Long story short the Surfboard app parental control is working.
However, I ran out of “blocks” (seriously, only 32 !?), and saw that the gui web interface also allows for blocking from there also.
(1) The gui parental controls do not allow for dashes “-”. Given there are many domains with dashes, why not?
(2) Everything was going fine. I had 25 listed in gui. No problemo. After we had to power-reset one day I saw they were down to 15. I added them again. A few days later we had to power reset (not a factory reboot just a power outage) and once again down to 15. I added them back once more. Then I saw that the ones I added back, although they were listed in the gui software, they were not actually blocking anything anyway (I tested from a laptop afterwards). I come back and they are still there and listed. They stay there and remain listed. Until we have a power cut. Then they vanish as if by magic.
I have had a problem with hackers. I think they have done something to the router to stop the websites I listed and only make it look like they are blocking. Ones from the phone app still work great. But the gui has been attacked somehow and now the blocks are only cosmetic and not actually blocking anything.
(Q) If I factory reboot how can I stop hackers doing this to me again? I have no idea if a factory reboot will even work, tbh.