Web filtering and safeguarding for every school network
Your designated safeguarding lead needs to know filtering works, and needs evidence when an inspector asks. Shield filters at the DNS lookup to the IWF standard, with separate policies for staff and pupils by group. Visitor and parent WiFi gets its own family-safe policy, and Shield helps you meet KCSIE and the DfE filtering and monitoring standards, or CIPA in the US.
What is at stake
Where school filtering gets tested
Harmful content in lessons
A pupil searches for something in class and the results come back unfiltered. Safe Search enforced on Google, Bing and YouTube closes that gap.Phishing aimed at staff
A fake login page that captures a teacher's password can open pupil records and lead to ransomware across a trust.Pupils finding a way round
Proxy sites and VPN apps spread fast through a year group. One-click app blocking and new-domain rules catch them early.
How Shield fits
Separate policies for staff, pupils and visitors
- Pupils by year groupStrict categories, Safe Search, and social media and games blocked in lesson time, from Entra ID or Active Directory groups.
- StaffThreat defense first, wider access for teaching resources and video, and generative AI tools allowed or blocked by group.
- School-issued devicesChromebooks and iPads get the pupil policy on every school SSID and site, with nothing to install on them.
- Visitor and parent WiFiA family-safe guest policy on its own SSID, with nothing to install on visitors' devices.
- Staff and head officeThreat defense firstOffice LAN and staff WiFi, by directory group
- Guest WiFiStrict, family-safeVisitors and customers, nothing to installGuest network tiersFree WiFiAd blocking on, streaming limited at busy timesPaid WiFiIts own rules, separate from the free tier
- IoT and branchesLocked downTills, cameras and sensors behind a relay
Schedule, per site
Proof
The filtering standards schools are measured against
- 10 days
- earlier warning of new phishing and malware domains than standard blocklists
- IWFfiltering standard met by Shield, which you can show governors and inspectors
- CIPAsupported for US schools filtering under the Children's Internet Protection Act
- Cyber Essentialsheld by Purple, alongside ISO 27001, GDPR and CCPA
FAQ
Questions we hear from teams like yours
Does Shield help us meet KCSIE and the DfE filtering standards?
It helps you meet them. Shield filters to the IWF standard, applies separate policies for staff and pupils, and sends your designated safeguarding lead scheduled reports to review. KCSIE also expects monitoring and a named person responsible, so Shield is one part of your safeguarding approach, not all of it.
What does the designated safeguarding lead see?
Dashboards and scheduled PDF reports show blocked lookups by category, user and group. Drill-down from a domain shows each device that looked it up, so your DSL can follow up a concern with a name rather than a guess.
Are Chromebooks and iPads filtered at home?
Not by Shield. Shield protects devices while they are on your networks, so Chromebooks and iPads carry the pupil policy in every classroom and on every site you run. At home, school devices need the device-level filtering or endpoint protection you already run.
Can pupils bypass it with a VPN or proxy?
One-click app blocking covers VPN and proxy apps, and new-domain rules block domains registered in the last 7 or 30 days, where new proxy sites tend to appear. Safe Search stays enforced on Google, Bing and YouTube, whichever browser a pupil opens.
Do we need hardware in each school?
No. Point your router, firewall or DHCP at Shield and filtering starts, with no appliance to buy or maintain. Trusts and districts can set a central policy and give each school its own rules and schedules, and the 30-day free trial lets you test it first.
Other use cases
Offices and branches
Threat defense for head office and branch networks, wired and wireless, under one policy.Guest WiFi
Family-safe, faster guest WiFi for any venue, with nothing to install on guest devices.IoT and OT
Threat defense and allow lists for cameras, tills, sensors and plant equipment that cannot run an agent.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.