How to Lock Your Mac's Blocklist With Touch ID

Blocking a site is easy. Keeping it blocked at 2 AM, or when a curious kid finds your unlocked Mac, is harder. A lock adds one deliberate step: before blocking can be turned off, your Mac asks for Touch ID or your password.

Turn on the Protection Lock

Open SaneHosts and choose Settings > General.
Under Protection Lock, turn on Require Touch ID to change protection.
That is it. A small lock appears next to your active profile.

What asks for Touch ID

Turning protection off
Switching to a different profile
Editing the active profile's entries
Adding or removing Allowed Sites
Turning the lock itself off

Macs without Touch ID ask for your Mac password instead. Cancel the prompt and nothing changes. After you unlock once, changes in the next two minutes go through without asking again, so a few edits in a row need one unlock.

What never asks

Turning protection on. Adding blocking is always allowed.
Weekly list updates. They only refresh the lists you already chose.

What the lock does not do

The lock asks for the password of whoever is signed in to the Mac. It stops a quick click, a weak moment or someone without your password. It is not a parental-control system: anyone who knows your Mac password, or has an admin account and Terminal, can still change /etc/hosts.

For focus and self-control that is often enough. The extra step is the point: it turns an impulse into a decision.

Try it on your Mac

14-day trial

SaneHosts manages your Mac's hosts file for you: pick a protection level, allow the sites you need, keep lists current, and lock it if you want. Try it free for 14 days, then $14.99 once. No subscription.

Get SaneHosts

Works on macOS 14 (Sonoma) and later.

Questions

Does the lock work on Macs without Touch ID?

Yes. macOS asks for your Mac password instead.

Can I block sites without the lock?

Yes. The lock is off by default. Turn it on only if you want changes to ask first.

Does protection stay on if I quit SaneHosts?

Yes. Blocking lives in your Mac's hosts file, so it keeps working after you quit the app or restart.