Short version:
I set up a bunch of time-based URL filtering rules, and I get very mixed results. Sometimes on the same computer, Firefox will be blocked from loading a blocked website, but Safari will be able to load it right through the filter. I can't figure out any rhyme or reason. I checked [redacted ip lookup website] in both browsers and confirmed that both show my correct external IP, so neither browser is doing any kind of tunneling/vpn etc. All computers are using the router for their DNS. I'm baffled. 

Long version: 
I'm trying to set up a series of time-based rules that block certain time-suck websites. So for example, blocking facebook from 2am till noon time. I'm also setting up a few hour long blocks in the evening. As sort of a kick so if you are falling down a swiping black hole, this will pop you out of it. 

So first I went into Preferences > Time Range and set up some Time Ranges. One time range is 6pm to 7pm, 8pm to 9pm and 10pm to 11pm, all in one time range group. There are others too. 

Then I went to Behavior Control > Web Filtering > URL Filtering and set up some rules. The rule has the following settings:

IP Group :IPGROUP_ANY
Policy: Deny
Mode: Keywords
Filtering Content:
*.instagram.com
instagram.com
*.facebook.com
facebook.com
*.youtube.com
youtube.com
Effective Time: [ the time range I made above ]
Description: Evening Hourly Blocks

The results of this (and other rules/blocks I set up) are very random. For example today at 1030pm, All browsers on my Mac Pro were unable to access facebook and instagram. However on my Mac mini, facebook was unable to access facebook and instagram, but safari could access them perfectly fine, loading new data from the server. Shift-reloading didn't help. Quitting Safari and reloading didn't help. On that same Mac mini, I fired up a Ventura virtual machine, and tried loading instagram in THAT Safari, and it was UNABLE. 

So I can't figure it out. The results seem totally random. But also, SOMETIMES Safari on this Mac mini IS blocked from loading blocked sites. All machines are using the router's LAN IP as their DNS. Although I don't know how these filters work so they may not use DNS at all. 

I also had an issue with loading blocked sites through safari on an iphone connected to my wifi, WAS blocked, but loading those apps (facebook, instagram) worked fine. BUT I suspect this is a different problem entirely, and that the apps just use different domains. 

The documentation doesn't really do a great job of explaining the difference between "Keywords" and "URL Path" options, or "Web Group Filtering" vs "URL Filtering". But because my setup works sometimes, in some places, it makes me think i must be doing it right?