TikTok off means off.
Apps like TikTok and Instagram are built to stay online. Block the obvious route and they quietly switch to a backup. A Shield closes the main route and the backup routes on your home network, for one phone or for the whole house. No cloud, no account, no app on the child's phone, and nothing to renew.
The 30-day home trial for AU & NZ households: if Shield isn't right for your home, send it back — prepaid label, full refund.
Why these apps shrug off most parental controls.
An app like TikTok talks to dozens of servers, shares some of them with other services, and changes them over time. To the app, a parental filter is just another outage to route around: when its main route is blocked it tries the next one, and the next.
Controls that live on the phone can be undone on the phone. The parental controls built into most modems pause a whole device or nothing. A DNS blocker closes the addresses on its list, and the list is only as good as its last update; an app that reaches a server without asking for its name isn't on the list at all.
Checked 27 September 2026: when we blocked TikTok's main route on our own Shield, the app switched to a backup route within seconds. The public TikTok service list that AdGuard Home's blocked services come from did not include that backup route.
What a Shield does instead.
- Step 1
The rule lives on your network, not on the phone.
Tick TikTok for one device on Shield Edge or Vault, or for the whole house on any Shield, and save. Nothing is installed on the phone, so there's nothing on it to uninstall or switch off.
- Step 2
Two layers close the app.
The Shield refuses the app's website lookups, and its firewall closes the addresses the app reaches without a lookup, including the backup routes it switches to. The videos already downloaded run out, then nothing new loads and the app itself reports no internet.
- Step 3
Everything else keeps working.
The rest of that phone, every other phone in the house, and every app you didn't tick. One tap undoes it. A device that tries to slip around its rules shows up on your dashboard.
On Shield Vault the same rule leaves the house with the phone, on mobile data, at school or at a friend's place, through Follow-Me Filtering. Follow-Me Filtering, on Shield Vault →
Meta's apps, one switch each.
Facebook, Instagram, Messenger and Threads share servers, which is why many filters take them all down together or none of them. On a Shield each has its own switch, tested on the real apps: Instagram off, WhatsApp still working, on the same phone.
Over 130 apps and services, by name.
TikTok and Meta's apps fight hardest, so they get the full treatment: main route and backup routes. Snapchat, YouTube, Roblox, Discord and over 130 other apps and services are in the list by name. Tick what you want off, for one device or for everyone, and set the hours if you only want it off on school nights.
Proof: one take, no cuts.
Recorded on our own Shield at home on 27 September 2026. Left, the Shield's dashboard. Right, the phone, live. TikTok is ticked for this phone and saved; the videos already downloaded run out, then nothing new loads and the app reports no internet. One tap brings it back.
Device names are stand-ins for the family's. Strangers' TikTok videos are blurred; nothing else is staged. The same rule with a second phone on the same Wi-Fi left alone →
Apps change. The list can't stand still.
In our own test TikTok switched to a backup route the moment its main one was blocked. So we test the popular apps against a Shield every month, on real phones, and when one grows a new route the next signed update closes it on every Shield. Updates install from your Shield's Update page in under a minute, or by themselves if you leave automatic updates on. There's no account to hold and no fee that can lapse: the update is a file your Shield checks for.
Side by side.
Where the rule lives
- WOMBATS Shield
- On the Shield behind your modem, for one device or for the whole house.
- DNS blockers (Pi-hole, AdGuard Home)
- On a DNS server you set up and keep running.
- Modem and router parental controls
- In the modem's settings, or in the maker's phone app.
What closes the app
- WOMBATS Shield
- Two layers: the app's website lookups are refused, and the Shield's firewall closes the addresses it reaches without a lookup, including its backup routes.
- DNS blockers (Pi-hole, AdGuard Home)
- Website lookups only, for the addresses on the lists you keep (Pi-hole describes itself as a DNS sinkhole; AdGuard Home's blocked services are DNS rules from a public list).
- Modem and router parental controls
- Varies by model. Most pause a whole device or filter by category; blocking apps by name is offered on some, usually as a paid tier run through the maker's app.
Backup routes
- WOMBATS Shield
- Closed for TikTok and Meta's apps today, and the popular apps are re-tested every month.
- DNS blockers (Pi-hole, AdGuard Home)
- Only if someone adds them to a list. The public TikTok service list AdGuard Home's blocked services come from did not include the backup route TikTok used in our test (read 27 September 2026).
- Modem and router parental controls
- Not stated by the makers we checked.
Different rules for each child
- WOMBATS Shield
- On Shield Edge and Vault, per device, with school-night hours. Whole house on Shield Core.
- DNS blockers (Pi-hole, AdGuard Home)
- Pi-hole: groups of devices. AdGuard Home: per-client settings.
- Modem and router parental controls
- Usually per device, through the maker's app.
Meta's apps
- WOMBATS Shield
- Facebook, Instagram, Messenger and Threads on their own switches; WhatsApp keeps working when the others are off.
- DNS blockers (Pi-hole, AdGuard Home)
- Separate list entries for Facebook and Instagram; whether the app keeps working after a DNS block is not something the lists claim.
- Modem and router parental controls
- Not stated by the makers we checked; eero's own help page notes that blocking Facebook does not block Messenger.
Cloud, account, subscription
- WOMBATS Shield
- No cloud, no account, no subscription. Buy once.
- DNS blockers (Pi-hole, AdGuard Home)
- Free software you install, update and troubleshoot yourself.
- Modem and router parental controls
- App blocking is commonly a paid add-on run through the maker's cloud and app (TP-Link HomeShield Pro, Netgear Smart Parental Controls Premium, eero Plus).
| Feature | WOMBATS Shield | DNS blockers (Pi-hole, AdGuard Home) | Modem and router parental controls |
|---|---|---|---|
| Where the rule lives | On the Shield behind your modem, for one device or for the whole house. | On a DNS server you set up and keep running. | In the modem's settings, or in the maker's phone app. |
| What closes the app | Two layers: the app's website lookups are refused, and the Shield's firewall closes the addresses it reaches without a lookup, including its backup routes. | Website lookups only, for the addresses on the lists you keep (Pi-hole describes itself as a DNS sinkhole; AdGuard Home's blocked services are DNS rules from a public list). | Varies by model. Most pause a whole device or filter by category; blocking apps by name is offered on some, usually as a paid tier run through the maker's app. |
| Backup routes | Closed for TikTok and Meta's apps today, and the popular apps are re-tested every month. | Only if someone adds them to a list. The public TikTok service list AdGuard Home's blocked services come from did not include the backup route TikTok used in our test (read 27 September 2026). | Not stated by the makers we checked. |
| Different rules for each child | On Shield Edge and Vault, per device, with school-night hours. Whole house on Shield Core. | Pi-hole: groups of devices. AdGuard Home: per-client settings. | Usually per device, through the maker's app. |
| Meta's apps | Facebook, Instagram, Messenger and Threads on their own switches; WhatsApp keeps working when the others are off. | Separate list entries for Facebook and Instagram; whether the app keeps working after a DNS block is not something the lists claim. | Not stated by the makers we checked; eero's own help page notes that blocking Facebook does not block Messenger. |
| Cloud, account, subscription | No cloud, no account, no subscription. Buy once. | Free software you install, update and troubleshoot yourself. | App blocking is commonly a paid add-on run through the maker's cloud and app (TP-Link HomeShield Pro, Netgear Smart Parental Controls Premium, eero Plus). |
Happy with your Pi-hole? Good, keep it. The longer comparisons are at Shield vs Pi-hole and Shield vs modem controls, and the map puts all of them next to a Shield on one page.
Founding Edition
Whole-house app blocking from $424 AUD, inc GST (Shield Core) · rules for each child's device from $524 (Shield Edge) · the same rules on the kids' phones away from home, Shield Vault $724
Founding prices for the first 20 numbered Shields. Standard prices from unit 21: Core $574 · Edge $664 · Vault $914, plus $25 delivery in Australia.
Pay in 4: From $106.00 a fortnight with Afterpay or PayPal, interest-free — or Zip, with weekly, fortnightly or monthly repayments on Zip's terms. The total is the same either way.
30-day home trial for households in Australia and New Zealand · 12-month warranty plus Australian Consumer Law · Security updates until at least 31 December 2029
Compare all three models →Everything a Shield filters →All the short videos →
Common questions.
Will it block TikTok on my child's phone but not on mine?
Yes, on Shield Edge and Shield Vault: each device carries its own app rules, and you can add school-night hours to them, so TikTok is off on one phone from 9 pm and nothing changes on yours. On Shield Core, app blocking applies to the whole house at once.
Does blocking Instagram break WhatsApp?
No. Facebook, Instagram, Messenger and Threads each have their own switch, and WhatsApp keeps working when the others are off. We test that on the real apps, on real phones, because Meta's apps share servers and many filters can't separate them.
Our router says it blocks apps. Why didn't it stick?
Most router controls pause a whole device or filter by category, and the ones that block apps by name rely on a list of addresses. Apps like TikTok are built to switch to a backup route the moment the usual one is blocked, and to reach some servers without asking for their names at all. A Shield closes the backup routes too, at the network, through the website lookups and the firewall on the Shield itself, and we re-test the popular apps every month.
Does it stop them watching TikTok in the browser instead?
Yes. The rule is for the service, not the app icon, so TikTok in Safari or Chrome goes nowhere on that device either. Installing apps is the phone's own job (Screen Time and Family Link do that well); once TikTok is installed, the Shield decides whether it gets anywhere.
Can they get around it with a VPN?
The common ways around a filter are shut at the network: a device's own DNS settings, encrypted-DNS apps and Apple Private Relay. A determined user on a managed device can still use a VPN to tunnel out. You'll see them: the device's row on your dashboard shows whether its traffic is going through the Shield.
Does it work on mobile data, away from home?
On Shield Vault, through Follow-Me Filtering: the phone connects back to your own Shield through a free app, so the same app rules apply on mobile data, at school or on a friend's Wi-Fi. The phone's owner can switch it off, and it depends on your home internet.
This comparison is based on publicly available information from each maker’s own website and documentation, reviewed 27 September 2026. Pi-hole, AdGuard Home, TP-Link, Netgear, eero are trademarks of their respective owners; WOMBATS Shield has no affiliation with, and no endorsement from, the companies or projects mentioned. Spot something outdated or unfair? Email hello@wombatss.com and we’ll fix it.