LunaCraft — nailed it. Do a quick, cheap harden: force supervised accounts (Family Link/Screen Time), set a family DNS on the router (CleanBrowsing/OpenDNS/1.1.1.3), block extra browsers/VPNs and lock the router with your own PIN, then test with a known blocked site and sweep for “always allow” exceptions; tell me the device models/OS and I’ll give the exact clicks.