The network layer
cocloc writes its blocklist into the Windows hosts file. A blocked domain stops resolving. The page does not load.
That happens below the browser, so it applies to every browser on the machine, including private and incognito windows, and to apps that are not browsers at all.
It also turns DNS-over-HTTPS off in Chrome, Edge, Brave and Firefox. A browser that resolves DNS inside itself would route straight around the hosts file. cocloc sets this as a policy rather than a setting, which greys the browser’s “Secure DNS” toggle out so it cannot be clicked back on.
That is the whole mechanism. No packet filtering. No virtual network adapter. No inspection of the connection. Nothing is decrypted and no certificate is installed, now or ever. The blocking works by turning DNS-over-HTTPS off, not by reading your traffic.
What it covers
Anything on the machine that asks Windows to resolve a blocked domain. Any browser, any app, any window.
What gets around it
Three routes, and all three still work:
- A browser pointed at a DNS-over-HTTPS provider the policy does not cover.
- A VPN.
- A raw IP address.
We would rather list them here than let you discover them at 1am and conclude the rest of the page was written the same way.
The list itself
121 domains, hand-curated, shipped inside the software. Plus a 15-domain never-block list covering health, recovery and education, which no blocklist entry can override.
It covers the majors. It is not exhaustive and it will not become exhaustive. If you find a miss, send it to us and it goes into the next build.
The screen layer is coming, and is not here
The plan is a small model on your own disk that watches your monitors for explicit content a domain list structurally misses: a feed, a timeline, a thread, a video on a site that cannot be blocked wholesale.
It is not in this build. There is no screen capture, no model running, nothing drawn on your screen, and no sensitivity setting, because there is nothing yet for a setting to control. The detection code exists and is tested; it is wired to nothing that ships.
When it does ship, frames will be analysed in memory on your machine and discarded, and the sensitivity choice will be described by what it does — curtains more, and more often — not by a precision number we have not earned.
Why say it at all, then. Because the honest version of the pitch is the product. A page that describes a screen layer you do not have is the same page that would quietly stop being true about your privacy.
The 24-hour gate
This is cocloc Lock. It is the paid part, and it is the only paid part. On cocloc Free there is no gate: pause is instant.
On Lock, anything that loosens cocloc goes through the same two steps.
- You request it. It takes effect as a request. Nothing changes.
- You confirm it — no earlier than 24 hours later. Confirming is what applies the change.
Loosening means pausing, unblocking a domain, turning a layer off, or uninstalling the software.
Uninstalling is loosening. There is no separate fast path. Settings, then Apps, then Uninstall launches the request. It does not remove anything.
Tightening is always instant. More blocked domains, a layer turned back on, a gate set longer than 24 hours. The delay only ever runs in the direction of more protection.
If you never confirm, nothing happens. A request that sits there expires into nothing, which is the outcome we are hoping for.
When you ask to loosen it
The request is not a silent button. Before the clock starts, cocloc shows you a window, and that window carries the number of days you have been protected and the wait you agreed to.
There are two buttons. Not tonight closes it. Continue with the request is the quiet one, off to the side, and it is greyed out for about fifteen seconds before it can be pressed.
It is a normal window. Alt-Tab works, Task Manager works, nothing at the operating system level is disabled. Hard to dismiss by reflex. Possible to dismiss on purpose.
And it unlocks nothing. Pressing through does not bypass the wait. It starts it.
There is no emergency unlock and no override. We are not going to build one, because it would be the first thing anyone found at 1am.
The accountability partner is coming
The intent: you name one person — a spouse, a friend, a sponsor — and give their email. They receive events. An uninstall request. A repeated attempt to stop the service. A request to loosen something.
They never receive images or your browsing history. Events and timestamps, nothing else, and you will be able to see exactly what they get before you turn it on.
It is not built. There is no mechanism to send those emails yet, which is why it is not in any feature list on this site with a tick beside it. It will be a cocloc Lock feature when it exists.
What you keep
You stay an administrator on your own machine. The install changes nothing about your Windows account. No demotion, no sealed password, no switching you to a standard user.
That is deliberate. Taking a paying customer’s admin rights on their own computer is the heaviest thing this software could do, and the honest version of the pitch does not need it: the craving does not survive a logged, deliberate, 24-hour detour.
What follows from it is the limit on the front page. A determined person with their own admin account can force this software off. We do not hide that. It costs a deliberate administrative action, and it is recorded.