Before writing a line of Ward I read about 1,600 low-star reviews of the porn blockers that already exist, across the App Store, Google Play and the Mac App Store. They cluster into four complaints, and the same four come up for the market leaders and the solo-developer apps alike:
- A paywall after a long quiz. You answer twenty questions about your habits and then discover that nothing blocks until you subscribe. The free tier is a brochure.
- The “VPN” breaks the internet. Filtering apps that route every packet through their servers slow the phone down, drop connections, and fight with the real VPN you use for work.
- It’s easy to walk around. Incognito, another browser, safe mode, changing the date, a different DNS. If the blocker lives in one browser, the fix is a second browser.
- Removing it costs money. Uninstall gated behind a paid “unlock”, billing that continues after deletion, an accountability partner feature that emails screenshots of things it got wrong.
Ward is the app that takes those four complaints as the spec.
Table of contents
Open Table of contents
Free has to actually block
The first decision was the one every competitor gets wrong on purpose: the free tier blocks everything. All five categories, your own sites, in every app and browser, with a waiting time of up to a day. Nothing is held back that matters to the person who installed it at 2 a.m. and wants it working by 2:01.
Ward Plus exists, and it is one purchase for every platform, not a monthly subscription. It sells the things that make the commitment stronger rather than the things that make it work: a friend who holds the unlock code, Freeze for 7, 30 or 90 days, a wait of up to a week, and groups of sites with import and export. If you never buy it, Ward still blocks. If you delete it, that costs the waiting time and nothing else.
The lists
Ward doesn’t maintain its own blocklist. It uses StevenBlack/hosts, an MIT-licensed project that merges a dozen curated sources into category lists and rebuilds them daily: about 77,000 adult domains, 6,700 gambling, 3,900 social, a fake-news list, and an ads-and-malware base of about 85,000. The project has been going for over a decade and a lot of eyes read every pull request. Building a private list would be worse and would rot.
Both apps download the lists, compile them into a memory-mapped sorted index, and match by parent domain, so blocking example.com also blocks cdn.example.com. The index format is shared byte for byte between the Swift and Kotlin builds.
Why the phone calls it a VPN
This is the part that generates the most support questions for every app in the category, so it’s worth being precise.
On iPhone there is no hosts file and an app cannot see another app’s traffic. The mechanisms Apple offers were each tried and each ruled out:
- Screen Time’s web content filter (FamilyControls / ManagedSettings) caps a custom domain list at around 49 entries and needs an entitlement that takes weeks. Fine for Apple’s own adult filter as an extra layer later; useless for 150,000 domains.
- NEDNSSettingsManager needs a hosted resolver, and iOS ignores it the moment any VPN is active. The user with a work VPN would be unprotected exactly when they didn’t know it.
- Safari content blockers are Safari-only. See complaint number three.
- NEURLFilter, new in iOS 26, needs an Apple-reviewed private-information-retrieval server and an OHTTP gateway. It’s a candidate for a later version, not a first one.
What remains is a packet tunnel provider, the same API real VPN apps use, which is why the phone puts a VPN badge in the status bar. Ward’s tunnel claims only one route: the address of a fake DNS server. Every other packet on the phone goes where it always went. Name lookups arrive at the extension, the index answers “blocked” with a null address or forwards the query to your normal resolver, and that is the whole job. No server on my side, no traffic through anyone, and a “Why a VPN?” sheet in the app that says so in five lines. The App Store review team asked the standard three VPN questions and got the same answer.
Android is the same design with a VpnService that advertises a single /32 route and a DNS address, so the system sends it lookups and nothing else. The Android extra is a warning when Private DNS is set to strict mode, because that would carry lookups past any local filter.
On desktop, where Ward started, there is a hosts file, and a hosts file beats all of this: it works offline, under any VPN, in every browser and without trusting any resolver. The desktop app writes a managed block between markers, and a small root helper watches the file and restores it within two seconds if anything edits it. That build is done and in testing; it will ship as a direct download with the same Plus purchase.
The off switch is the product
Blocking is table stakes. The reason people pay for these apps is that they don’t trust their own future self, and the reason they leave one-star reviews is that the app either trusts that self too much (one tap to disable) or too little (pay us to leave).
Ward’s answer is a waiting time. You pick it when you’re calm: one hour, one day, one week. Turning a category off, removing a site, or disabling the filter starts a countdown, and the change lands when it ends. You can cancel the request any time before that. The lock engine is a pure function over the current state and the clock, and it is the same code, ported line for line with its tests, on both platforms.
Two things sit on top of it for Plus. An unlock code that you hand to a friend, stored as a salted hash and never shown again, which lets them open the lock early; and Freeze, which refuses every loosening request for 7, 30 or 90 days. Neither one involves screenshots, location, or a report to anyone.
What it took to make it readable
The first iPhone build was correct and unusable. I had written the interface for someone who knows what a hosts file is. The person who installs a porn blocker at 2 a.m. does not, and my own note from the device test says “too wordy, user knows nothing about hosts”.
So the second design round was a copy pass, not a layout pass. Every screen got a six-word ceiling per line and a glossary that the whole app uses consistently: Categories, My sites, Groups, Always allow, Waiting time, Unlock code, Freeze. The DNS explanation moved behind one sheet. Counts stayed only where they motivate (“168,492 sites blocked · 41 days”). The same deck drives all sixteen translations, on both platforms, from a single Python dictionary that generates the iOS string catalog and the Android resources.
What’s next
iOS 1.0 is in App Store review and the Android build is on its way to Google Play. The desktop version follows with installers for Windows, macOS and Linux. After that: alerts to the friend when the filter is turned off (the one accountability feature people actually want), Apple’s Screen Time adult filter as a second layer, and a home-screen widget that shows the count.
Ward’s product page has the screenshots and the FAQ. If you’ve been burned by one of the apps in the reviews above, the free tier is the whole filter, and it stays free.