Protective DNS for public PCs, library WiFi and council staff
A library opens its public PCs and WiFi to anyone with a card, while staff work on the council network beside self-service kiosks and RFID returns. Shield checks each DNS lookup before a connection starts, blocking phishing, ransomware and C2 callbacks on staff systems. On public terminals and WiFi, filtering meets the IWF bar, with tighter rules in the children's library.
What is at stake
Where a library network is exposed
Ransomware on the catalogue
The library management system runs loans, holds and member records. Ransomware there stops lending across the whole authority.Public PCs anyone can use
People download, click and plug in USB sticks on shared terminals all day. Each one is a route for malware.Children and public WiFi
Children use the same WiFi and PCs as adults. Filtering has to meet the IWF bar and suit the children's area.
How Shield fits
Public, children's and staff networks, each with a policy
- Public access PCsThreat defence and content filtering to the IWF bar, with VPN and proxy apps blocked.
- Children's libraryStricter categories and Safe Search on Google, Bing and YouTube, applied by area or by session time.
- Council staff networkThreat-first policy by Entra ID group on staff laptops and PCs, with new-domain blocking.
- Kiosks and self-serviceSelf-issue kiosks and RFID returns on their own VLAN, limited to known domains through the relay.
Guest WiFi policy
- Adult contentBlocked
- GamblingBlocked
- Safe Search on Google, Bing and YouTubeEnforced
- Streaming at busy timesLimited
Allow list
bookings.examplemenu.exampleBlock list
rival-venue.exampleProof
What Shield gives a library service
- 10 days
- earlier warning of new malicious domains than standard blocklists
- IWFfiltering meets the Internet Watch Foundation bar on public PCs and WiFi
- Friendly WiFifiltering meets the Friendly WiFi standard for family-safe public WiFi
- Cyber Essentialsheld by Purple, alongside ISO 27001, GDPR and CCPA
FAQ
Questions we hear from teams like yours
Does Shield meet the IWF requirement for public internet access?
Yes. Shield's filtering meets the Internet Watch Foundation bar and the Friendly WiFi standard on both public PCs and library WiFi. You can add your own allow and block lists, and show a branded block page that explains why a site is blocked.
Does it help the council with Cyber Essentials and the CAF?
It helps you meet Cyber Essentials and the NCSC Cyber Assessment Framework by blocking malware and phishing on staff networks, with reports and log streams to Microsoft Sentinel or Splunk as evidence. It sits behind the council firewall, not in place of it.
Can each branch have its own rules?
Yes. Set policy per branch, network, SSID or VLAN, and by time of day. A mobile library, a central library and a small branch can each run their own policy from one dashboard.
Do users have to install anything?
No. Nothing needs installing on guest or unmanaged devices on the network. Point the router, firewall or DHCP at Shield, and public PCs and WiFi are covered at once.
What happens if Shield goes down?
Shield runs on a dual anycast DNS network and fails closed, so an outage never leaves public PCs or WiFi unfiltered. That matters where children use the same terminals as adults.
Other industries
Cinemas
Threat defence for ticketing, kiosks and concession tills, with family-safe WiFi in the foyer.Theatres
Threat defence for box office, show control and bar tills, with family-safe audience WiFi.Music venues
Threat defence for door scanners, cashless bars and production kit, with lighter fan WiFi.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.