GuardLock

GuardLock

A content filter that installs into a browser that has none — works in private windows, cannot be switched off without your PIN, and provisions a brand-new VM in one command.

Download for EdgeAlso Chrome, Brave, Opera Download for FirefoxNeeds signing for permanent install

Source code and full documentation on GitHub

What it does

Blocks by categoryAdult, gambling, social, streaming and games. Subdomains included automatically.
Subscribes to blocklistsPoint it at any public hosts file or domain list for coverage in the hundreds of thousands.
Catches unlisted sitesWeighted keyword rules on the address and on the page text itself.
Forces SafeSearchGoogle, Bing, DuckDuckGo, Yahoo, Yandex and more, plus YouTube Restricted Mode.
Number lock4–12 digit PIN on a keypad, hashed with PBKDF2. Wrong tries trigger a growing lockout.
Nothing leaves the deviceNo account, no server, no telemetry. Lists and PIN stay in the browser.
Provisions a whole VMOne command lays down the policy; the browser comes up locked with no setup wizard.

Every new VM, without the clicking

Installing by hand is fine once. It is not fine for the fifth VM this month. GuardLock reads its whole configuration — including the PIN — from browser policy, so a freshly built machine comes up already filtered and already locked: no setup wizard, no window where the browser is open and unfiltered, and nothing to pay per machine.

One command on a fresh Linux box:

curl -fsSL https://www.linearit.co/filter/guardlock/install/install.sh \
  | sudo bash -s -- --pin 4821 --categories adult,gambling

Or on Windows, from an elevated PowerShell:

& ([scriptblock]::Create((irm https://www.linearit.co/filter/guardlock/install/install.ps1))) -Pin 4821

Both hash the PIN locally, write the policy for Edge, Chrome and Firefox, and drop a copy of the extension in a fixed place. Re-running is safe, --uninstall reverses it, and --dns will also point the machine at a filtering resolver so it is covered before any browser even starts. Add --categories, --allow, --block, --lists or --no-private to taste.

What "already locked" means.

The policy carries a PBKDF2 hash of your PIN, never the digits. Settings the policy pins are greyed out and refuse to change even for someone holding the PIN — they are changed in the policy, not in the browser. Because there is no setup step there is also no recovery code, so keep the PIN somewhere safe.

Policy configures GuardLock; something still has to install it. Firefox is the easy one — it force-installs a signed .xpi straight from a URL and grants private-window access without anyone ticking a box. For Edge and Chrome, either publish once to the Edge Add-ons store (free) and pass --ext-id, or host it yourself with npm run pack-crx. Failing both, the installer still leaves a copy on disk and pre-authorises the id Chromium will give it, so one "Load unpacked" is all that remains — and even then the browser comes up locked and configured.

Install on Edge

  1. Unzip the download somewhere permanent — the folder has to stay put, Edge loads it from there.
  2. Open edge://extensions and turn on Developer mode.
  3. Click Load unpacked and choose the unzipped folder.
  4. Click Details on GuardLock and turn on Allow in InPrivate.
  5. GuardLock opens its setup page. Choose a PIN and write down the recovery code.

Chrome, Brave and Opera take the same steps at chrome://extensions.

Install on Firefox

Firefox only installs signed add-ons permanently. To try it now, open about:debugging#/runtime/this-firefox → Load Temporary Add-on → pick manifest.json from the unzipped folder. It goes away when Firefox closes.

For a permanent install, sign it once with a free Mozilla developer account:

  1. Get an API key at addons.mozilla.org.
  2. Run npx web-ext sign --channel=unlisted inside the unzipped folder.
  3. Open the signed .xpi it hands back to install it.
  4. In about:addons → GuardLock → Details, set Run in Private Windows to Allow.
Private windows need one manual switch.

Every browser keeps extensions out of private windows until a person allows it by hand — no extension can grant itself that. GuardLock checks whether it has the access, marks the toolbar icon amber when it does not, and puts the fix at the top of its settings. On a computer you administer, the surer route is to switch private browsing off entirely; the enterprise folder in the download has ready-made Firefox and Edge policy files that do that and also make the extension impossible to remove.

Worth knowing

← Back to content filters