StevenBlack/hosts: A Merged Blocklist You Install as a Hosts File
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
At a glance
- What is it?
- The repository aggregates several curated hosts files into a single deduplicated blocklist, with 31 optional variants for porn, gambling, social media and fake news. It is a build system and a publishing pipeline, not a filtering engine, and that distinction decides who should use it.
- Who is it for?
- Adopt StevenBlack/hosts if you want one deduplicated hosts file covering adware and malware, or a named variant such as alternates/social/hosts, and you are willing to run make test after each rebuild because a hosts file has no per-entry disable list. Do not adopt it as a DNS server, a per-app filter, or anything that needs block statistics, since the mechanism is a local name lookup override and nothing more.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 2 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The problem is blocklist maintenance, not blocking itself
A hosts file blocks by mapping a domain to a dead address. The hard part was never the mapping. It is keeping thousands of entries current across several independent curators, each with its own format, its own false positives, and its own update cadence. StevenBlack/hosts exists to absorb that work. The README describes the repository as a hosts file aggregator that consolidates several reputable hosts files and merges them into a unified hosts file with duplicates removed. The base variant, labeled adware plus malware, is published with 79,962 unique domains as of the last update noted in the README, September 09 2026. The audience is anyone who wants domain-level blocking without running a filtering daemon: a home router with a writable hosts file, a single workstation, a lab machine. It is a poor fit for anyone who needs per-user policy, category toggles at request time, or logs of what got blocked.
Aggregation pipeline: data sources in, one deduplicated file out
The repository is a Python build system with a data directory. Curated sources live under hosts/data/, and the README states that the contact information for all contributing data sources can be found in that directory. The build reads those sources, normalizes them into hosts-file syntax, removes duplicate domains, and writes the result to the repository root as hosts. That output is what consumers download. Two consequences follow from this design. First, the published file is a build artifact, so the right way to consume it is to download the artifact rather than the history: the README warns that cloning can take a long time and recommends git clone --depth 1 to avoid pulling the full history back to 2018. Second, the README draws a support boundary around content. Issues about what is in the produced file, other than changes to hosts/data/StevenBlack/hosts, are directed to the upstream data source that contributed the entry. If a domain you rely on is blocked, the aggregator is often not the place that decided it should be.
The alternates tree is the real feature
Beyond the base file, the repository offers 31 host file variants under alternates/, as listed in the README table, with and without the unified hosts included. The naming is systematic. A variant such as alternates/porn/hosts is the unified list plus the porn category, and the README gives it 156,146 unique domains. A variant such as alternates/porn-only/hosts drops the unified base and keeps just that category, at 76,771 domains. The same pattern repeats for fakenews (2,187 domains in fakenews-only), gambling (6,644 in gambling-only), and social (3,808 in social-only), plus combinations such as fakenews-gambling. The category-only files are the interesting ones for a specific reason: they let you compose your own list instead of accepting the aggregator's default. If you want gambling and social blocked but not the full adware and malware set, the -only files give you the raw material. The README also lists a non-GitHub mirror at sbc.io for each variant, which it says is needed by some hosts file managers such as Hostsman for Windows that do not work with GitHub download links. That mirror is a practical detail, not a footnote: on Windows, the raw GitHub URL may simply fail in your update tool.
Running the build yourself
The repository ships a Makefile, and the README's build instructions center on it. The canonical invocation is make, which runs the update script and produces the hosts file. The Python entry point is updateHostsFile.py, and the README documents its flags, including -a for auto mode. According to the README, python3 updateHostsFile.py -a performs a fully automated run: it reads the sources, merges them, and writes the output without prompting. Interactive mode exists as the alternative, and it is the path to the optional extensions. The README describes being prompted for extensions such as porn, social media, and other categories during an interactive run, which is how the alternates are generated rather than downloaded. Verification is also part of the documented workflow: make test is the target the project provides for checking the generated output. The repository is written in Python and formatted with black, per the badge in the README. There is no server component, no daemon, and no configuration file to learn beyond the script flags and the Makefile targets. That is the whole operational surface, and it is small on purpose.
Where a hosts file stops working
The core limitation is structural, not a defect in this repository. A hosts file intercepts name resolution on the machine that reads it, and only there. It does not see DNS-over-HTTPS traffic that bypasses the system resolver, it does not cover other devices on your network unless you distribute it to them, and it cannot distinguish one application from another. It also produces no telemetry. You get a blocked domain and a connection failure, not a count of what was blocked or by which process. The size of the larger variants matters too. The porn variant is listed at 156,146 unique domains, and every lookup on the machine consults that list, so on constrained hardware the resolver's read cost is a real consideration, though the README does not publish lookup timings. The second limitation is content-level and more annoying in practice. Because the output is a merged file, there is no per-entry disable list. If a merged domain breaks a service you use, your options are to edit the generated file by hand, which the next build overwrites, or to take it up with the upstream data source that contributed the entry, which is exactly the boundary the README draws. The third case where this is the wrong tool is anything requiring category policy per user or per group. A hosts file is global to the host. If you need role-based filtering, this is not the layer to solve it at.
Compared with a filtering DNS resolver
The obvious alternative is a DNS-based blocker such as Pi-hole, which takes a similar input (blocklists, and it can consume the lists this project publishes) but operates at a different layer. A resolver answers queries for every device pointed at it, so one installation covers a phone, a laptop, and a smart TV without touching each hosts file. It can log queries, show per-client statistics, and let you allow a domain temporarily from a web interface without editing a file. The trade-off runs the other way as well. A resolver is a service you have to run, keep updated, and keep available; if it goes down, name resolution for everything behind it goes down with it. StevenBlack/hosts has no runtime. It is a file, and the failure mode of a stale file is a stale file, not an outage. The choice comes down to whether you want coverage across devices with observability (resolver) or a zero-daemon, per-machine override that never becomes a single point of failure (hosts file). The two are not mutually exclusive, since a resolver can import these lists, but they are different operational commitments.
Licence, release cadence and the cost of staying current
The repository is MIT licensed. For the code that is straightforward, but the MIT grant covers the build scripts; the merged content comes from multiple upstream sources, each with its own terms, and the README points to hosts/data/ for their contact information. If you redistribute the generated hosts file inside a product, checking the upstream licences in that directory is the step that matters, and this is not legal advice. On maintenance, the release history shows a fast cadence: 3.16.111, 3.16.112, and 3.16.113 landed within roughly ten days in August and September 2026. That cadence is the cost model. If you consume the published file, your ongoing work is a scheduled download and a reload of the resolver or hosts file. If you build it yourself, your ongoing work is keeping the Python environment working and re-running make; the README notes the code is black-formatted, so a rebuild after a Python or dependency change is the realistic breakage point. There is no migration path to plan for and no database schema, which is the upside of a build that emits a text file.
Editorial conclusion
Adopt StevenBlack/hosts if you want one deduplicated hosts file covering adware and malware, or a named variant such as alternates/social/hosts, and you are willing to run make test after each rebuild because a hosts file has no per-entry disable list. Do not adopt it as a DNS server, a per-app filter, or anything that needs block statistics, since the mechanism is a local name lookup override and nothing more. Before deploying, verify three things: whether your resolver reads the hosts file before DNS, which variant file matches the categories you actually want blocked, and how you will re-run python3 updateHostsFile.py -a when a domain you need gets merged into the list.
Community notes