Lockdown

Windows app that blocks websites and apps, tracks all network activity, and makes it genuinely hard to cheat your own rules.

What it does

• Block websites — permanently, on a schedule, with daily time limits, or temporarily
• Block apps — prevent games/launchers/apps from running or accessing the internet (Steam games are found automatically; blocking one closes everything running from its game folder)
• Network log — see every connection your PC makes (which app, where, when)
• Anti-bypass — locked settings, delayed unlocks, challenges, watchdog services — designed to beat your own willpower

Status

• Phase 1 (MVP) done: permanent website blocking via the hosts file, enforcement service, GUI with blocklist + popular-sites quick-list, system tray.

• Phase 2 done: blocking by hours (allow-only or block-during, several time windows with their own days), daily time limits, temporary blocks, stacked rules, locked browser DoH/QUIC policies, closing open connections on block, blocked-visit notifications, tray agent at login, single instance, clock-change protection.

• Phase 3 done: app blocking (close politely then force after 10 s / block internet via firewall / both), app browser with icons, daily limits for apps, groups with shared rules + extra limits per member (on top of the group's) and their own way of blocking members (close / minimize / cut internet; can't load / close the tab / go back), "N minutes allowed during blocked hours", warnings before blocks + reminders while in use + "block started".

• Blocking UI: five tabs — Overview (everything with rules as chips, sortable, Edit/Remove), Groups (list + editor), Add (pick a site or app, tick any number of blockers: hours, time limit, opening limit, permanent, temporary), Site protection (always-on lists, your own lists, blocked words, allowed-anyway) and Calendar (one row per blocked item with its blocked stretches as bars; Day / 3 days / Week; emergency unlocks marked; summary cards for the day). Site suggestions while typing, popular sites suggested while typing (small typos are fine). Auto-save is on by default; turn it off to stage changes until you press Save changes (unsaved items then show "Not applied").

• Limits per day / week / month (stackable, e.g. 2 h a day + max 8 h a week). The daily time limit can have its own amount on each weekday (0.84.12: untick "Same every day", e.g. 3 h Mon–Fri and 2 h Sat–Sun; an empty day has no daily limit). The day is the limit day: with a 03:00 reset, Saturday 01:00 still gets Friday's amount. Raising a day's amount or clearing it goes through Anti-Bypass; lowering is free. A configurable limit reset time (Settings; a change never ends the current limit day, week or month early), and Emergency unlock (Blocking > Overview: unblock chosen items for 20 min - blocked yet or not, e.g. before your allowance runs out; the time still counts toward your limits - and/or pause the bedtime and break alerts; also "Emergency (N left)" on the bedtime screen; 3 uses per week by default, configurable in Settings - also several kinds at once, each with its own uses per day / week / month and length, e.g. 3 a week for 5 min and 1 a month for 60 min, picked when you use one; never for permanently-blocked items).

• Dashboard (home page) and Screen Time (Overview / Apps / Websites / Switches, Today to 30 days) with categories (productive / neutral / distracting + your own, with your colours - click a category to change it). Your Steam games and purely-for-fun sites / apps (game launchers, streaming, short video) start as Distracting. Hover a chart for details. Themes: Dark, AMOLED, Light, Match Windows + any accent colour (Settings > Appearance).

• Protection lists (Blocking > Protection): always-on community lists of scam, phishing, malware and adult sites (gambling optional; ~4.3M sites from HaGeZi, Block List Project, Phishing Army, URLhaus), updated daily with a download progress, with exceptions and a "check a site" box. Blocked by the service's own DNS filter. Also forced SafeSearch (Google / Bing / DuckDuckGo, YouTube Restricted Mode) and blocked words: the browser tab in front is closed (or sent back) when its address or title has a blocked word (ready-made English and Polish adult word lists you can open and edit, your own words, exceptions).

• Modes (Phase 6a): Work / Study / Focus (Pomodoro) / Do Not Disturb / Relax + your own - each blocks a category plus picked sites/apps while it's on; start for a while, until a time or until stopped (optionally locked), or on a schedule; also from the tray menu.

• Reminders (Phase 6b): bedtime overlay, break reminders (optionally forced), your own reminders (interval / set times / random) with snooze, "did you really do it?" check and quotes; they wait while you're in a full-screen game. At most one interruption every 20 minutes (what falls due in between arrives together), a reminder you keep dismissing asks half as often for the rest of the day, and reminders due around a break ride along in it. A strict break minimises your windows; apps on your "Allowed during breaks" list (Lockdown + Settings by default) stay usable. Grey screen during bedtime (Sleep card, off by default): the whole screen goes grey from bedtime until wake-up time - not while an emergency unlock or a silent pause holds the alerts - and the colour comes back after; turning it off while bedtime is Important goes through Anti-Bypass.

• The window: a web page in a native window (Edge WebView2; the installer adds the runtime where Windows lacks it). If it can't start on a PC (no WebView2, its page never loads), Lockdown writes the reason to its log and %TEMP%\lockdown-newui.log, shows a message and tries once more; the tray agent keeps running either way. The old Tk window is gone.

• Anti-Bypass (Phase 7): loosening a block (removing it, higher limits, switching a protection list off, more emergency unlocks, quitting from the tray, ...) needs the challenges you turn on - typing a random phrase (no pasting; optionally word by word in a 3×3 grid of boxes picked at random - macros can't type blindly) and/or only during chosen hours; tightening is always instant. The tray app and the service come back within a minute if they're closed; a new time zone counts only after 24 hours; uninstalling asks for the challenge.

• Pause my blocks (0.84.8): on the Anti-Bypass page or from the tray ("Pause my blocks..."): every site and app on your list - items, groups, modes, categories; hours, time limits, opening limits, temporary and permanent blocks - is unblocked for 30 min, 1 h, 2 h, 4 h or the rest of the day (until the next reset time), then blocked again by itself. Optionally Silence all notifications for the same while (warnings, reminders, bedtime and break alerts and screens, pop-ups and Windows notifications). The protection lists, blocked words and SafeSearch stay on, and the time you use still counts toward your limits. Starting it needs the Anti-Bypass challenge; Resume now (the banner over every page, the tray, the Anti-Bypass page) ends it early, free. Kept in trusted time, so a restart or a clock change doesn't stretch it. Not the same as turning Lockdown off (everything, until you turn it back on) or an emergency unlock (picked items, spends a use).

• Phase 8a: your own block lists by URL (with a preview), settings backup / import, screen-time CSV, a weekly summary notification, streaks, a month calendar on Screen Time, display settings (⚙) for Dashboard / Screen Time.

• Network Log (Phase 5): which app connected to which site in the last hour (names from the Windows DNS cache); table or graph, filters, export; click a row to block the site/app or copy it.

• Speed (redesign Phase 0, 0.84.0): indexed database, statistics summed in SQL, settings parsed once per change, and a month of per-minute detail with daily totals kept forever - the Dashboard of a year-old install loads in about a tenth of the time, and an install no longer gets slower the longer it is used.

• Updates (0.84.4, 0.84.8): Lockdown asks GitHub for a newer release a minute after it starts, every 6 hours, and when you open the window (at most every 5 minutes). A newer version shows as a banner over every page ("Lockdown X is available - Install / Later / ✕"), a dot on About and "Update available" with "Install update" in the tray menu, plus one notice (Install / Remind me later). Later hides it for 4 hours, the ✕ hides the banner until Lockdown is next started (never for good); Install downloads LockdownSetup-X.Y.Z.exe to the temp folder and runs it from the About page, with progress (the file is deleted at the next start). If that fails, About says so with Try again and GitHub - nothing opens by itself. About's update section: Check for updates automatically (on/off), the version with Check now, GitHub (the releases page) and Get update when there is one. Only ever forward to a newer version.

See PLAN.md for the full plan and later phases.

How it works

• The GUI + tray agent (runs as you, starts hidden at login) writes the blocklist to C:\ProgramData\Lockdown\config.db and shows notifications.
• The enforcement service (runs as SYSTEM) every 2 s:
  • evaluates the rules (permanent / by hours / temporary) and rewrites a marked # >>> Lockdown section in C:\Windows\System32\drivers\etc\hosts, redirecting blocked hostnames to 127.0.0.1. Manual edits are repaired; the rest of the hosts file is never touched (backup: C:\ProgramData\Lockdown\hosts.backup);
  • keeps browser policies set that turn off DNS-over-HTTPS and QUIC in Chrome, Edge, Brave and Firefox (browsers then show "managed by your organization") — otherwise browsers could skip the hosts file;
  • closes already-open connections to a site right after it gets blocked; while a site is blocked its video hosts (googlevideo.com ...) are also firewalled, IPv4 and IPv6, and the DNS filter answers for them (0.84.9).
• Apps are matched by exe name. The service checks running processes 4x per second: an app started while blocked is killed at once; one that was already open when its block began is asked to close (like clicking X) and force-closed after 10 s. "Minimize" keeps the app running but the tray agent minimizes it whenever it comes to the front; "Grey it" keeps it open too, but the whole screen goes grey while it is in front and the colour comes back when you leave it (the tray agent does it with Windows' Magnification API, no admin needed; Windows' own Color filters are a separate setting, never touched - Lockdown only undoes the grey it applied); "Block internet" adds a Windows Firewall rule. "Also close its background processes" (with Close app) closes, once the app is gone, what it started and whatever runs from its install folder. Windows' own processes can't be blocked.
• Groups (Blocking > Groups) hold shared rules; members inherit them, and a group daily limit is one total for all members. A member can get extra limits ON TOP of the group's (never instead of them): the group's rules always apply to it, its time and openings fill the group's shared limits and its own, blocked hours add up and allowed hours narrow, and the first limit to run out blocks it. E.g. "Fun" 2 h a day with YouTube at most 1 h: YouTube stops at 1 h, which is 1 h of Fun's 2 h. A member can get an extra limit of any kind (hours, time limit, opening limit, temporary), also one the group itself doesn't have. An app that is closed the moment it opens (because it is blocked) doesn't use up the group's openings. Extra limits only tighten - adding or tightening one is free, removing or relaxing one goes through Anti-Bypass. Warnings/reminders are set on the Notifications page.
• How a group's members are blocked (0.84.11): the group editor's "How members are blocked" chooses it for all members - apps: Close app (+ its background processes) / Minimize / Grey it / Block internet; sites: Can't load it / Close the tab / Go back. A member's extra-limits window can add to that for that member only (the group's way is greyed there - a member can never be weaker than its group). A group with nothing ticked blocks each member the way it was set when it was added (every group from before 0.84.11). A block by the item's own rules keeps the item's own way; blocked by both, it does both. Making the way weaker (e.g. "close" -> "block internet", "close the tab" dropped) goes through Anti-Bypass; stronger is free.
• Sites set to "Can't load it" only are never closed or sent back by the tray (0.84.11): a page that was already open, e.g. a playing video, is stopped by the network (its connections cut, QUIC off, its video hosts firewalled). "Close the tab" closes the tab in front once; another blocked tab that comes to the front after it is left alone for 10 s, so several tabs are never closed at once.
• Daily limits: the tray agent checks the windows in front twice a second, reads the active browser tab's address (Windows UI Automation — Chrome, Edge, Brave, Firefox, no extension needed) and counts time on limited sites and apps; the service blocks the site once the limit is used up, until the limit period ends (at the limit reset time).
• The service keeps its own trusted time (internet time + the Windows tick counter), so changing the Windows clock doesn't unlock anything; clock changes are logged.
• Site icons are downloaded once from Google's favicon service and cached in %LOCALAPPDATA%\Lockdown\icons (a letter icon is shown when offline).
• The service also listens on 127.0.0.1:80/443: when a browser tries to open a blocked site, it records which site and why; the tray agent turns that into a notification (configurable on the Notifications page) - only when a browser window in front (focused, or in front on another monitor) shows that site around then, i.e. you tried to open it (0.84.10). Hits from embedded videos, thumbnails, other programs or the DNS filter are recorded (network log, Blocked visits) but stay silent.
• Notifications (0.84.7): Windows' own notifications by default (package windows-toasts), with their buttons. While a full-screen app (a game) is in front Lockdown never draws a window of its own: everything, held reminders too, goes out as a normal Windows notification, which Windows may hold in the notification centre.
• DNS filter (protection lists - millions of sites, far too many for the hosts file, which makes Windows' DNS hang): the service runs a small DNS server on 127.0.0.1 / ::1 port 53. Connected network adapters are set to DNS "127.0.0.1, " (+ ::1 for IPv6): listed sites get 127.0.0.1, everything else is passed to the network's DNS. If the service stops, Windows falls back to the network's DNS (internet keeps working, lists not enforced). Original settings are saved and restored on uninstall or with service.py restore-dns.
• Service log: C:\ProgramData\Lockdown\lockdown.log.
• Data kept: per-minute screen time, the switch log, blocked visits and reminder answers for 32 days; older days are rolled into daily totals (kept forever) by the tray app once a day, so charts, streaks, the calendar and the CSV export are unchanged. Only once 33 days with recorded data follow a day is it rolled up, so a wrong clock can't take recent detail. Limit usage, emergency unlocks, settings and rules are never pruned (src/retention.py).

Install

Run LockdownSetup.exe (build it with scripts\build.ps1, see below). It installs Lockdown into Program Files, registers the "Lockdown Enforcer" Windows service and starts everything. Run a newer LockdownSetup.exe to update - your settings, blocks and history (in C:\ProgramData\Lockdown) are kept. Uninstall from Settings > Apps (needs the Anti-Bypass challenge if it's on).

Build

& "<project folder>\scripts\build.ps1"     # -> build\LockdownSetup.exe (and build\dist\Lockdown)

Setup from source (development)

Requires Windows and Python 3.13.

py -3.13 -m venv .venv
.\.venv\Scripts\python.exe -m pip install -r requirements.txt

Install the enforcement service (once, from an Administrator PowerShell — works from any folder; re-run after changing service code):

Set-ExecutionPolicy -Scope Process Bypass -Force; & "<project folder>\scripts\install_service.ps1"

Remove it with scripts\uninstall_service.ps1 (also removes the browser policies and restores DNS settings; clear the blocklist first so the hosts entries are removed).

If pages ever stop loading because of Lockdown, run scripts\repair_dns.ps1 the same way: it stops the service, restores the network adapters' DNS settings and removes Lockdown's hosts-file section (run install_service.ps1 again to turn Lockdown back on).

Usage

Double-click Lockdown on the Desktop (or Lockdown.lnk in the project folder) — no console window. Create/recreate the shortcuts with scripts\create_shortcut.ps1 (no admin needed).

Or from a terminal in the project folder:

.\.venv\Scripts\pythonw.exe src\main.py

• The app registers itself to start hidden in the tray at login (HKCU\...\Run\Lockdown).
• Only one copy runs; launching it again just shows the window.
• Shortcuts: Esc closes pop-ups; in text boxes Ctrl+Z / Ctrl+Y, Ctrl+Backspace, Ctrl+A. Searches forgive small typos.
• Closing the window minimizes it to the tray. The tray icon's Exit closes only the icon and the window (needs the Anti-Bypass challenge when it's on): blocking, word filters and reminders keep running, and opening Lockdown again brings the window and icon back. Killed (e.g. in Task Manager), Lockdown is started again within a minute.
• Tray icon: green = service enforcing, red = service not running.

Development

.\.venv\Scripts\python.exe -m pytest

The suite also runs on Linux/macOS (python -m pytest, needs only pytest and pillow): tests/conftest.py fakes the Windows-only modules there, and the few tests that need the real Win32 API skip with a reason.

Set LOCKDOWN_DATA_DIR to use a different data folder (e.g. for testing).

python scripts/bench_stats.py times the Dashboard / Screen Time data work on a big synthetic database (a year of minutes, 6 000 blocked items); --src <other checkout>/src measures another version for comparison.

Design: design/Lockdown Dashboard & Screen Time.dc.html (Claude Design). Colours and the system font stack live in src/ui/css/tokens.css; the installer's fonts (Inter, Barlow Condensed - SIL Open Font License, licences next to them) are in assets/fonts.

Known limitations

• The hosts file has no wildcards: blocking reddit.com also blocks www.reddit.com, but not other subdomains unless they are listed (the quick-list, and typing a known site's domain, include the common ones).
• Closing open connections works for IPv4 TCP only, and uses the site's IPs as resolved at block time (big sites on CDNs may use other IPs too).
• The DNS filter can be bypassed by changing the network adapter's DNS by hand (Lockdown switches it back within 10 s) or by stopping the service; Windows may also briefly use the fallback DNS if the filter answers slowly.
• Anti-Bypass works in the app: someone with admin rights can still stop the scheduled tasks, or edit config.db directly (making settings service-only is planned).

Licence

MIT — © 2026 Husarp. Free to use, change and share, keeping the copyright notice; see LICENSE. The bundled fonts (Barlow Condensed, Inter) keep their own licence, the SIL Open Font License — the licence files are next to them in assets/fonts/.