How to Whitelist a Pi-hole Site for One Device Only

Pi-hole is brilliant at blocking ads and trackers across your whole home, but sometimes it blocks too much. A banking app stops working, a school portal will not load, or a game cannot connect on just one laptop or phone. Whitelisting that site for the whole house would fix it, but it also weakens protection for everyone else.

The good news is that Pi-hole lets you apply rules to a single device only. You do this with Groups and Clients. Once you understand that system, you can keep strict blocking for most devices and allow a site only where it is really needed.

Quick Answer

To whitelist a site for one device only in Pi-hole, add the device as a Client using its IP or MAC address, create a new Group for that device, move the client into that group, and then add the domain as an Exact Whitelist entry assigned only to that group. The site will then load on that device while staying blocked for every other device on your network.

Why Pi-hole Blocks Too Much in the First Place

Pi-hole works by checking every DNS request against blocklists. If a domain appears on one of those lists, Pi-hole returns no real address and the site or service cannot load. Most lists are well maintained, but they are also broad.

Common Reasons for Over-Blocking

• You added several large blocklists that overlap and include shared services.
• A site uses the same domain for ads and for login, video, or payments.
• An app needs a tracking domain to unlock a feature or reward.
• A smart TV, console, or work laptop needs a domain that others do not.

Before you whitelist anything, confirm that Pi-hole is really the cause. Turn off blocking for 30 seconds from the Pi-hole dashboard and try the site again. If it works, check the Query Log, filter by your device, and look for red blocked entries at the exact time you tried to load the site. Those red domains are the ones to consider whitelisting.

How Groups and Clients Work in Pi-hole

By default, every device belongs to the Default group. Any whitelist or blacklist entry assigned to Default applies to everyone. Groups let you split that behaviour.

A Client is a single device, identified by its IP address or MAC address. A Group is a collection of clients. A domain rule can be assigned to one group, several groups, or no group. If you create a group called One Device Allow, put only one laptop inside it, and assign a whitelist rule to that group alone, only that laptop gets the exception.

You can learn more about this model in the Pi-hole documentation on group management, which explains how clients and lists work together.

Step-by-Step: Whitelist a Site for One Device Only

Step 1: Give the Device a Fixed IP Address

This step is important. If the device gets a new IP address from your router tomorrow, Pi-hole may stop recognising it and your rule will stop working.

1. Log in to your router admin page.
2. Find the DHCP reservation or static lease section.
3. Find the device by its name or MAC address.
4. Reserve its current IP address so it always gets the same one.
5. Restart the device Wi-Fi or reconnect it so it picks up the reservation.

Step 2: Create a New Group

1. Open the Pi-hole admin page and log in.
2. Go to Group Management > Groups.
3. Enter a clear name such as Single Device Exceptions.
4. Add a short description so you remember why the group exists.
5. Click Add and make sure the group is enabled.

Step 3: Add the Device as a Client

1. Go to Group Management > Clients.
2. Pi-hole may already list the device if it has made DNS queries. Select it if it is there.
3. If it is not listed, enter its IP address or MAC address manually.
4. Add a comment such as the owner name or device type.
5. Click Add.

Step 4: Assign the Client to Your New Group

1. Stay on the Clients page and find the client you just added.
2. Use the group assignment controls to untick Default if needed and tick your new group.
3. Keep the client in Default as well if you want it to keep all normal blocklists. In most setups you should keep Default ticked for blocking, and use the new group only for the extra whitelist rule. A client can belong to more than one group, and rules from all its groups apply.
4. Save the change.

Step 5: Find the Exact Domain to Whitelist

Do not guess the domain. Open the site or app on the device, let it fail once, then open Query Log in Pi-hole. Filter by the client IP address and look for blocked domains in red from the last few minutes. Often there is one main domain, but sometimes there are two, such as a login domain and a content delivery domain. Note them exactly as shown.

Step 6: Add the Whitelist Entry for That Group Only

1. Go to Domains > Whitelist or Group Management > Domains, depending on your Pi-hole version.
2. Enter the domain exactly, for example example.com.
3. Choose Exact Whitelist, not Regex, unless you have a clear reason to match subdomains.
4. Add a comment explaining why you allowed it and for which device.
5. In the group assignment, select only your new single-device group.
6. Click Add to Whitelist.

Now test. On the allowed device, close and reopen the browser or app and load the site again. On a second device, try the same site. It should still be blocked there. Check the Query Log again. The allowed device should now show the domain as permitted.

What If the Site Still Does Not Load?

Sometimes one domain is not enough. Many modern sites load resources from several domains. Repeat the Query Log check and look for other blocked domains requested by the same device at the same second. Add them one at a time and test after each addition. Stop as soon as the site works. Adding ten domains at once leaves you with a wider hole than you need.

Also clear the device cache. Browsers remember failed DNS results for a short time. Close the browser fully, toggle Wi-Fi off and on, or restart the device. On Windows you can run ipconfig /flushdns. On macOS you may need to restart the browser. Give Pi-hole a minute after saving before you judge the result.

If you use Pi-hole with other network tools, our guide to setting up Pi-hole on a Raspberry Pi for network-wide ad blocking covers the base install and router settings that this fix builds on.

Common Mistakes to Avoid

• Whitelisting for Default by accident: Always check the group tick boxes before saving. Default means everyone.
• Skipping the fixed IP: Without a DHCP reservation the device changes address and the exception silently stops working, or worse, applies to a different device that later gets that address.
• Using Regex when Exact will do: A broad regex can allow many subdomains you never intended to allow. Start exact and widen only if testing proves you must.
• Whitelisting the whole site from a search guess: Always take the domain from your own Query Log, not from a forum post for a different version of an app.
• Forgetting to test on a second device: The whole point is one-device access. If you never test elsewhere, you will not notice a rule that applies to everyone.
• Leaving old exceptions forever: Add a comment with a date and review exceptions every few months. Remove ones you no longer need.

Tips for Safer, Cleaner Exceptions

Name groups by purpose. Keep one exception group per device, so you can remove a laptop from its group in seconds when it is replaced. Keep a short dated note in the comment field for every entry.

Conclusion

You do not have to choose between a broken app on one device and weaker blocking for your whole home. With a fixed IP, a dedicated group, a correctly assigned client, and an exact whitelist entry for that group only, Pi-hole gives you precise control. Test on the allowed device and on another device, keep the exception as narrow as possible, and review it from time to time. That keeps your network protected while letting the one device that needs an exception get on with its work.

Frequently Asked Questions

Will whitelisting for one device affect other devices?

No, not if the whitelist entry is assigned only to the group that contains that one device. Devices that are not in that group keep the normal blocked behaviour. Always verify by testing the same site on a second device after you save the rule.

Should I identify the client by IP or MAC address?

Either can work. A reserved IP address is easy to understand and works in most home setups. A MAC address can be more stable on the same local network, but some phones use randomised MAC addresses per network, so check that setting. Pick one method and make it consistent.

What is the difference between Exact and Regex whitelist?

Exact matches one domain exactly as written. Regex uses a pattern and can match many domains or subdomains at once. Regex is powerful but risky for beginners. Use Exact first and only move to Regex if a service truly needs a pattern of changing subdomains.

Why did my one-device rule stop working after a few days?

The most common cause is the device getting a new IP address because it had no DHCP reservation. Another cause is the device using a private or randomised MAC address that changed. Fix the reservation in your router, update the client entry in Pi-hole, and test again.

Can I whitelist a site for one device for a limited time only?

Pi-hole does not have a built-in timer for a single whitelist entry. You can disable the entry manually when you no longer need it, or remove the client from the exception group. Add the date in the comment so you remember to review and remove it later.