Filtering that helps you meet KCSIE on every school network
Your school has a duty to filter what pupils can reach, and to keep staff accounts away from attackers. Shield checks each DNS lookup against policy before a connection starts. Pupils get safeguarding categories and Safe Search, staff get threat-first defense, and visitor WiFi gets a family-safe policy of its own.
What is at stake
Safeguarding duties and a target on staff accounts
Harmful content in lessons
Pupils search for things they should not find. KCSIE and the DfE standards expect you to filter it and know what was blocked.Pupils finding a way round
Proxy sites and VPN apps spread fast through a year group, and each one is a route round your filtering.Phishing aimed at staff
A fake login page that captures a teacher's password can open pupil records and lead to ransomware across a whole trust.
How Shield fits
Pupils, staff and devices, each on their own policy
- Pupil networkSafeguarding categories, Safe Search on Google, Bing and YouTube, and social media, games and VPN apps blocked.
- Staff networkThreat-first policy with fewer category blocks, set per group through Microsoft Entra ID or Active Directory.
- Visitor and parent WiFiA family-safe guest policy on its own SSID, with nothing to install on visitors' devices.
- By year group and timeStricter rules for younger year groups, and different rules in lessons, at break and after school.
- Staff and head officeThreat defense firstOffice LAN and staff WiFi, by directory group
- Guest WiFiStrict, family-safeVisitors and customers, nothing to installGuest network tiersFree WiFiAd blocking on, streaming limited at busy timesPaid WiFiIts own rules, separate from the free tier
- IoT and branchesLocked downTills, cameras and sensors behind a relay
Schedule, per site
Proof
Standards you can show governors and inspectors
- 10 days
- earlier warning of new malicious domains than standard blocklists
- IWFfiltering meets the bar set by the Internet Watch Foundation
- Friendly WiFistandard met for family-safe filtering
- CIPAsupported, for US schools that filter under the Children's Internet Protection Act
FAQ
Questions we hear from teams like yours
Does Shield help us meet the DfE filtering and monitoring standards?
It helps you meet the filtering standard. Shield blocks harmful categories to the IWF bar, enforces Safe Search and records what each network looked up. Scheduled PDF reports give your designated safeguarding lead evidence for governors. Monitoring pupil activity and your safeguarding process remain with the school.
Are school Chromebooks and iPads filtered at home?
Not by Shield. Shield protects devices while they are on your networks, so Chromebooks and iPads are filtered in every classroom and on every site you run, with nothing to install. At home, school devices need the device-level filtering or endpoint protection you already run.
Can pupils get round it with a VPN?
Shield blocks VPN and proxy apps with one click and answers each lookup on the school network, with nothing on the device for a pupil to switch off. New-domain rules also catch fresh proxy sites registered in the last 7 or 30 days.
Can staff have different rules from pupils?
Yes. Give staff and pupils separate SSIDs or VLANs, or tie policy to Microsoft Entra ID or Active Directory groups. Staff can reach the sites they teach from, while pupils see YouTube with Safe Search enforced.
Do you support CIPA for US schools?
Yes. Shield supports CIPA, filtering harmful content on every pupil network across your schools. Reports by network and device give you evidence for your CIPA obligations.
Other industries
Colleges
Filtering that helps you meet KCSIE for learners, threat-first policy for staff, and BYOD with nothing to install.Higher education
Threat defense for staff, research and student networks, with a policy per VLAN, per group and per halls block.Student accommodation
Threat defense for residents, a policy per block or VLAN, and safeguarding where halls house under-18s.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.