How to block a program from the internet on Windows

Maybe a program keeps updating itself, shows ads, or you simply don't want it to send anything home. Windows can stop it from going online with its own firewall. It takes about five minutes, and you can undo it at any time.

1. First, find the program's file

A firewall rule is made for one program file, the one ending in .exe. You need its full path, for example C:\Program Files\MyApp\MyApp.exe.

• If the program is running: press Ctrl + Shift + Esc to open Task Manager, right-click the program › Open file location. The folder opens with the file selected.
• From a shortcut: right-click the shortcut on the desktop or in the Start menu › Properties (or More › Open file location first). The Target field shows the path.
• Copy the path: in File Explorer, hold Shift, right-click the file › Copy as path.

Some programs use more than one file: a main program, an updater and helpers. If the program still gets online after you blocked it, look in its folder for other .exe files, such as update.exe or helper.exe, and block those too.

2. Block it with Windows Defender Firewall (step by step)

1. Press Windows key + R, type wf.msc and press Enter. This opens Windows Defender Firewall with Advanced Security. (You can also search the Start menu for "Windows Defender Firewall" and click Advanced settings.)
2. On the left, click Outbound Rules. On the right, click New Rule…
3. Choose Program and click Next.
4. Choose This program path, click Browse… and pick the program's .exe file (or paste the path). Click Next.
5. Choose Block the connection. Click Next.
6. Leave Domain, Private and Public all ticked, so the block works on every network (home, work, café Wi-Fi). Click Next.
7. Give the rule a name you will recognise later, for example Block MyApp, and click Finish.

The rule works at once; you don't need to restart. A block rule wins over any allow rule for the same program, so the program stays offline even if it created its own allow rule.

To undo it: open wf.msc › Outbound Rules, find your rule, right-click › Disable Rule (to switch it off for now) or Delete.

3. The same in PowerShell

Right-click the Start button › Windows PowerShell (Admin) or Terminal (Admin), then type (with your own path):

New-NetFirewallRule -DisplayName "Block MyApp" -Direction Outbound `
  -Program "C:\Program Files\MyApp\MyApp.exe" -Action Block

The back-tick ` at the end of the first line just continues the command on the next line. You can also type it all on one line.

Useful extras:

# See the rule
Get-NetFirewallRule -DisplayName "Block MyApp"

# Switch it off for now, and on again
Disable-NetFirewallRule -DisplayName "Block MyApp"
Enable-NetFirewallRule -DisplayName "Block MyApp"

# Remove it
Remove-NetFirewallRule -DisplayName "Block MyApp"

# Block every .exe in a program's folder (one rule per file)
Get-ChildItem "C:\Program Files\MyApp" -Recurse -Filter *.exe | ForEach-Object {
  New-NetFirewallRule -DisplayName "Block MyApp - $($_.Name)" -Direction Outbound -Program $_.FullName -Action Block
}

On older Windows versions, or in a Command Prompt run as administrator, netsh does the same:

netsh advfirewall firewall add rule name="Block MyApp" dir=out action=block program="C:\Program Files\MyApp\MyApp.exe"

4. Check that it works

1. Start the program. It should now say it is offline, can't connect, or can't check for updates.
2. To see it for yourself: press Windows key + R, type resmon, open the Network tab. The program should not appear under TCP Connections with an internet address.
3. If it still gets online, look for a second .exe (see step 1), or check whether the program was updated into a new folder. A rule only covers the exact path it was made for.

5. Good to know

• It blocks your home network too. A Windows block rule stops the program everywhere, also from reaching your printer or NAS. To allow only your own network, you would have to limit the rule's Scope to certain addresses yourself.
• Programs from the Microsoft Store are packaged differently. A rule for their .exe may not catch them.
• Programs that update themselves into a new folder (with the version number in the path) escape the rule after the update. Check your rules after big updates.
• Blocking every program by default is possible: in the firewall's properties, set Outbound connections to Block, then make an allow rule for every program that may go online. Windows does not ask you about new programs, so this is a lot of work, and things quietly stop working until you find out why.
• A firewall rule is not a virus scan. If you think a program is harmful, remove it and run a scan in Windows Security.

6. Decide once per program, without the work: Coinetic

Doing this by hand means: finding each program's file, making one rule per file, checking again after every update, and never seeing the new programs that went online without asking. Windows lets every program connect out by default, and it doesn't tell you when a new one does.

Coinetic works through the Windows Firewall that is already on your Server or PC. Coinetic is not an antivirus, and no tool can promise 100% security, but you decide who may go online:

• Every new program asks once: switch on outbound control and each new program that wants to go online asks you one time, then never again. Choose Allow, LAN only (your own network, no internet), allow only one address, or Block. Outbound control is in every plan.
• A plain recommendation: the question shows who published the program and whether its digital signature is valid, where it wants to connect, and a recommended choice with the reason. A program without a signature that calls the internet gets the recommendation Block.
• Allow just for now: allow a program for 1 hour, 8 hours or until the computer restarts. When the time is up, Coinetic asks again.
• Updates don't break your choice: Allow (all versions) trusts a program by name in every version signed by the same publisher, also when it updates into a new folder. A look-alike with the same name is asked about again.
• One list of every decision: the Programs page shows every program and what you decided. Change it, block it, or remove the decision so the program asks again.
• Strange behaviour stopped by itself: Coinetic learns what is normal for your computer for 7 days. A program that then suddenly contacts many addresses, scans other computers or sends mail like spam malware is cut off from the internet automatically, and you can release it with one click.
• All of this at any time: the Connections page and the live log show which program talks to which address, right now and with country and owner, not just when you happen to look. The protection service keeps your choices working in the background, also when nobody is logged on.
• Your AI security analyst (Pro + AI): right-click any line, program or connection and choose Ask AI, e.g. “What does this program connect to, and is it safe to block it?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.

More guides: all Coinetic guides.

Frequently asked

Can I block a program from the internet without extra software?

Yes. Windows Defender Firewall, which is part of every Windows 10 and 11, can do it with an outbound rule, as shown above. No download is needed.

Will blocking a program break it?

Most programs work fine offline; they just can't update, sync or show online content. Some need the internet to start or to check their license. If that happens, disable the rule again.

Why does "Allow an app through Windows Firewall" not block it?

That list only controls connections coming in to your PC. By default, Windows lets every program connect out. To stop a program going online, you need an outbound rule.

How do I block a program only from the internet but keep my home network?

In Windows, edit the rule's Scope so it blocks only addresses outside your network; this takes some care with address ranges. In Coinetic it is one choice: LAN only.