Labthrift Labthrift What to buy. What to skip. Why.

Written 6 Sep 2026. This is a how-to, not a product card.

Allow a site in Pi-hole on purpose

One domain the house needs that a block list keeps catching. Add it to the allow list. You don't wipe every list or buy a new router.

Haven't installed the house ad block yet? Start with the first useful thing. A bank or login just broke and you are still hunting which name is guilty? That diagnostic walk is when a site won't load after Pi-hole. Want the opposite (block a name on purpose)? That is block a site in Pi-hole on purpose. This note is the calm allow: you already know the domain, and you want phones and laptops to reach it again.

Skip until you know the exact domain

If ads never dropped, point DNS first: point common home routers at Pi-hole. Admin page blank? when the Pi-hole admin page won't open. Guessing a domain is how you open the wrong tracker for the whole house. Prefer a name from the query log. Calmer look anytime: see what Pi-hole blocked.

What this is

Pi-hole skips names on subscribed lists. An allow entry is your exception: one exact domain the house should resolve even when a list says no. Useful for a bank CDN, a login host, a school portal, or a streamer that shares a name with an ad network. You are not turning blocking off. You are naming one domain. You need house Wi-Fi (or a cable), not guest Wi-Fi that still uses ISP DNS, and not cellular data on a phone.

Step 1: get the exact domain

Open the admin Query Log at http://pi.hole/admin (or the computer's address plus /admin). Reload the broken page once on a device that uses house DNS. Copy the domain from the blocked row. From SSH you can watch live while you reload:

pihole tail

Press Ctrl-C when you have the name. Use the host itself (cdn.example.com), not a full URL with https:// or a path. Skip wildcards and regex on day one. One exact domain is enough.

Step 2: allow it from SSH

SSH into the computer, then:

pihole allow cdn.example.com

Swap in the real name. Pi-hole reloads DNS after the add. To ask whether a name is already on a list (subscribed or yours):

pihole query cdn.example.com

Step 3: or allow it in the admin page

Same job without SSH. Open Domains (sometimes under Lists, depending on your Pi-hole version). Add the domain to the allow / whitelist side. From Query Log you can often open a row and choose Allow. Either path is fine. Forgot the admin password? Change the Pi-hole admin password.

Step 4: prove it on a phone

On a phone or laptop that uses house DNS, try the site again. Clear a sticky DNS cache if the page still fails once (toggle Wi-Fi off and on, or wait a minute). In Query Log you should see the name as allowed / OK when something asks for it. If the site still breaks, you allowed a different host than the one the page needs. Watch the log again and allow the next exact blocked name for that page. Stop when the page works. Don't allow the whole internet.

If you allowed the wrong thing

Open Domains in the admin page and remove that name from the allow list. Reload the site. Prefer removing one bad allow over turning blocking off forever. A five-minute pause is for diagnosis on when a site won't load after Pi-hole, not a substitute for a permanent allow you meant to keep.

What this is not

This is not leaving blocking disabled overnight. It is not a reason to delete every subscribed list. It is not opening the admin page past the house network. It is not fixing a phone that uses Private DNS, Private Relay, or a VPN that bypasses house DNS (that walk is when one phone still shows ads). Ads back on every device is still when ads come back.

What next

Leave the allow list alone when the site works. For a calmer look anytime, see what Pi-hole blocked. Need the other direction? Block a site in Pi-hole on purpose. Cast picker empty? When casting won't find the TV. Once a week, keep Pi-hole updated. Before a scary reinstall, save a Pi-hole backup so your allow and deny entries survive. Tired of typing the number? Add a local name in Pi-hole. A file share on this same computer can wait: a file share.

Optional: jot that you allowed a domain in Lab plan — username + passkey, no email. Skip if you just want to keep reading.

Skip

Sources

Pi-hole docs. Pi-hole command (allow, deny, query, tail). Official pages only. For install, see the first useful thing. For a broken site you are still diagnosing, see when a site won't load after Pi-hole. For the deny direction, see block a site in Pi-hole on purpose. For the query log, see see what Pi-hole blocked. For router DNS, see point common home routers at Pi-hole.

Also on this topic

The first useful thingPut a house-wide ad block on the old PC. The rest of the house keeps using the internet as usual. You don't need a Raspberry Pi. See what Pi-hole blockedOpen the query log (or watch it over SSH) so you can tell ads are dying, which device asked, and which name to allow later. You don't need a new router. Block a site in Pi-hole on purposeOne domain you don't want in the house. Add it to the deny list. You don't wipe every block list or buy a new router. When a site won't load after Pi-holeA bank, streamer, or login page breaks after Pi-hole. Pause blocking for five minutes, then allow the domain you need. You don't need a new router. When casting won't find the TVPhone or laptop can't see Chromecast, AirPlay, or the smart TV after Pi-hole. Same Wi-Fi first, pause blocking to prove it, then allow the blocked name. You don't need a new TV. When ads come backAds are back, sites won't load, or a phone still shows banners. Check the computer, Pi-hole, router DNS, then the phone. When one phone still shows adsEveryone else's ads dropped. One phone still shows banners. Check Private DNS, Private Relay, a VPN, then the Wi-Fi lease. You don't need a new router. Keep Pi-hole updatedWeekly apt does not refresh Pi-hole. Update the software and the block lists on the old PC so ads stay gone. You don't need a new Raspberry Pi. Add a local name in Pi-holeGive the old PC a short house name so phones and laptops can open SSH, the share, and the admin page without remembering the number. You don't need a new router. When the Pi-hole admin page won't openhttp://pi.hole/admin or the computer's address plus /admin won't load. Check house Wi-Fi, the address, then Pi-hole and the web service. You don't need a new router. Point common home routers at Pi-holeWhere to set DNS on TP-Link, ASUS, eero, Netgear, Nest, and ISP gateways so the house asks Pi-hole. Prefer LAN DHCP DNS. You don't need a new router. Change the Pi-hole admin passwordAfter the house ad block is up, change the admin password the installer printed. That password is not the login. Save a Pi-hole backup before you change thingsExport settings with Teleporter so a reinstall or a bad list does not wipe your allow list and local DNS. You don't need a new Raspberry Pi. Put a Pi-hole backup back with TeleporterAfter a reinstall or a bad list, import the Teleporter zip so allow lists, deny entries, and local DNS names return. Fresh Pi-hole first. You don't need a new Raspberry Pi.