Screen Guardian

Loopholes

How to Block Private Browsing and VPNs on iPhone

Private Browsing + a bypass VPN are the two most common reasons a Screen Time block leaks. Both close with two toggles.

By The Screen Guardian Team· Product Team6 min read

Loopholes — Private & VPN

A Screen Guardian guide

Two of the most common "why is my Screen Time block leaking?" causes are Private Browsing and a VPN routing DNS around your filter. Neither is dramatic to fix — a Face ID gate on Private tabs, a Screen Time toggle for VPN configuration changes, plus removing any existing VPN profile. Here’s the exact set of settings.

Blocking Private Browsing in Safari

Private Browsing on modern iOS still respects the Web Content filter — Limit Adult Websites applies whether the tab is regular or private. What Private Browsing changes is the history log: sites visited in Private mode don’t show up in the Screen Time report, so the visit isn’t visible to anyone reviewing the report afterwards.

If your goal is to add friction and make Private Browsing a deliberate act, iOS supports requiring Face ID (or Touch ID) to unlock private tabs.

Step 1

Enable Face ID for Private Browsing

Settings → Safari → scroll to Require Face ID to Unlock Private Browsing → ON. Now, every time private tabs are opened, Safari demands a Face ID authentication before revealing them.

This doesn’t disable Private Browsing — Apple doesn’t provide that toggle on personal (non-supervised) devices — but the Face ID gate raises the friction. Combined with a strong Web Content filter (see the permanent-blocking guide), Private Browsing is no longer a meaningful bypass.

Blocking VPN configuration changes

A VPN app on iPhone can install a VPN configuration profile that routes all your traffic through the VPN’s DNS. If your porn filter is DNS-based (like NextDNS or CleanBrowsing on a device-wide DNS profile), a VPN can bypass it entirely — the VPN’s DNS servers don’t honor your filter’s block list.

Two things to note:

  • Apple’s Web Content filter (Limit Adult Websites) is NOT DNS-based. It runs inside WebKit against Apple’s category list. A VPN doesn’t defeat it.
  • DNS-based filters (NextDNS, OpenDNS, custom Encrypted DNS profiles) DO get defeated by VPNs that override DNS.

Step 1

Block VPN changes via Screen Time

Settings → Screen Time → Content & Privacy Restrictions → scroll to Allow Changes → VPN → set to Don’t Allow. Now no new VPN configurations can be added and existing ones can’t be modified — without knowing the Screen Time passcode.
Content & Privacy Restrictions — VPN row lives under Allow Changes.

Step 2

Remove existing VPN configurations

Settings → General → VPN & Device Management → tap each installed VPN profile → Remove Profile. If you use a VPN for work, keep that one — but everything else should go.

Blocking custom encrypted DNS

iOS lets apps install encrypted DNS profiles (Settings → General → VPN & Device Management → DNS). Some of these ship as DNS-only VPN alternatives that don’t register as VPNs and therefore don’t hit the VPN Don’t Allow toggle above.

Same fix, different path: install any DNS profile you actually want, then set Content & Privacy Restrictions → Allow Changes → Cellular Data / Wi-Fi & Bluetooth to Don’t Allow, which locks the DNS configuration too.

The pattern behind all three

Private Browsing, VPN configuration, and DNS profile changes are all gated by the Screen Time passcode. Someone who knows it can:

  • Disable Face ID for Private Browsing.
  • Flip VPN Allow Changes back on and install a bypass VPN.
  • Add a new DNS profile that routes around a filter.

Which is why the pattern for every loophole in Screen Time terminates at the same door: the passcode. See Every Screen Time Loophole for the full catalog. The mechanism that closes the passcode itself is what Screen Guardian provides.

Bottom line

Private Browsing gets Face ID gated (Settings → Safari). VPN gets locked via Screen Time (Content & Privacy → Allow Changes → VPN → Don’t Allow). Any existing bypass VPN/DNS profiles get removed. The whole stack rests on the Screen Time passcode; make that unrecoverable if you want the block to last.

Frequently asked questions

How do I disable Private Browsing on iPhone?
iOS doesn't offer a full disable on personal devices — only supervised (MDM) devices do. What you CAN do is Settings → Safari → Require Face ID to Unlock Private Browsing ON, which adds a Face ID gate every time Private tabs are opened.
Does Private Browsing bypass Screen Time filters?
No — Limit Adult Websites still applies in Private tabs on modern iOS. What Private Browsing bypasses is the history log inside Screen Time reports, so visits aren't visible to anyone reviewing the report.
How do I block VPNs on iPhone?
Settings → Screen Time → Content & Privacy Restrictions → Allow Changes → VPN → Don't Allow. This locks the ability to add or modify VPN profiles. Then remove any existing VPN profiles under Settings → General → VPN & Device Management.
Can a VPN bypass Apple's Limit Adult Websites?
No. Apple's Web Content filter is category-based inside WebKit — it doesn't rely on DNS. VPNs defeat DNS-based filters (like NextDNS profiles) but not the built-in iOS filter.

Related guides