Installed a PiHole to clear all their devices from malicious ads / malicious url's.
Seriously, since I installed PiHole my maintanance visits / calls have dropped by 90%.
They don't use a CC. Maybe once a year for flight tickets but I tell them to check the URL / https.
And I've told them 100 times: companies do not call you. They don't. Ignore calls!
It's better than a browser extension, as it works for mobile devices and native apps (e.g. Skype). Remember to set a backup secondary DNS server in case it goes down though.
If the router allows changes to the DHCP DNS settings then make them there. Some don't, so then you'll need to use the Pi for DHCP too.
However, keep in mind that it provides an unauthenticated web interface that exposes all domains that have been visited. This could be a privacy risk. It's pretty easy to simply use dnsmasq on its own if you don't want the extras.
You can also use this technique to make some news sites less annoying: https://unop.uk/block-bbc-breaking-news-on-all-devices
No, BBC News still doesn't support HTTPS (it's now over 6 months later than they said it would).
No, it doesn't. At least not since version 3.x with which i started using it...
If you want more detail than just a broad overview, you need to login (though that is just a password, no username needed)...