. We haven't tested every phone, so confirm it yourself: turn on safe mode, try the test page from Step 1, then restart.
Don't count on a single blocker app. If your only protection is an app, safe mode is a quick way past it. Use DNS plus the other layers in this guide.
Add a person. Safe mode can't be fully disabled on a normal phone, so the practical answer is to make the next step, changing the DNS setting, something that needs a second person or a waiting period.

Nothing on a phone you own is impossible to undo. The goal is to make undoing it slow enough that you change your mind.

Step 5: Turn on Play Store content restrictions

The Play Store can have its own PIN-protected filter that limits apps, games, movies and more by age rating. It helps with the apps you might download in a low moment, such as unfiltered browsers or chat apps.

Google's help page for people managing their own account gives these steps:

Open the Google Play app and tap your profile icon at the top right.
Go to Settings, then Family, then Content restrictions.
Turn on parental controls and create a PIN.
Turn on the content type filters you want and choose how to filter or restrict access.

The important part is the PIN. Ask your trusted person to type it in, and ask them not to tell you what it is. Google also notes that these restrictions don't block restricted content that appears in search results or is reached through a direct link, so this is a layer on top of Private DNS and not a substitute.

Step 6: Set the DNS on your home router

Steps 1 to 5 protect your phone. A router setting protects every device on your home Wi-Fi, including old phones, tablets and laptops, and it is harder to change if you don't know the router password.

Find your router's address, which is usually printed on a sticker on the router (often 192.168.0.1 or 192.168.1.1).
Open it in a browser and sign in with the router's admin account.
Look for DNS, Internet or WAN settings.
Replace the DNS servers with the family-filter addresses. For Cloudflare's malware and adult content filter, Cloudflare lists 1.1.1.3 as the primary and 1.0.0.3 as the secondary. CleanBrowsing publishes its own addresses in its setup guides on its website.
Save, and restart the router if it asks.

Two practical points. First, many ISP-supplied routers, including some used for fiber broadband in India, lock or hide the DNS fields. The setting may only be in the ISP's app, or need a support request. If you can't change it, skip this step. Second, change the router's admin password and give the new one to your trusted person. A default password printed on the router's sticker defeats the purpose.

A router filter only covers the Wi-Fi it's connected to. On mobile data your phone uses its own settings, which is why Step 1 comes first.

How people get around blocks (and what makes it harder)

It's better to know the common workarounds now than to discover them at 1 a.m. None of this means you're weak. Your brain is good at solving problems, and in that moment it is pointed at the wrong one.

Turning Private DNS off. The simplest workaround is to go back to the same menu and choose Off or Automatic.

Make it harder: tell a trusted person your plan and ask them to check the setting once a week. A screenshot of the Private DNS screen sent every Sunday works well.

Installing a VPN app. A VPN sends your traffic through its own servers, which skips your DNS filter. Free VPN apps are easy to find.

Make it harder: CleanBrowsing says its family filter blocks many VPN and proxy domains, which helps. Beyond DNS, use your Play Store restrictions to limit what can be installed and ask your trusted person to hold the PIN. Android also shows which VPN is active under Network & internet > VPN, so a quick check is possible.

Using a different browser. A browser with built-in secure DNS or its own VPN can skip the system filter.

Make it harder: keep only browsers you trust, set their secure DNS option to follow the system setting, and use Play Store restrictions to limit new installs.

Switching from Wi-Fi to mobile data. If your only filter is on the router, mobile data walks right past it.

Make it harder: use Private DNS on the phone (Step 1). Cloudflare's setup page says the manual Private DNS setup applies to all networks, including cellular.

Safe mode or a factory reset. Safe mode is covered in Step 4. A factory reset removes everything, but it takes a lot of time and effort, and that pause is long enough for many urges to pass.

The pattern across all of these is the same. Each workaround takes a few minutes and a little privacy. The best countermeasure is a person: someone holding the PIN and the router password, doing a weekly check with no judgment attached. If you aren't ready to tell anyone, that's okay. Start with the technical layers and think about the person later.

When the block isn't enough: handling the urge

Filters change what's available. They don't change what you feel at 11:40 p.m. when you're worn out, scrolling, and your mind starts bargaining. Urges are often strongest at night, so it's worth reading about why you might relapse at night and planning for that window specifically.

This is where Essence comes in. To be clear about what it is: Essence does not block any websites or content. It's a recovery app that works next to the blocking steps above, not in place of them. It's available for Android and iPhone, with a free version and a paid tier.

Here is what it offers for the moments a filter can't help with:

A streak timer with widgets. Your current streak sits on your home screen and lock screen, so you see what you're protecting each time you pick up the phone.
A panic button. When an urge hits, you open the app and press it, which gives you something to do in the next few minutes instead of arguing with yourself.
A relapse log with triggers. If you slip, you can record your mood, urge level and what set it off. The aim is to understand the pattern, not to punish yourself.
Charts of when relapses happen. Over time, the statistics show the hours, moods and triggers behind your relapses. For many people that is the first time they can see it's mostly late at night, or mostly after a hard day, and plan around it.

A good routine combines both halves. The filters make the first click harder. The app gives you a next step when you feel the pull anyway. If you want your day count and milestones worked out, the streak calculator does it in your browser. You can also read how Essence compares with other recovery apps, or see what Essence is in full.

Questions

Can I block porn on Android without installing an app?

Yes. Private DNS (Step 1), SafeSearch (Step 2) and Play Store content restrictions (Step 5) are all built into Android and Google's services, and the router step needs only your router's settings page. You don't have to install anything, which also means there is no blocker app for safe mode to switch off.

Does Private DNS work on mobile data?

Yes. Private DNS is a phone-wide setting, so it applies on Wi-Fi and on mobile data. Cloudflare's setup page says the manual Private DNS setup applies to all networks, including cellular. A router-level filter, by contrast, only covers the Wi-Fi it's connected to.

How do I stop Private DNS from being turned off?

You can't lock the setting itself on a normal phone, so you make it costly to change. Ask a trusted person to check it weekly, hold the Play Store PIN and the router password, and agree a waiting-period rule before any setting is changed. If you're under 18, Google Family Link lets a parent manage controls from their own device.

Does Samsung's safe mode bypass my blocker?

Safe mode switches off most downloaded apps, so an app-based blocker can stop working in it. Private DNS is a system setting and should stay on, but test this on your own phone. Samsung describes safe mode as a diagnostic tool and says you leave it by restarting. Because you can't disable it, the best protection is having someone else involved in any change.

Which is better, CleanBrowsing or Cloudflare for Families?

Both are free and both are set up the same way. CleanBrowsing's Family Filter is described as also enforcing SafeSearch and blocking many proxy and VPN domains. Cloudflare's family option blocks malware and adult content. Try one for a week and switch if sites you need are blocked or your connection feels slow.

Will this block everything?

No. DNS filters can miss new or unlisted sites, and they don't filter images that appear inside social media apps and feeds, which many people name as a trigger. Think of blocking as a way to cut down accidental and impulsive access, and pair it with changes to your feeds and your late-night routine. The free porn blocker guide goes through more options, and the iPhone version of this guide covers Screen Time if you use both platforms.

I keep getting past my own block. Is something wrong with me?

No. Getting around a rule you set for yourself, when you are tired or low, is a very common part of recovery. It usually means the plan needs another layer, such as a person or a new evening routine. If shame or distress feels heavy, or you ever feel unsafe, please contact a mental health professional or a local crisis line.

Sources

Get Essence free on Android and iPhone.

Download on theApp Store Get it onGoogle Play