Why is something still getting through?

The curated Screen Time list only reaches Safari, because that is the only browser iOS lets an app filter. Third party browsers are handled instead by sealing the browser itself as an app, which is why Chrome, Firefox and Edge are standing entries on the guided checklist. If the site loads in one of them, that browser was not sealed. The resolver layer does reach them, so a site on its list still fails there; a site that loads is one the resolver does not carry.

Do this: open the Shield tab, open the apps sheet, add the browser, and save. It joins the seal for the rest of the term.

Two things block sites in Safari. The curated Screen Time list carries ten named sportsbooks and casinos and shows Apple's restricted site page, and the web shield's resolver answers for about 356,500 gambling domains, but only while its DNS setting is on. Open the Shield tab: the web tile reads On and Sites never load when the shield is answering. If it reads Off and Sites load normally, the DNS setting was never enabled or was switched off in iOS Settings.

Do this: turn the web tile on and follow the guided steps into Settings. The tile confirms when iOS reports the setting enabled.

Another VPN or a private relay is answering DNS in front of the shield. That is honest, not broken: the shield cannot answer a question it is never asked. The tile's line reads Another VPN in front for exactly this case, which is a statement about the order of the answers and not an accusation. Turn the other one off and the shield takes over again on its own, with nothing for you to switch back on.

These are two different admissions and neither is a block failing. Unconfirmed and Last check unanswered mean the last probe went out and no answer came back, so the app will not claim the shield is holding. Unknown and Could not read mean iOS did not report the setting's state at all. In both the tile says what it does not know rather than showing a green word it cannot stand behind. Both usually clear on the next check with no action from you.

That is the web shield being installed, and iOS is right to ask once. It is not a VPN and it opens no tunnel; what changes is where this phone asks for addresses. iOS keeps the switch for it, which is why Fold'em walks you into Settings to finish the job and why Fold'em cannot turn the shield off for you afterwards either. Fold'em can read whether the setting is on and report it; that is the whole of its power over it.

The app shield covers exactly the apps you picked and nothing else. A new install is caught only if the Games category is sealed, and only if the App Store files that app under Games. Sportsbooks filed elsewhere have to be added by name, which is one tap and holds for the rest of the term.

Do this: seal the Games category on the Shield tab if you have not, and add the app through the apps sheet. Adding is one tap; removing waits for the term to end.

This is the whole app layer, not one app. Fold'em blocks apps through Screen Time, so when that permission is withdrawn the shield stops holding and everything you sealed opens. The apps tile turns and reads Down over Screen Time not approved, and the count leaves the tile entirely, because a number there would claim protection the phone does not have. Nothing about it is quiet: Home asks you to fix it and your keyholder's card turns to Protection off. Your term does not end and the days already earned are not lost, but the day count stops moving until the permission is back.

Do this: grant Screen Time again from the card on Home. The shield goes straight back on.

Reinstalling does not end anything. Your term, the day you started, your keyholder and the lock itself are held on the server, so signing in on the fresh install brings all of it back exactly as it was, and never as anything weaker. Two things have to be done again on the phone, because they never left it: granting Screen Time, and picking your apps. Until both are done your keyholder's card reads Checking in.

Do this: sign in, grant Screen Time, and pick your apps again.

The pass in Wallet is a copy, and Fold'em cannot reach into it. When something changes, the server asks Wallet to come and fetch a fresh pass, and Wallet does the fetching. So a card that looks stale means one of two things: either the fetch has not happened yet, which is what the Refreshed row on the back of the card is for, or it did happen and nothing on the card was meant to announce itself. Email is the channel that is guaranteed to arrive; the pass is the fast one.

Quiet is the default rather than a fault. Fold'em asks iOS for provisional permission first, which delivers straight into Notification Center with no banner and no sound and shows you no prompt at all. Moving to the loud kind takes one tap on a row in Settings under Notifications, which raises the real iOS prompt. If you have already told iOS no, that row changes to point you at iOS Settings instead, because iOS will not ask twice.

A Fold'em widget reads one small file the app writes into the space the two of them share, and it works out nothing for itself. When that file is missing or cannot be read, the widget draws its empty face and says so rather than inventing a number. Opening Fold'em once rewrites the file and reloads every placed widget. If the empty face persists after that, the usual reason is that there is nothing to draw yet, because no term is running.

Every layer Fold'em has is installed on the one iPhone it runs on. There is no account wide block, no browser extension and no router setting, so a second device is outside all three layers by construction. That is a limit rather than a fault, and it is the reason the app treats itself as one layer among several and points at the others.