Home Web Filtering

Web Filtering

By KyberGate
• 8 articles

Understanding Content Categories

Understanding Content Categories KyberGate classifies websites into 130+ content categories using a curated database of over 1.3 million domains. Understanding these categories is essential for building effective filtering policies that keep students safe while allowing access to educational resources. Before You Begin - Familiarize yourself with your school's Acceptable Use Policy (AUP) - Review your district's CIPA compliance requirements - Know which grade levels and user groups you're filtering for How Categories Work Every domain in KyberGate's database is assigned one or more content categories. When a student visits a website, KyberGate checks the domain's category against the active filtering policy. If the category is blocked, the student sees the block page. Category Groups Categories are organized into logical groups for easier management: 🔴 Safety & Compliance (Typically Always Blocked) - Adult/Mature Content — Pornography, explicit material - Violence & Gore — Graphic violence, weapons - Drugs & Alcohol — Drug use, paraphernalia, alcohol - Gambling — Online casinos, betting sites - Malware & Phishing — Known malicious domains - Proxy/VPN/Anonymizer — Tools used to bypass filters 🟡 Discretionary (Policy-Dependent) - Social Media — Facebook, Instagram, TikTok, Snapchat - Gaming — Online games, game platforms (130+ domains) - Streaming — Netflix, Hulu, Disney+ - Chat & Messaging — WhatsApp Web, Discord, Telegram - AI Tools — ChatGPT, Claude, Gemini, Copilot 🟢 Typically Allowed - Education — Khan Academy, Coursera, educational publishers - Reference — Wikipedia, dictionaries, encyclopedias - Government — .gov sites, civic resources - Health — Medical information, health education - News — Major news outlets, current events - Technology — Developer resources, tech documentation Viewing and Browsing Categories 1. Navigate to Settings → Content Categories in the dashboard 2. Browse the full category list organized by group 3. Click any category to see: - Description of what the category covers - Number of domains in the category - Sample domains - Which policies currently block this category Multi-Category Domains Some domains belong to multiple categories. For example: - reddit.com → Social Media + Forum/Community - youtube.com → Streaming + Education + Social Media - discord.com → Chat & Messaging + Gaming When a domain has multiple categories, it is blocked if any of its categories are blocked in the active policy (unless the domain is on the Allow List). Custom Category Overrides If you disagree with how a domain is categorized: 1. Use the Domain Checker to see current categorization 2. Click "Report Miscategorization" to submit a review request 3. In the meantime, add the domain to your policy's Allow List or Block List for immediate effect Tips - Start with category groups: Block the Safety & Compliance group entirely, then selectively enable Discretionary categories based on your school's needs - Age-appropriate policies: Elementary schools typically block Social Media and Gaming; high schools may allow them during non-instructional time - Review quarterly: As new sites emerge and student behavior changes, revisit your category selections - Use the Policy Simulator: Test how category changes affect access before deploying to students Related Articles - Creating and Managing Filtering Policies - How Web Filtering Works in KyberGate - Using the Domain Checker

Last updated on Apr 17, 2026

YouTube Channel Blocking

YouTube Channel Blocking KyberGate goes beyond simple YouTube allow/block by letting you control access at the individual channel level. Block specific channels that are inappropriate while keeping YouTube available for educational content. Before You Begin - You need Admin or Policy Manager role - YouTube must be allowed in your filtering policy (if YouTube is fully blocked, channel-level controls don't apply) - Devices must be routing through the KyberGate proxy How YouTube Channel Blocking Works KyberGate inspects YouTube traffic at the URL level, identifying which channel a video belongs to. When a student tries to watch a video from a blocked channel, they see the KyberGate block page instead of the video. This works for: - Direct channel page visits (youtube.com/c/ChannelName) - Individual video pages from blocked channels - Embedded videos from blocked channels - YouTube Shorts from blocked channels Blocking a YouTube Channel 1. Navigate to Settings → Web Filtering → YouTube Controls 2. Click "+ Block Channel" 3. Enter the channel in one of these formats: - Channel URL: https://youtube.com/c/ChannelName - Channel ID: UCxxxxxxxxxxxxxxxx - Channel name: Search by name and select from results 4. Add an optional reason (e.g., "Inappropriate gaming content") 5. Choose which policies this block applies to 6. Click "Block Channel" Creating a Channel Allow List For maximum control, you can flip YouTube to Allow List mode: 1. Go to Settings → Web Filtering → YouTube Controls 2. Toggle "Allow List Mode" on 3. Only channels you explicitly add to the Allow List will be accessible 4. All other YouTube channels will be blocked This is ideal for: - Elementary school environments - Specific classroom assignments using curated video content - Standardized testing periods Managing Blocked Channels - View all blocked channels: See the full list with who blocked them and when - Search: Find channels by name in your blocked list - Bulk import: Upload a CSV of channel URLs to block many at once - Temporary unblock: Disable a block without deleting it Monitoring YouTube Activity KyberGate logs all YouTube activity for managed devices: - Which channels students visit - Which videos they watch (title and duration) - Search queries on YouTube - Attempted access to blocked channels View this data in Reports → Activity Logs filtered by "YouTube." Troubleshooting - Channel block not working? Verify the channel URL/ID is correct. Some channels have multiple URLs — try the channel ID format for reliability - Videos still playing? If the video is embedded on another site, ensure your proxy is inspecting that domain (not in the bypass list) - Too many channels to manage? Consider using Allow List mode instead of blocking individually Tips - Combine with Restricted Mode: Use SafeSearch enforcement for YouTube Restricted Mode alongside channel blocking for layered protection - Teacher requests: When teachers need specific channels, add them to the Allow List rather than removing blocks - Student reports: Check the Activity Logs to find channels students are accessing that should be blocked Related Articles - SafeSearch Enforcement - How Web Filtering Works in KyberGate - Understanding Content Categories

Last updated on Apr 17, 2026

Game Blocking and Detection

Game Blocking and Detection KyberGate includes specialized game detection that goes beyond simple domain blocking. With a curated list of 130+ gaming domains and advanced detection for browser-based games, KyberGate keeps students focused during instructional time. Before You Begin - You need Admin or Policy Manager role - Review your school's policy on gaming — some schools allow games during breaks or as rewards - Understand that some educational platforms use game-like elements (gamification) that you may want to allow What KyberGate Blocks Gaming Domains (130+) KyberGate maintains a curated list of known gaming sites, including: - Browser games: CoolMathGames, Poki, Y8, Kizi, Armor Games, Kongregate - Game platforms: Steam, Epic Games, Roblox, Minecraft.net - Mobile game sites: GamePigeon alternatives, io games (agar.io, slither.io, etc.) - Game-adjacent: Game wikis, cheat sites, game streaming (Twitch) - Proxy games: Sites that host games specifically to bypass school filters The list is updated regularly as new gaming sites emerge. Browser-Based Game Detection Many students find unblocked browser games hosted on obscure domains. KyberGate's advanced detection identifies: - HTML5/WebGL game content on otherwise uncategorized domains - Known game frameworks and engines running in the browser - Google Sites and other platforms hosting embedded games Enabling Game Blocking 1. Navigate to Settings → Filtering Policies 2. Select your policy 3. Go to the Categories tab 4. Enable the Gaming category toggle 5. Optionally enable Game Streaming to also block Twitch and similar platforms 6. Click "Save & Deploy" Schedule-Based Game Access Many schools allow gaming during lunch or free periods: 1. Create two policies: - "Instructional Hours" — Gaming category blocked - "Free Time" — Gaming category allowed 2. Set schedules for each policy: - Instructional: 8:00 AM – 12:00 PM, 1:00 PM – 3:00 PM - Free Time: 12:00 PM – 1:00 PM 3. Assign both to the same device group with the appropriate schedule Game Detection Dashboard Monitor gaming activity across your school: 1. Go to Reports → Activity Logs 2. Filter by Category: Gaming 3. View: - Which students are attempting to access games - Most popular gaming sites - Time of day gaming attempts occur - Which devices have the most gaming activity Handling New Game Sites Students are creative at finding new game sites. When you discover one: 1. Check if it's already in the Gaming category via the Domain Checker 2. If not, add it to your policy's Block List 3. Click "Report Miscategorization" to have it added to the global Gaming category 4. It will be categorized within 24 hours for all KyberGate customers Troubleshooting - Student found an unblocked game? Add the domain to your Block List immediately, then report it for global categorization - Educational game being blocked? Add the specific domain to your Allow List. Common examples: Kahoot, Quizlet Live, Prodigy - Google Sites games? These are tricky — enable browser-based game detection for best coverage, or block sites.google.com if your school doesn't use Google Sites Tips - Check activity logs weekly: Look at the Gaming category to spot trends and new game sites students are finding - Educate, don't just block: Pair technical controls with conversations about appropriate device use - Allow educational games explicitly: Maintain an Allow List of approved educational games (Kahoot, Prodigy, Quizlet, etc.) - Monitor "Proxy/VPN" category too: Students often use VPNs to bypass game blocks Related Articles - Understanding Content Categories - Creating and Managing Filtering Policies - Students Bypassing the Filter

Last updated on Apr 17, 2026

How Web Filtering Works in KyberGate

How Web Filtering Works in KyberGate KyberGate uses a cloud-based proxy architecture with SSL/MITM inspection to provide comprehensive web filtering for K-12 schools. This article explains the technology behind KyberGate's filtering engine and how it keeps students safe online. Overview Unlike traditional DNS-based filters that can only block entire domains, KyberGate inspects traffic at the URL and content level. This means you can allow YouTube.com while blocking specific channels, or permit Google searches while enforcing SafeSearch. How It Works 1. Proxy Architecture All web traffic from managed devices routes through KyberGate's cloud proxy network. The proxy sits between the student's device and the internet, inspecting each request in real time. - 8 global proxy regions with smart geo-routing for low latency - PAC file auto-configuration deployed via MDM — no manual setup on devices - SSL/MITM inspection decrypts HTTPS traffic for deep content analysis 2. Domain Database KyberGate maintains a curated database of 1.3 million+ domains organized into 130+ content categories. Each domain is classified and updated continuously. - Categories include: Adult Content, Gaming, Social Media, Streaming, Violence, Drugs, Gambling, and more - New domains are categorized within hours of discovery - Admins can override any categorization with custom allow/block rules 3. Real-Time Inspection When a student visits a website, KyberGate performs multiple checks: 1. Domain lookup — Is the domain in a blocked category? 2. URL path analysis — Is this specific page restricted? 3. Keyword scanning — Does the page content contain flagged terms? 4. SafeSearch enforcement — Are search engines forced to safe mode? 5. AI chat monitoring — Are AI tools being used appropriately? 4. Block Page When content is blocked, students see a branded block page with: - The reason the site was blocked - The content category that triggered the block - A "Request Access" button to ask their teacher or admin for an exception Filtering Modes | Mode | Description | |------|-------------| | Category-based | Block entire content categories (e.g., all Gaming sites) | | Domain-level | Block or allow specific domains | | Keyword | Block pages containing specific words or phrases | | Schedule-based | Apply different policies during school hours vs. after hours | Tips - Policy Simulator: Use the Policy Simulator in the dashboard to test how a URL would be handled before deploying changes - Bypass Domains: Add trusted domains to the bypass list to skip proxy inspection entirely (useful for internal school resources) - Game Detection: KyberGate blocks 130+ known gaming domains automatically when the Gaming category is enabled Related Articles - Creating and Managing Filtering Policies - Using the Domain Checker - SafeSearch Enforcement - Managing Bypass Domains

Last updated on Apr 17, 2026

Creating and Managing Filtering Policies

Creating and Managing Filtering Policies Filtering policies are the core of KyberGate's web filtering. A policy defines what content categories, domains, and keywords are blocked or allowed for a group of devices or students. Before You Begin - You need Admin or Policy Manager role in KyberGate - Ensure your devices are enrolled and assigned to device groups - Review the default policy to understand baseline filtering Creating a New Policy 1. Navigate to Settings → Filtering Policies in the KyberGate dashboard 2. Click "+ New Policy" in the top right 3. Enter a Policy Name (e.g., "Elementary School — Standard") 4. Optionally add a Description explaining the policy's purpose Step 1: Configure Category Blocks 5. In the Categories tab, you'll see all 130+ content categories 6. Toggle categories on (blocked) or off (allowed) 7. Common categories to block for K-12: - Adult Content, Gambling, Drugs, Violence, Weapons - Social Media (optional — many schools allow during breaks) - Gaming (blocks 130+ game domains automatically) - Proxy/VPN (prevents filter bypass attempts) Step 2: Add Custom Domain Rules 8. Switch to the Domains tab 9. Add specific domains to the Block List or Allow List 10. Use wildcards for subdomains: *.example.com blocks all subdomains 11. Domain rules override category settings (an allowed domain won't be blocked even if its category is blocked) Step 3: Configure Keyword Blocking 12. In the Keywords tab, add terms that should trigger a block 13. Keywords are matched against page content, not just URLs 14. Use phrases for accuracy (e.g., "how to make a weapon" vs. just "weapon") Step 4: Set Schedule 15. In the Schedule tab, define when the policy is active 16. Options include: - Always active — 24/7 filtering - School hours only — Define start/end times per day - Custom schedule — Different rules for different days Step 5: Assign to Groups 17. In the Assignment tab, select which device groups this policy applies to 18. A device can only have one active policy at a time 19. Click "Save & Deploy" to activate Managing Existing Policies - Edit: Click any policy name to modify its settings - Duplicate: Use the ⋯ menu → "Duplicate" to create a copy for a similar group - Disable: Toggle the policy off without deleting it - Delete: Remove the policy (devices revert to the default policy) Policy Priority When multiple policies could apply, KyberGate uses this priority order: 1. Classroom overrides (Focus/Restrict mode in KyberClassroom) 2. Device-specific policy (assigned directly to a device) 3. Group policy (assigned to the device's group) 4. Default policy (catches everything else) Tips - Test before deploying: Use the Policy Simulator to enter any URL and see how it would be handled under a policy - Start restrictive, then loosen: It's easier to allow sites teachers request than to chase down everything that should be blocked - Use descriptions: Future admins will thank you for explaining why a policy exists Troubleshooting - Policy not taking effect? Check that the device group assignment is correct and the device has synced recently - Site blocked that shouldn't be? Add it to the Allow List in the policy, or check if a keyword rule is triggering a false positive - Site allowed that should be blocked? Verify the correct category is enabled, or add the domain to the Block List manually Related Articles - How Web Filtering Works in KyberGate - Using the Domain Checker - SafeSearch Enforcement - Managing Bypass Domains

Last updated on Apr 17, 2026

Using the Domain Checker

Using the Domain Checker The Domain Checker is a built-in tool that lets you instantly look up how KyberGate categorizes any domain. Use it to verify filtering behavior, troubleshoot access issues, or check if a site is properly categorized before a teacher reports a problem. Before You Begin - You need any role in KyberGate (Viewer or above) - Access the Domain Checker from the dashboard sidebar under Tools → Domain Checker How to Use the Domain Checker 1. Navigate to Tools → Domain Checker in the KyberGate dashboard 2. Enter a domain name in the search field (e.g., coolmathgames.com) 3. Click "Check" or press Enter 4. Review the results: Results Breakdown The Domain Checker returns: - Domain: The full domain being checked - Category: The content category assigned (e.g., "Gaming", "Education", "Social Media") - Status: Whether the domain is currently Blocked, Allowed, or Bypassed - Policy Match: Which policy is causing the block/allow decision - Custom Rules: Whether any manual overrides exist for this domain - Last Updated: When the domain's categorization was last reviewed Checking Multiple Domains You can check multiple domains at once: 1. Click "Bulk Check" at the top of the Domain Checker 2. Enter up to 50 domains, one per line 3. Click "Check All" 4. Results are displayed in a table you can sort and export Requesting a Re-Categorization If you believe a domain is incorrectly categorized: 1. Check the domain using the Domain Checker 2. Click "Report Miscategorization" next to the result 3. Select the category you believe is correct 4. Add an optional note explaining why 5. Submit the request — KyberGate's team reviews recategorization requests within 24 hours Using Domain Checker for Troubleshooting The Domain Checker is your first stop when: - A teacher reports a site is blocked that shouldn't be - A student claims they can't access an educational resource - You want to verify a new policy is working correctly - You need to check if a game site is in the Gaming category Example Workflow Teacher: "My students can't access Khan Academy." You: Check khanacademy.org in Domain Checker → See it's categorized as "Education" → Check it's not in any Block List → Verify the device's policy allows Education → Identify the issue is a keyword rule blocking "academy" → Fix the keyword rule. Tips - Bookmark frequently checked domains: The Domain Checker keeps your recent search history for quick access - Use the Policy Simulator for deeper testing: The Domain Checker shows categorization; the Policy Simulator shows how a specific policy handles the URL - Check subdomains separately: docs.google.com and drive.google.com may have different categorizations Related Articles - How Web Filtering Works in KyberGate - Creating and Managing Filtering Policies - Students Bypassing the Filter

Last updated on Apr 17, 2026

SafeSearch Enforcement

SafeSearch Enforcement SafeSearch enforcement ensures that students always get filtered search results on major search engines, even if they try to disable SafeSearch manually. KyberGate enforces SafeSearch at the proxy level, making it impossible for students to bypass on managed devices. Before You Begin - You need Admin or Policy Manager role - Devices must be enrolled and routing traffic through the KyberGate proxy - SafeSearch enforcement is a per-policy setting How SafeSearch Enforcement Works KyberGate enforces SafeSearch by rewriting search engine requests at the proxy level: - Google: Appends &safe=active to all search queries and blocks access to Google search settings - Bing: Forces &adlt=strict parameter on all Bing searches - YouTube: Enables YouTube Restricted Mode, hiding age-inappropriate content and comments - DuckDuckGo: Forces &kp=1 safe search parameter Because enforcement happens at the proxy, students cannot disable it from their browser settings, search engine preferences, or browser extensions. Enabling SafeSearch Enforcement 1. Navigate to Settings → Filtering Policies 2. Select the policy you want to modify (or create a new one) 3. Go to the SafeSearch tab 4. Toggle "Enforce SafeSearch" to On 5. Select which search engines to enforce: - ✅ Google Search - ✅ Google Images - ✅ YouTube Restricted Mode - ✅ Bing - ✅ DuckDuckGo 6. Click "Save & Deploy" YouTube Restricted Mode YouTube Restricted Mode is a special case worth understanding: - What it does: Hides potentially mature videos based on YouTube's own content classification - Comments: Most comments are hidden in Restricted Mode - Live streams: Some live content may be restricted - Not perfect: YouTube's classification isn't flawless — some inappropriate content may slip through, and some educational content may be incorrectly restricted Combining with YouTube Channel Blocking For maximum control over YouTube, combine SafeSearch enforcement with KyberGate's YouTube Channel Blocking feature. This lets you: - Block specific YouTube channels by name or URL - Allow only approved educational channels - Monitor which YouTube content students are watching Verifying SafeSearch Is Working 1. On a managed device, go to google.com/preferences 2. The SafeSearch setting should show as locked (enabled and uneditable) 3. Try searching for known-blocked terms — results should be filtered 4. Check YouTube — the Restricted Mode indicator should appear at the bottom of the page Troubleshooting - SafeSearch not enforcing? Verify the device is routing through the KyberGate proxy (check the PAC file configuration) - YouTube Restricted Mode not active? Ensure the YouTube option is checked in the policy's SafeSearch settings - Search results still showing inappropriate content? SafeSearch isn't 100% — use keyword blocking as an additional layer for sensitive terms - Teacher needs unrestricted YouTube? Create a separate policy for teacher devices with YouTube Restricted Mode disabled Tips - Layer your protections: SafeSearch + keyword blocking + category blocking provides defense in depth - Educate teachers: Let them know SafeSearch is enforced so they understand why some search results differ from their personal devices - Monitor AI search: New AI-powered search features (Google AI Overviews, Bing Chat) are also filtered through KyberGate's SafeSearch enforcement Related Articles - How Web Filtering Works in KyberGate - Creating and Managing Filtering Policies - YouTube Channel Blocking

Last updated on Apr 17, 2026

Managing Bypass Domains

Managing Bypass Domains Bypass domains are websites that skip KyberGate's proxy inspection entirely. Traffic to these domains goes directly from the device to the internet without being filtered, inspected, or logged. Use bypass domains sparingly for sites that conflict with proxy inspection. Before You Begin - You need Admin role in KyberGate - Understand that bypassed domains are completely unfiltered — no blocking, no logging, no SafeSearch - Have a clear reason for bypassing (not just "a teacher asked") When to Use Bypass Domains Appropriate uses: - Sites with certificate pinning that break under SSL inspection (e.g., some banking or government sites) - Internal school resources hosted on private networks - Standardized testing platforms that require direct connections (e.g., certain state assessment tools) - Video conferencing tools that have quality issues through the proxy (e.g., Zoom, Google Meet) Inappropriate uses: - Sites a teacher wants unblocked → Use the Allow List in the filtering policy instead - Sites that are slow → Check proxy region settings before bypassing - "Just in case" entries → Every bypass is a gap in your protection Adding a Bypass Domain 1. Navigate to Settings → Network & Proxy → Bypass Domains 2. Click "+ Add Domain" 3. Enter the domain name (e.g., zoom.us) 4. Optionally add a note explaining why this domain is bypassed 5. Choose the scope: - All devices — Every managed device bypasses this domain - Specific groups — Only selected device groups bypass this domain 6. Click "Save" Wildcard Entries - zoom.us — Bypasses only the exact domain - *.zoom.us — Bypasses all subdomains of zoom.us - *.*.zoom.us — Not supported; use *.zoom.us instead Managing Existing Bypass Domains - View all: The bypass domain list shows each domain, who added it, when, and the note - Edit: Click the domain to change its scope or note - Disable temporarily: Toggle the domain off without deleting it - Delete: Remove the domain to resume proxy inspection Common Bypass Domains for Schools These domains frequently need bypassing in school environments: | Domain | Reason | |--------|--------| | *.zoom.us | Video conferencing quality | | *.webex.com | Video conferencing quality | | *.state.*.us | State assessment platforms | | *.collegeboard.org | SAT/AP testing | | *.air.org | Standardized testing (AIR) | | Internal domains | School-hosted resources | Auditing Bypass Domains We recommend reviewing your bypass list quarterly: 1. Go to Settings → Network & Proxy → Bypass Domains 2. Sort by Date Added to find old entries 3. For each entry, ask: "Is this still needed?" 4. Remove any entries that no longer have a valid reason 5. Document the review in your IT change log Troubleshooting - Bypass domain still being filtered? Ensure you included the correct subdomain pattern. Check that the device has synced its PAC file recently - Site works without proxy but not with bypass? The issue might not be the proxy — check the site's own firewall or IP restrictions - Too many bypass domains? If your list is growing beyond 20-30 entries, consider whether the proxy configuration or SSL certificate deployment needs attention Tips - Less is more: Every bypass domain is a blind spot in your filtering and monitoring. Keep the list minimal - Document everything: Always add a note explaining why a domain was bypassed. Future admins will thank you - Test after adding: Verify the bypass works by visiting the site on a managed device and confirming it no longer appears in activity logs Related Articles - How Web Filtering Works in KyberGate - Network and Proxy Settings - Certificate Installation Issues

Last updated on Apr 17, 2026