Written 5 Sep 2026. This is a how-to, not a product card.

Block a site in Pi-hole on purpose

One domain you don't want in the house. Add it to the deny list. You don't wipe every block list or buy a new router.

Haven't installed the house ad block yet? Start with the first useful thing. A bank or login broke after Pi-hole and you need that name back? That is when a site won't load after Pi-hole. This note is the other direction: you chose a domain, and you want phones and laptops to stop reaching it.

Skip until the house asks Pi-hole

If ads never dropped, point DNS first: point common home routers at Pi-hole. Admin page blank? when the Pi-hole admin page won't open. You need house Wi-Fi (or a cable), not guest Wi-Fi that still uses ISP DNS, and not cellular data on a phone.

What this is

Pi-hole already skips names on subscribed lists. A deny entry is your own add-on: one exact domain the house should not resolve. Useful for a tracker that slipped through, a site you do not want on kids' devices, or a noisy CDN host you already identified in the query log. You are not stacking ten third-party lists tonight. You are naming one domain.

Step 1: get the exact domain

Guessing is how you break a login. Prefer a name you already saw. Open the admin Query Log at http://pi.hole/admin (or the computer's address plus /admin), reload the site once on a phone that uses house DNS, and copy the domain from the row. Calmer walk: see what Pi-hole blocked.

From SSH you can watch live while you reload:

pihole tail

Press Ctrl-C when you have the name. Use the host itself (ads.example.com), not a full URL with https:// or a path. Skip wildcards and regex on day one. One exact domain is enough.

Step 2: deny it from SSH

SSH into the computer, then:

pihole deny ads.example.com

Swap in the real name. Pi-hole reloads DNS after the add. To ask whether a name is already on a list (subscribed or yours):

pihole query ads.example.com

Step 3: or deny it in the admin page

Same job without SSH. Open Domains (sometimes under Lists, depending on your Pi-hole version). Add the domain to the deny / blacklist side. From Query Log you can often open a row and choose Deny. Either path is fine. Forgot the admin password? Change the Pi-hole admin password.

Step 4: prove it on a phone

On a phone or laptop that uses house DNS, try the site again. Clear a sticky DNS cache if the page still loads once (toggle Wi-Fi off and on, or wait a minute). In Query Log you should see the name as blocked / denied when something asks for it. If the site still loads, you denied a different host than the one the page needs. Watch the log again and deny the next exact name. Stop when the page stays gone. Don't deny the whole internet.

If you denied the wrong thing

Open Domains in the admin page and remove that name from the deny list. Or from SSH, remove it the same way you would undo an allow: use the Domains page if you are unsure of the delete flag on your Pi-hole version. Reload the site. Prefer removing one bad deny over turning blocking off forever. A five-minute pause is for diagnosis on when a site won't load after Pi-hole, not a substitute for fixing a deny list.

What this is not

This is not a parental-control product with profiles and schedules. It is not blocking every device that uses cellular data or a VPN that bypasses house DNS. It is not opening the admin page past the house network. It is not a reason to delete every subscribed list, or to buy a Raspberry Pi so the deny feels official. Ads back on every device is still when ads come back.

What next

Leave the deny list alone when the site stays blocked. For a calmer look anytime, see what Pi-hole blocked. Once a week, keep Pi-hole updated. Before a scary reinstall, save a Pi-hole backup so your deny and allow entries survive. Tired of typing the number? Add a local name in Pi-hole. A file share on this same computer can wait: a file share.

Optional: jot that you denied a domain in Lab plan — username + passkey, no email. Skip if you just want to keep reading.

Skip

• Skip stacking a dozen extra block lists because one site annoyed you.
• Skip wildcards and regex on day one.
• Skip leaving blocking disabled overnight.
• Skip opening the Pi-hole admin page to the internet.
• Skip a new router or a mesh kit for one domain.
• Skip this if a site you need is broken and you meant to allow it. That is a different walk.