Download
Menu Close
Download

What AdHole blocks, and what it doesn’t

No ad blocker stops every ad. Here is exactly what AdHole removes — on this computer, on the devices you point to it, and on an Android phone — and what it can’t.

  • This computer
  • TV, console, phone
  • Its limits too

The table

Two filters, three reaches.

The page filter works on this computer, and on an Android phone whose certificate you have installed. The DNS filter works for this computer, for every device whose DNS you set to it, and on the phone for every app.

On this computer This computer TV, console, phone (DNS pointed to the computer) TV, console, phone Android phone with the app Android phone
Ads and trackers served from ad servers Yes Yes Yes
Ad slots inside web pages Hidden No: the slot may stay empty Hidden in browsers, with the certificate
Ads inside apps Partly: what comes from an ad network Partly: what comes from an ad network, never inside the app
YouTube video ads Yes, in the browser No In the browser, with the certificate; never in the YouTube app
Cookie banners Rejected, when the site offers “reject all” No Rejected in browsers, with the certificate, when the site offers it
TV home-screen ads Partly
Twitch, Netflix, Prime Video ad tiers No No No
“Accept or pay” consent walls Removal off by default No Removal off by default
Paywalls (subscriber-only content) Never removed Never removed Never removed

No blocker stops every ad. Some will get through, and a site may occasionally look broken: one line in the dashboard, to allow that site, usually fixes it.

What it can’t do

What AdHole doesn’t block.

  • YouTube in the app of a TV, a console or a phone

    Inside the YouTube app, AdHole doesn’t remove YouTube ads: they come from the same servers as the video. Removing them takes a change inside the app itself, and a PlayStation or a locked-down TV accepts none. In a browser they do go — on this computer, and on an Android phone whose certificate you have installed.

  • Twitch, Netflix, Prime Video

    Their plans with ads keep their ads, on this computer as on the TV.

  • TV home screens: partly

    Pointing a TV’s DNS to AdHole removes part of its home-screen ads, not all of them.

  • Empty ad slots on your other devices

    The DNS filter stops the ad from loading; it can’t hide the empty space where it was. Ad slots are only hidden by the page filter: on this computer, and in the browsers of an Android phone with the certificate installed. On a TV, a console, or inside any phone app that isn’t a browser, the blank space stays.

  • Devices you haven’t pointed at it

    Each device’s DNS is set by hand, once. AdHole doesn’t change your devices’ settings for you, and a device that doesn’t use it isn’t filtered.

  • The sites left encrypted

    AdHole never looks inside payment, banking, tax and health sites on a built-in list, so it doesn’t filter them either. The Android app starts from the same list, and never opens those sites in a browser either. That list is built around French services and is not complete: add your own bank, health insurer or employer in the settings.

  • Paywalls and “accept or pay” walls

    AdHole never unlocks content reserved for subscribers. Pop-ups that demand your consent without a free way to refuse are removed only if you turn that on in the settings, and it doesn’t recognise them all.

  • Every last ad

    Some ads will get through, and a site may occasionally look broken. One line in the dashboard, to allow that site, usually fixes it.

  • What YouTube may change

    Google is testing ads stitched into the video itself. If that becomes the norm, no blocker will be able to remove them this way, AdHole included.

On Android

What the Android app reaches.

The Android app filters domain names on the device itself, for every app, on Wi-Fi and on mobile data: the second column of the table above follows the phone wherever it goes. It carries the page filter as well, so the first column applies too — for the browsers of the phone, and only once you have installed the certificate the app makes on the device. Ad slots hidden, cookie banners refused, YouTube’s video ads removed, in the browsers you leave switched on.

And nothing beyond that. Android doesn’t let one app read another app’s encrypted traffic, and AdHole doesn’t try: inside a game, a news app or the YouTube app, only the domain filter reaches the ads, and the blank space a blocked banner leaves stays where it was.

What the certificate asks of you: you install it yourself, in Android’s settings, and you take it out yourself — uninstalling the app leaves it in Android’s store. Firefox asks for one setting of its own. While pages are being cleaned, browsers are kept off HTTP/3, so a page may load a little differently. And page cleaning needs Android 10: below that, the name filter alone applies, from Android 8.0.

Two limits belong to the phone alone. A rewarded ad in a game is blocked like any other, and a game that has shown no ad hands out no reward. And Facebook Audience Network is served by the same host as Facebook login, so the lists let it through rather than lock you out of your account.

Block ads on Android: what we measured, and when

Before you install

What comes with it.

  • Your computer has to stay on

    Devices pointed at this computer lose internet access when it’s off or asleep. An always-on Raspberry Pi suits this role well.

  • A root certificate on each device that cleans pages

    It’s created on the machine that uses it — your computer, and your Android phone if you turn page cleaning on there — and its private key never leaves it. Anyone who copied that key could read your traffic: never copy the “ca” folder in AdHole’s data. On a computer, uninstalling removes the certificate; on Android, you take it out by hand, in Android’s security settings, under Encryption & credentials → User credentials (labels vary by manufacturer).

  • An unsigned installer

    Windows shows “Windows protected your PC” and “Publisher: Unknown”. Check the file’s SHA-256 before running it.

  • A crash cuts what’s running

    Pages keep opening and the service restarts on its own, but a download or a video call running at the moment of a crash is cut.

  • An anonymous statistic, on by default

    On a computer, at each start and then once a day; on Android, when you check for updates: a random number replaced every month, the version, the system, and the number of requests blocked since the previous check, which feeds the total shown on this site. One switch in the settings turns it off and deletes the number.

  • A dashboard without a password

    Anyone who uses this computer can open the dashboard and change the settings.

  • Windows: one account for the page filter

    Page and YouTube filtering applies to the account AdHole was installed from. The DNS filter covers the whole computer.

  • Firefox needs one setting

    On Windows, Firefox has its own certificate store: in about:config, set security.enterprise_roots.enabled to true. On Android, Firefox has a setting of its own for third-party CA certificates, to turn on in the browser.

  • Linux: GNOME and KDE for the automatic proxy

    Elsewhere, you set the proxy by hand. There’s no icon near the clock, and Chrome and Firefox get the certificate only if certutil is installed.

  • Android: a file to install by hand

    The Android app isn’t distributed through a store. You allow your browser to install it once, Android shows its warnings, and updates arrive when you fetch them. Cleaning the pages of its browsers asks for one more thing: the certificate, installed by hand in Android’s settings, on Android 10 or newer.

  • Not offered on Mac

    AdHole installs on a Windows or Linux computer, and on Android. It is not offered on Mac.

Why Windows warns, and how to check the file