Pi-hole blocks ads for your whole network at once. It runs as a DNS server on a small Linux box, often a Raspberry Pi, and answers requests for known ad and tracking domains with nothing. Point your router at it and every phone, laptop, smart TV and games console in the house is covered, including apps where a browser extension cannot reach.
It is on this list because it has done this job well for a decade. Version 6 bundles its own web server, so the dashboard, the query log and the API come in one package, and the pihole command can do everything the web interface does. It also caches DNS, which makes everyday browsing feel a little quicker, and can act as your network's DHCP server if your router will not let you change DNS settings.
The limits: it blocks by domain, so ads served from the same domain as the content, YouTube's for example, get through. It needs a machine that stays on, and if that machine goes down, so does name lookup for the whole house unless you set a second DNS server.
- Repository: github.com/pi-hole/pi-hole
- Licence: custom (Other)
- Language: Shell. Stars: 61.5K. Forks: 3,341. Last push: Oct 24, 2026.
- Scan: safe, Oct 26, 2026, commit f503a65
Who it is for
Households and small offices that want fewer ads and trackers on every device, especially smart TVs and phones, and anyone with a Raspberry Pi or a home server.
Getting started
1. One-step install on a supported Linux system
curl -sSL https://install.pi-hole.net | bash2. Or read the installer first: clone and run it yourself
git clone --depth 1 https://github.com/pi-hole/pi-hole.git Pi-hole && cd "Pi-hole/automated install/" && sudo bash basic-install.shAfter installing, set your router to hand out the Pi-hole's address as the DNS server. An official Docker image is also available from the pi-hole/docker-pi-hole repository.
Safety scan
We cloned pi-hole/pi-hole at commit f503a65 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no self-decoding code, no committed binaries and no bare-IP URLs in about 9,000 lines of shell.
- The three download-piped-to-shell hits are the install method itself: a comment at the top of basic-install.sh, the line where the installer re-runs as root with sudo, and the reinstall hint in uninstall.sh. The README offers two ways to read the script before running it.
- The installer downloads Pi-hole's FTL engine from ftl.pi-hole.net. The debug tool can upload a debug log to tricorder.pi-hole.net for support, which is the project's own server.
- Five workflows. One, merge-conflict.yml, uses pull_request_target, but only to label pull requests with a pinned action and never checks out their code. All five third-party actions are pinned to a commit. Dependabot present; OpenSSF Scorecard 6.3 of 10.
- No lockfile, so no dependency advisories were queried; Pi-hole is shell scripts plus packages from your distribution.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 3 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 1 installer script (one fetches and runs a remote script) |
| Committed binaries | None. |
| CI workflows | 5 workflows. 1 uses pull_request_target, none check out the pull request head. 0 of 5 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 16 distinct hosts referenced from source; most often github.com, pi-hole.net, docs.pi-hole.net, stackoverflow.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has automated dependency updates, licence file. Missing security policy, CodeQL, contributing guide. |
| OpenSSF Scorecard | 6.3 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (3)
| Where | Rule | Match |
|---|---|---|
| automated install/basic-install.sh:16 | download-piped-to-shell | # curl -sSL https://install.pi-hole.net | bash |
| automated install/basic-install.sh:2428 | download-piped-to-shell | exec curl -sSL https://install.pi-hole.net | sudo bash "$@" |
| automated install/uninstall.sh:219 | download-piped-to-shell | Reinstall at any time: ${COL_BOLD}curl -sSL https://install.pi-hole.net | bash${COL_NC} |
Installer scripts (1)
- automated install/uninstall.sh, 241 lines, fetches and runs a remote script; talks to install.pi-hole.net, pi-hole.net
Workflows worth a look
- .github/workflows/merge-conflict.yml: pull_request_target
By the numbers
| Stars | 61.5K |
|---|---|
| Forks | 3,341 |
| Contributors | 265 |
| Commits | 7,292 |
| Open issues | 25 |
| Open pull requests | 16 |
| Releases | 127 |
| Latest release | v6.5 |
| Licence | custom |
| Main language | Shell |
| Project age | 12 years |
| Last push | Oct 24, 2026 |
| Tracked files | 95 |
| Lines of code | 9,342 |
| Checkout size | 474 KB |
Lines by language: Shell 7,858, SQL 951, Markdown 276, YAML 257.
Questions
Is Pi-hole free?
Yes. Pi-hole is free and open source under the European Union Public Licence (EUPL), and is run by volunteers funded by donations.
Does Pi-hole block YouTube ads?
Mostly not. Pi-hole blocks by domain name, and YouTube serves its ads from the same domains as its videos. A browser ad blocker handles those better.
Do I need a Raspberry Pi for Pi-hole?
No. Any always-on Linux machine or a Docker host works, including an old laptop or a small virtual machine. A Raspberry Pi is popular because it is cheap and uses little power.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.