Family-Safe Browsing: What Actually Works
Every parent who asks us about this has already tried one thing, usually a router setting or an app, and found it either blocked nothing or blocked the homework. Here's how the pieces fit and what each one misses.
There is no single switch, and any product that says otherwise is describing one layer. The router sees everything on your Wi-Fi and nothing off it. The device controls follow the phone out the door and stop at the app store. The accounts have kid modes that nobody turns on. Put the three together and it holds; use any one alone and a twelve-year-old will find the gap in a week.
The Short Version
Three layers, none sufficient alone: DNS filtering at the router for everything on the Wi-Fi, the built-in controls on each child's device for everything that leaves the house, and the accounts themselves (YouTube, games, streaming) set to their kid modes. Then a conversation, because a filter is a fence, not a babysitter.
Layer 1: Filtering at the Router
Change the DNS setting on your router to a family filtering resolver and every device on your Wi-Fi, including the smart TV and the game console, stops reaching adult and malware sites. It's a two-minute change with no software to install: Cloudflare for Families (1.1.1.3 and 1.0.0.3 block malware and adult content; 1.1.1.2 blocks malware only) or OpenDNS FamilyShield (208.67.222.123 and 208.67.220.123). The rest of the router's settings are in our router security checklist.
What it misses: cellular data, since a phone off the Wi-Fi bypasses it entirely; browsers that bring their own encrypted DNS, so turn off “secure DNS” in Chrome and Firefox on the kids' devices or let a device control enforce it; and a determined teen changing the DNS on their own device. It also filters by site, not by page: it can't allow YouTube and block one video.
Layer 2: Controls on the Device
| Platform | Tool | Does well | Misses |
|---|---|---|---|
| iPhone, iPad, Mac | Screen Time, under Settings, with a parent passcode | A web filter that follows the device onto cellular, app limits, downtime, Ask to Buy, communication limits | Needs a passcode the child doesn't know. Workarounds surface with each iOS release; keep it updated. |
| Android, Chromebook | Google Family Link | Approves app installs, sets limits, locks SafeSearch, locks the device, shows location | Works best when the child's account was created through Family Link; an older teen can leave supervision. |
| Windows, Xbox | Microsoft Family Safety | Web filtering, screen time, app and game limits, activity reports | Web filtering only applies in Edge, so block other browsers with the app limit. |
| PlayStation, Xbox, Nintendo | Console family settings | Age ratings, chat, spending limits | Chat inside specific games. |
| Streaming | Kids profiles with a PIN | Content ratings | Nothing on the open web. |
Layer 3: The Accounts
- YouTube: a supervised account for younger kids, or Restricted Mode locked on.
- Roblox and similar: the parental controls and spending limits inside the account, not just the app rating.
- SafeSearch locked on in Google, which Family Link, Screen Time and the family DNS resolvers all enforce.
- App installs requiring a parent's approval. This is the single setting that blocks VPN apps, which are the most common workaround.
What Kids Actually Do
| The workaround | What stops it |
|---|---|
| Install a VPN app | Approval on every app install (Ask to Buy, Family Link) |
| A friend's hotspot, or cellular | Device-level controls, which travel with the device |
| Change the DNS on their own device | Device controls that lock network settings. Router filtering alone can't. |
| Private browsing | Nothing needed. It hides history; it doesn't bypass DNS filtering or Screen Time. |
| A second account | App-store approval and the family group |
| The old tablet in a drawer | Same controls on it, or it lives on the filtered guest network |
Don't Overdo It
Filtering is for age-appropriate content. Monitoring apps that log messages are a different tool with a different conversation, and past a certain age they cost more trust than they protect. Our rule of thumb: a filter the kid knows about, and a parent who talks about what's online, beats surveillance the kid discovers later.
The Managed Version
Our Residential Premium plan includes web filtering for family-safe browsing on the computers we manage, set centrally so it doesn't depend on which browser gets used, plus Mobile Device Management for a phone or tablet (additional devices $12/mo each), which is the piece that enforces the settings and stops the workarounds on the device kids actually use. We set it up on the first visit and adjust the categories as they grow.
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Is the router pointed at a family DNS resolver? | Two minutes |
| Do the kids' phones have a parent passcode they don't know? | Set it today |
| Do app installs need approval? | This one blocks the VPNs |
| Could you list every device a child uses, including the old ones? | Make the list |
Set It Up Once, Properly
Web filtering and Mobile Device Management are included on the Residential Premium plan. We configure the router, the devices and the accounts in one visit.
Frequently Asked Questions
Will filtering slow down my internet?
No. DNS filtering adds nothing you'd notice; the family resolvers are as fast as the ones your provider uses, and often faster.
Can I filter only the kids' devices and not mine?
Yes. Device controls do that by definition, and many routers let you assign a filtered profile to specific devices while leaving the rest alone.
What about the school-issued Chromebook?
The school manages it, and its filter applies at home too. You usually can't add your own controls on top, so ask the school what theirs covers.
How do I force SafeSearch?
Family Link, Screen Time and Microsoft Family all lock it. The family DNS resolvers force SafeSearch on Google and Bing and turn on YouTube Restricted Mode as well, for every device on the Wi-Fi.
My teenager says it's blocking homework.
The category lists are blunt instruments. Add the sites they need to an allow list, and prefer device controls with categories over the router's all-or-nothing switch for older kids.
More Guides
The ten settings that make a home router safe, and when to replace it.
Lock it, protect the accounts on it, and suspend the line, in the right order.
The five tells, the scams hitting Tampa Bay right now, and what to do if you already clicked.
How a cloned voice works, and the family password that beats it.
Why the mesh kit didn't fix it, what's really blocking the signal, and the fix that holds.
The issues we see most often in Tampa Bay homes, and what to try first.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service