How Hard Stop works

Four layers, rebuilt every five seconds by a service running as root. Any one of them can be worked around on its own — which is exactly why there are four.

The four layers

1. 01

   Name resolution

   /etc/hosts

   389 domains and their subdomains are pointed at nowhere, on both IPv4 and IPv6. This is what most blockers ship, and on its own it is weak: edit one file and it is gone. Here the file is rewritten from a sealed copy every five seconds, and removing an entry is reverted and logged.

2. 02

   Packet filter

   pf

   Catches what DNS cannot: a hardcoded IP address, Tor's directory authorities, and VPN tunnels. Public DNS resolvers are blocked on ports 443 and 853 only — encrypted DNS is a bypass, plain DNS on port 53 is not, and blocking the whole host would take the machine's own resolver down with it.

3. 03

   Browser policy

   managed preferences

   Forces DNS-over-HTTPS off in Chrome, Brave, Edge and Firefox. Without this the entire hosts layer is defeated by one toggle in settings: a browser resolving names through its own encrypted channel never consults the system at all.

4. 04

   Process termination

   SIGKILL

   Tor Browser, commercial VPN clients, WireGuard, OpenVPN and the usual tunnelling tools are closed on sight. An established tunnel is invisible to every layer above, and Tor's bridge list is far too large to enumerate — killing the client is the only reliable answer.

What it blocks

389 base domains, each expanded across its subdomains. The list lives in a plain text file you can read and extend at any time — adding sites never needs the password. Removing one does.

Prediction markets

Polymarket, Kalshi, Limitless, Myriad, SX.bet, Manifold, Augur

Crypto casinos

Stake, Rollbit, Roobet, BC.Game, Shuffle, Duelbits, Gamdom, Betpanda

Sportsbooks

DraftKings, FanDuel, BetMGM, bet365, 1xBet, Pinnacle, Bovada

Mainstream casinos & poker

PokerStars, 888, PartyPoker, LeoVegas, Casumo, Unibet

Regional bookmakers

Melbet, Parimatch, Fonbet, Pin-Up, Dafabet, SBOBet, 22Bet

Skin & loot-box gambling

CSGOEmpire, Hellcase, Key-Drop, HypeDrop, CSGORoll, Skinclub

Affiliates and odds sites

AskGamblers, Casino.guru, OddsChecker, Covers, OddsJam

Binary options

IQ Option, Pocket Option, Quotex, Olymp Trade, Deriv

What it cannot do

Read this part before you decide to rely on it.

• If your macOS account is an administrator, you can remove Hard Stop. The daemon and its watchdog reinstall each other and every attempt is logged, but someone determined, unhurried and technical will win. The password stops the 2am impulse, not a planned afternoon.
• The fix is not more software: create a second admin account, give that password to the same person holding the guardian password, and remove admin rights from the account you use daily. Without sudo, none of the bypass routes open at all. This is the only configuration where 'I cannot get in' is literally true.
• It covers this Mac. Your phone, your tablet and any other computer are untouched — a block on one device is a speed bump if a second one is in your pocket.
• It blocks websites, not money. Exchange accounts, cards and wallets keep working. If money moving is the part you cannot control, self-exclusion with your bank does more than any blocklist.