Block Outbound Internet Access Per App on Windows

To stop a Windows app from connecting to the internet while leaving other apps online, create an outbound rule in Windows Defender Firewall with Advanced Security. You’ll need the app’s executable file path and an administrator account; the rule can be removed or disabled later.

What You’ll Need

A Windows PC and an account with administrator privileges.
The full path to the app’s executable file (.exe). A desktop shortcut can help you find it.
The app open or installed, so you can verify afterward whether its internet connection is blocked.

Step-by-Step

Find the correct executable. Right-click the app’s desktop shortcut or Start menu shortcut and select Open file location, if available. In File Explorer, right-click the app shortcut, select Properties, and check the Target field. It may contain a path in quotation marks; use the path to the actual .exe, not the shortcut (.lnk) or a launcher if the app uses a separate executable. If the app is already running, open Task Manager with Ctrl+Shift+Esc, find the process, right-click it, and choose Open file location. Some protected or packaged apps do not expose a usable path this way.
Open the advanced firewall console. Press Start, type Windows Defender Firewall with Advanced Security, and open it. You can also press Win+R, enter wf.msc, and press Enter. Approve the administrator prompt if one appears.
Start a new outbound rule. In the left pane, select Outbound Rules. In the right pane, select New Rule…. Choose Program, then select Next.
Choose the program file. Select This program path, then browse to or paste the full path of the app’s .exe. Check that the selected file is the one that runs the app, then select Next.
Block the connection. Choose Block the connection and select Next. This is the action that prevents the chosen program from sending outbound network traffic covered by the rule.
Choose when the rule applies. Leave Domain, Private, and Public selected to block the app on all Windows network profiles. Clear a profile only if you deliberately want the app to be blocked on some network types but not others. Select Next.
Name and save the rule. Give it a clear name, such as Block outbound – AppName, and optionally add a description. Select Finish. The rule should appear in the Outbound Rules list and be enabled.
Test the result. Close and reopen the app, then try a feature that needs the internet. Some programs show an offline message; others may keep working with cached data. If the app still connects, check the troubleshooting section before assuming the rule has failed.

Common Mistakes

Blocking the wrong file: A shortcut, updater, launcher, or helper process may be different from the executable that makes the connection. Identify the process that needs internet access and create a rule for its actual .exe.
Creating an inbound rule: Inbound rules control connections coming into your PC. For an app’s outgoing internet traffic, use Outbound Rules.
Choosing “Allow the connection”: The rule must use Block the connection. Review the rule’s Action if you are unsure.
Applying the wrong profiles: A rule limited to one profile may not apply when Windows changes the network classification. Select all three profiles if you want the block everywhere.
Expecting one rule to cover every component: An app may use a separate updater, background service, or helper executable. Blocking the main app does not automatically block those other programs.

Tips

Use a descriptive name and note the executable path in the description. This makes the rule easier to recognize and maintain.
To change or undo the block, return to Outbound Rules, find the rule, and right-click it. Choose Disable Rule to temporarily stop applying it, or Delete to remove it. Disabling is useful for a quick test.
Keep the firewall enabled. You can manage a per-app block without turning off Windows Defender Firewall for the whole computer.
App updates can install a new executable in a different location. If the block stops working after an update, check the current process path and update or recreate the rule.
Store apps and packaged apps can be harder to target by file path. If the app’s executable is protected or unclear, don’t guess at system files; check the app’s available Windows firewall controls or documentation.

Troubleshooting

The app still has internet access: Confirm the rule is enabled, its Action is Block, and it is listed under Outbound Rules. Verify the program path against the running process using Task Manager’s Open file location option. If the app uses multiple executables, identify which one is making the connection and add a separate rule for that program. Restart the app after making changes.

The app is blocked only on some networks: Open the rule’s properties and check the Advanced tab. Make sure the appropriate profiles are selected; select Domain, Private, and Public to cover all profiles.

The app cannot perform a local task: A broad program rule can block more than internet access, including some local network communication. Disable the rule temporarily to see whether it is responsible. If you need to allow certain connections while blocking others, a simple program-wide block is not sufficiently selective; firewall rules require carefully defined exceptions or narrower network criteria.

You cannot edit or create a rule: Sign in with an administrator account and approve the permission prompt. On a work- or school-managed PC, an organization’s policy may control firewall settings; contact its administrator rather than trying to override that policy.

You can’t find the app file: Check the shortcut’s Properties or the running process in Task Manager. If Windows does not expose an ordinary executable path, the app may be packaged or protected. Avoid selecting a similarly named file in a system folder unless you have verified it is the app’s executable.

Frequently Asked Questions

Does this block incoming connections too?
No. An outbound rule governs traffic leaving the PC. Configure an inbound rule separately only if you also need to control incoming connections.

Will the app work offline after I block it?
Often, but it depends on the app. Features that need a server, online sign-in, syncing, or updates may stop working; locally stored features may continue.

Does the rule block the app on every network?
Yes, if Domain, Private, and Public are all selected. If you clear profiles, the rule applies only to the selected network types.

How do I allow the app again?
In the advanced firewall console, open Outbound Rules, locate your named rule, and choose Disable Rule or Delete.

Will blocking the main app also block its updater?
Not necessarily. An updater or helper may run as a separate executable and need its own outbound rule.

Can I block only one website for the app?
Not with a basic program-wide rule. This method blocks outbound connections for the selected executable rather than selecting a particular website.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →