Guide
How to block adult content on a Windows PC so it stays blocked
A browser extension you installed yourself is gone in one click. A DNS setting you can change is not a limit, it is a suggestion to yourself. The Windows client works differently on purpose: it runs as a local DNS proxy that starts with the machine, and — once you add a partner — the tray icon's own "Exit" button refuses to close it.
Short answer
squeevio for Windows runs a filtering DNS proxy on 127.0.0.1:53, launched at boot with the highest available privilege level so it survives a normal reboot, and it locks outbound port 53 so another DNS server cannot be substituted underneath it.
Add a partner and the client's own Exit menu item is disabled while your policy is locked — the same 'you can always add, only someone else can remove' rule the phone apps use, applied to a desktop tray icon instead of a mobile settings screen.
Step by step
Install and run once as administrator
The Windows client needs admin rights once, at install, because it changes the machine's DNS resolver and configures a port-53 firewall rule. After that it runs automatically — the scheduled task that starts it at logon is created at the highest run level on purpose, because a task that silently fails to launch after a real reboot protects nobody.
Pick your categories
Same category list as the phone apps — choose broad categories rather than hunting individual domains one at a time. The free tier covers 5 categories and 50 domains of your own choosing.
Add a partner before you need one
This is the step that changes what the tray icon can do. Before a partner exists, you can turn filtering off yourself — a five-second, unpaired convenience. After you add one, the same 'you can add, only they can remove' rule as the phone apps applies here, and closing the app from the tray while locked is refused rather than quietly succeeding.
Confirm ordinary sites still load fast
A DNS-based filter should be invisible on everything you did not block — repeat lookups are cached locally, so ordinary browsing is not slower than your ISP's own resolver, and often faster. If a site you rely on breaks, that is a false positive to report, not a reason to disable the whole filter.
What this does not do
- This is DNS-level filtering, not a full-tunnel VPN like the phone apps. It blocks by hostname, which covers the overwhelming majority of browsing, but a determined user pointing a specific browser at a hardcoded IP address or an unlisted encrypted-DNS (DoH) provider can, in principle, get around a hostname-only block. The client maintains a large, actively-updated list of known DoH providers specifically to close this gap, but a brand-new or self-hosted DoH endpoint is not something a name-based list can ever fully close.
- Anyone with administrator rights on the machine can still uninstall the software outright, boot into Safe Mode, or reinstall Windows. No local software survives that — the point of the partner-lock is to remove the one-click, thirty-second undo, not to defend against a determined hour-long project.
- It is not therapy. If this is costing you sleep, work or relationships, the software is a support structure, not the fix.
Questions
- Why DNS filtering on Windows instead of a full VPN like the phone apps?
- A desktop full-tunnel VPN is heavier to maintain correctly across every Windows network configuration a PC might sit behind (corporate proxies, VPN-on-VPN setups, gaming consoles sharing the connection), and DNS-level filtering already covers the large majority of real browsing without that overhead. The trade-off — a hardcoded-IP or exotic-DoH bypass being theoretically possible — is documented here rather than hidden.
- What happens if I just uninstall it?
- You can, if you have admin rights on the machine — that is true of any Windows software. What changes with a partner attached is that doing so is visible to them (the device reports its status), and the point was never to make removal physically impossible, only to make it a deliberate act with a witness rather than a reflex with none.
- Does the port-53 lockdown break anything?
- It is designed to fail safe: the client runs a live self-test against its own upstream resolvers before applying the lockdown, and rolls it back automatically if it would also block the traffic it is supposed to allow through (for example a network's own DHCP-assigned DNS server that the client is deliberately racing for speed).
- Can this also block specific apps, not just browsers?
- It filters at the DNS layer for the whole machine, so any app that resolves a blocked hostname is affected, not just browsers. Apps that hardcode an IP address and skip DNS entirely are the one category this approach cannot see — the same honest limitation as above.
Set it up on the machine, not just the phone
Most of the moments this matters for happen on a laptop, not a phone. Cover the machine you actually use.