For Springfield Parents Everywhere

Keep Your Kids Safe Online

A Parent's Field Guide to Locking Down the Internet — Before Your Kid Does It First

Overview

Why This Guide Exists

The average teenager spends more than eight hours a day in front of a screen. A significant portion of that time is spent on platforms designed by engineers who are paid to maximize engagement, not protect your child. The internet as it exists in an unfiltered state is not a safe place for children.

This guide gives parents ten concrete, technically actionable security measures ranging from free router settings that take ten minutes to dedicated hardware appliances. Each entry explains the threat it addresses, exactly how to configure it, a real example you can copy, and—critically—how a determined child will try to circumvent it, so you can stay one step ahead.

None of these tools replace honest conversation. But they buy time, reduce casual exposure, and create a trail of accountability that keeps children safer while they develop the judgment to navigate the internet on their own.

The average child is first exposed to online pornography at age 11. Cyberbullying affects 1 in 3 young people. Social media algorithms are engineered to maximize time-on-platform—not wellbeing.

Parental monitoring is not surveillance. It is supervision. The same way you would not leave a ten-year-old alone on a city street at midnight, you should not leave them alone on an unfiltered internet.

Every tool in this guide has been used by real parents. Every circumvention method has been used by real kids. The goal is to know both.

The Big Picture

How the Layers Fit Together

No single tool is enough. Each of the ten measures sits at a different point along the path your child's data travels — from their device all the way out to the open internet. A determined child who slips past one layer is caught by the next. This is "defense in depth," and it is exactly how professional network security works.

The Device

Phone, tablet, console, or computer in your child's hands.

On-Device

Controls that live on the device and travel everywhere it goes.

hosts file · Net Nanny · Screen Time / Family Link · Browser extensions

Home Router

The gateway every device on your WiFi must pass through.

Firewalla · Router parental controls

DNS Resolver

Answers "where is this website?" — and refuses for blocked sites.

OpenDNS / CleanBrowsing / NextDNS · SafeSearch enforcement

Family VPN

Wraps all traffic — even on mobile data, away from home.

Circle · Bark · NextDNS profile

The Internet

Everything beyond your controls — the open, unfiltered web.

Watching Over Every Layer: Monitoring

Bark, Qustodio, and similar tools sit above the whole chain. Instead of blocking, they read messages and flag danger — grooming, bullying, self-harm — that no content filter can catch, because the threat is in the conversation, not the website.

Section 1

Ten Things to Lock Down and Monitor

Each measure includes the threat it addresses, how to configure it, a concrete example you can replicate, and how children typically bypass it so you can prepare a counter-measure.

Why

Software parental controls can be uninstalled by a persistent teenager. A hardware device sitting between the modem and the internet cannot be bypassed by deleting an app. Firewalla inspects all network traffic at the gateway level, blocks by category (adult, gambling, violence), enforces schedules per device, and sends real-time alerts to your phone when a blocked category is attempted.

How to Set It Up
  1. Purchase Firewalla Gold, Purple, or Blue (Purple handles up to 500 Mbps home connections).
  2. Connect Firewalla between your modem and existing router in "Simple Mode" — the setup wizard in the app walks you through it in about five minutes.
  3. Download the Firewalla app on your phone and complete the pairing process.
  4. In the app, create a Family profile. Assign each child's device by MAC address to the Family group.
  5. Enable "Family Protect" (built-in blocklist), "Adblock," and "YouTube Safe Search" from the profile settings.
  6. Set time schedules per child: tap their profile, choose "Time Limits," and block all traffic between 9 PM and 7 AM on school nights.
Example Configuration
# Firewalla App → Devices → [Child's iPhone]
# Assign to: Family Group
#
# Rules on Family Group:
#   YouTube Safe Search:   ON
#   Block categories:      Adult, Violence, Gambling, VPN Services
#   Bedtime (Sun-Thu):     9:00 PM – 7:00 AM (all traffic paused)
#   Bedtime (Fri-Sat):     11:00 PM – 8:00 AM
#   Data alert:            Notify if device uses > 2 GB/day
#
# To block a specific domain manually:
# Firewalla App → Rules → New Rule → Block → Target Domain
# Domain: tiktok.com → Apply to: Family Group
How Kids Circumvent It
Using mobile data (4G/5G) instead of home WiFi Counter: Enable your carrier's family plan controls (Verizon Smart Family, T-Mobile FamilyMode) which apply the same restrictions on the cellular network. In the Firewalla app, also enable the "Block Mobile Data Bypass" rule so the device cannot use LTE as a fallback when WiFi is restricted.
Running a VPN app on the device to tunnel through Firewalla Counter: In Firewalla Rules, block "VPN Services" category for the Family group. This blocks known VPN protocols (OpenVPN on port 1194, WireGuard on port 51820, and Shadowsocks).
Creating a mobile hotspot from one device to connect another Counter: Contact your carrier and disable the hotspot feature on your child's line. Most family plans allow this through the account management portal without changing any device settings.
Why

Every operating system consults the hosts file before making any DNS request. Entries in this file override DNS entirely: 0.0.0.0 tiktok.com means that domain resolves to nothing, and no browser or app on that machine can reach it, regardless of which DNS server is configured or whether a VPN is running. It is free, requires no subscription, and works completely offline.

How to Set It Up
  1. Open a terminal (Mac/Linux) or Notepad as Administrator (Windows) on the child's computer.
  2. Mac/Linux: run sudo nano /etc/hosts
  3. Windows: navigate to C:\Windows\System32\drivers\etc\hosts
  4. Add one line per domain: 0.0.0.0 domain.com and a second line for 0.0.0.0 www.domain.com
  5. Save the file and flush the DNS cache (see example below).
  6. Make the file read-only under a separate admin account so the child cannot edit it without your password.
Example Configuration
# /etc/hosts additions
# Format: 0.0.0.0 [domain]

# Social media
0.0.0.0  tiktok.com
0.0.0.0  www.tiktok.com
0.0.0.0  m.tiktok.com
0.0.0.0  instagram.com
0.0.0.0  www.instagram.com

# Use the StevenBlack hosts project for 500,000+ domains:
# github.com/StevenBlack/hosts  (regularly updated, free)

# Flush DNS cache after editing:
# macOS:   sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder
# Windows: ipconfig /flushdns
# Linux:   sudo systemd-resolve --flush-caches

# Make read-only on macOS (requires separate admin account):
# sudo chflags uchg /etc/hosts
How Kids Circumvent It
Editing the hosts file if they have admin access Counter: Create a standard (non-admin) user account for your child's daily use and keep the administrator password to yourself. On macOS, use sudo chflags uchg /etc/hosts under the admin account to lock the file from any modification.
Using a VPN which bypasses local DNS entirely Counter: The hosts file alone is insufficient against VPNs. Combine it with network-level DNS filtering (Card 3) and app-install restrictions (Card 6 — Screen Time) to prevent VPN apps from being installed.
Accessing a site by its IP address instead of its domain name Counter: Hosts-file entries are domain-based and do not block IP-direct access. For IP-level blocking, use a network firewall rule on your router or Firewalla to block specific IP ranges.
Why

Every internet connection begins with a DNS lookup. If that lookup goes through a filtering resolver instead of your ISP's default server, the resolver can silently refuse to answer for adult or harmful domains. Changing your router's DNS settings applies this filter simultaneously to every device on your home network — computers, tablets, gaming consoles, smart TVs — with no software installation required on any device.

How to Set It Up
  1. Log into your router admin panel (typically 192.168.1.1 or 192.168.0.1 in a browser).
  2. Find the DNS settings under "Internet Setup," "WAN," or "Network Settings" depending on your router brand.
  3. Replace the Primary and Secondary DNS addresses with one of the options below.
  4. Save and reboot the router.
  5. Verify: open a browser on any device and navigate to a known adult domain — it should show a block page.
  6. Change your router admin password if it is still the default. Write it down and store it somewhere your children cannot find it.
Example Configuration
# Option 1: CleanBrowsing Family Filter (free, no account)
Primary DNS:   185.228.168.168
Secondary DNS: 185.228.169.168
# Blocks: adult, mixed-content, proxy/VPN bypass domains

# Option 2: OpenDNS FamilyShield (free, no account)
Primary DNS:   208.67.222.123
Secondary DNS: 208.67.220.123
# Blocks: adult content categories

# Option 3: NextDNS (free tier, most powerful)
Primary DNS:   [your-profile-specific IP from nextdns.io]
# NextDNS Dashboard → Security → Block Bypass Methods: ON
# NextDNS Dashboard → Parental Controls → SafeSearch: ON
# NextDNS Dashboard → Parental Controls → YouTube Restricted: Strict

# Verify filtering is active from any device:
# nslookup pornhub.com 185.228.168.168
# Expected: returns 0.0.0.0 (blocked)
How Kids Circumvent It
Manually changing DNS settings on their device to 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare) Counter: On routers that support it, add a firewall rule to intercept all outbound DNS traffic (TCP/UDP port 53) and redirect it to your chosen filtering DNS, regardless of what the device requests. Firewalla and pfSense both support this "DNS hijacking" rule.
Using DNS-over-HTTPS (DoH) which is built into Firefox and some Chromium browsers and bypasses traditional DNS entirely Counter: NextDNS offers its own DoH endpoint which you can push to devices as a managed profile. For Firefox, set network.trr.mode = 5 via the browser managed policy to disable DoH. Block Cloudflare's DoH IP (104.16.248.249) at the router firewall level.
Switching to mobile data, which uses the carrier's DNS Counter: NextDNS and CleanBrowsing both offer iOS/Android apps that install as a system-level DNS-over-HTTPS profile, applying filtering even on cellular networks.
Why

DNS-level filters are blind to the content within a web page — they block domains but cannot read what is on a page at a subdomain you did not think to block. Net Nanny operates at the application layer using local SSL inspection: it reads HTTPS page content in real time, categorizes it, masks profanity, and sends instant alerts to parents when their child searches for or views content in sensitive categories. It works on both home WiFi and mobile data.

How to Set It Up
  1. Purchase a Net Nanny Family Protection Pass (covers up to 5 or 20 devices, depending on plan).
  2. Create a parent account at netnanny.com. Add each child as a named sub-profile with their age.
  3. Install the Net Nanny agent on each device. It will prompt you to install a local SSL inspection certificate and grant accessibility permissions.
  4. On iOS, complete the prompted MDM profile installation. On Android, grant the required Accessibility Service permission.
  5. In the parent dashboard, configure per-child rules: select content categories to block and set daily time limits per app category.
  6. Enable "Immediate Alerts" for self-harm, pornography, and violent threat categories.
Example Configuration
# Net Nanny Parent Dashboard → [Child Profile] → Web Filter
#
# Content categories (drag to BLOCK):
#   Pornography:          BLOCK
#   Violence:             BLOCK
#   Drug-Related:         BLOCK
#   Weapons:              BLOCK
#   VPN & Anonymizers:    BLOCK   ← critical
#   Social Networking:    TIME LIMIT (30 min/day after 4 PM)
#   Gaming:               TIME LIMIT (1 hour/day)
#
# Alerts → Immediate notification:
#   Self-Harm / Suicidal content:   ON
#   Sexual / Pornographic content:  ON
#   Violent threats:                ON
#
# Reports: Weekly digest email of top 10 visited sites
How Kids Circumvent It
Attempting to uninstall the Net Nanny app Counter: On Android, activate Net Nanny as a Device Administrator (prompted during setup). A Device Administrator cannot be removed without first revoking admin rights, which requires your parent dashboard password. On iOS, the MDM profile locks uninstallation.
Installing a third-party browser not covered by the Net Nanny proxy Counter: In the Net Nanny app control section, you can block the installation of unrecognized apps. Combine with Screen Time (iOS) or Family Link (Android) to require parental approval for any new app install.
Using a second, unmonitored device such as an old phone or gaming console Counter: Configure your router (Card 4: router controls) so unknown devices are placed into a restricted guest network with blocked adult categories at the DNS level — so even unmonitored devices are filtered by default.
Why

The router is the single choke point for all home internet traffic. Modern consumer routers from ASUS, Netgear, TP-Link, and Eero include built-in parental control suites that require no software installation on child devices. They work at the network level, are invisible to the child, and catch every device including gaming consoles, smart TVs, and IoT devices that cannot run parental control apps.

How to Set It Up
  1. Log in to your router admin panel (check the label on your router for the default IP, usually 192.168.1.1).
  2. Find parental controls, labeled "Access Control," "Family Safety," or "Parental Controls" depending on your router brand.
  3. Identify each child's device by MAC address (iPhone: Settings → General → About → WiFi Address).
  4. Assign the device to a schedule: block internet access during school hours and after bedtime.
  5. For content filtering, enable the router's built-in content filter if available (ASUS: AiProtection; Eero: eero Plus subscription; TP-Link Deco: HomeShield).
  6. Change the router admin password from the default. Store it somewhere your children cannot access.
Example Configuration
# ASUS Router: AiProtection + Parental Controls
# Admin Panel → AiProtection → ON

# Parental Controls → Time Scheduling:
#   Device: [Child's MacBook] (MAC: AA:BB:CC:DD:EE:FF)
#   Block times (Mon–Fri):  10:00 PM – 7:00 AM
#   Block times (Sat–Sun):  12:00 AM – 9:00 AM

# Website Filter → Activate for MAC AA:BB:CC:DD:EE:FF
#   Block categories: Adult, Gambling, Violence, Drugs, P2P

# Default policy for unknown devices:
#   Settings → Guest Network → Block guest from accessing intranet
#   (All unrecognized MACs go to a restricted guest VLAN)
How Kids Circumvent It
MAC address spoofing — changing the device's MAC to appear as an unrestricted device Counter: Set your router's policy for unknown/unrecognized MAC addresses to "block by default." This means any spoofed MAC that does not match an explicitly allowed device will land in a blocked state or the restricted guest network.
Connecting to a neighbor's WiFi or creating a mobile hotspot Counter: Combine router controls with device-level controls (Card 6: Screen Time / Family Link) which travel with the device to any network, and with carrier-level family controls for mobile data.
Resetting the router to factory defaults to erase the parental control settings Counter: Some routers allow disabling the physical reset button in firmware settings. At minimum, change the admin password from the default so a router reset does not restore it to a known credential.
Why

Network-level controls vanish the moment a child leaves home. Device-level controls built into the operating system persist across WiFi, mobile data, school networks, and friends' houses. Both Apple Screen Time and Google Family Link integrate deeply with the OS: they control app installs, enforce content ratings, limit daily usage, and can lock the device remotely. They are enforced cryptographically and cannot be removed without a parent passcode.

How to Set It Up

Apple Screen Time (iPhone / iPad):

  1. Settings → Screen Time → "This is My Child's [Device]"
  2. Set a Screen Time passcode — use six digits entirely different from the device unlock PIN.
  3. Content & Privacy Restrictions → Enable → Web Content → "Limit Adult Websites."
  4. Communication Limits: restrict who the child can contact during school hours and downtime.
  5. Downtime: set a schedule (e.g., 9 PM to 7 AM) during which only "Always Allowed" apps work.

Google Family Link (Android):

  1. Create or link a Google account for your child at families.google.com. This must be a supervised account.
  2. On your phone, install the Family Link parent app. On the child's phone, install the Family Link child app.
  3. Set daily screen time limits, bedtime locks, and require your approval for all Play Store downloads.
  4. Enable SafeSearch: Family Link → child profile → Settings → Google Search → SafeSearch: Filter.
Example Configuration
# Apple Screen Time via Family Sharing (remote management)
# Settings → [Your Name] → Family Sharing → Screen Time
#
# Content & Privacy Restrictions:
#   Web Content:          Limit Adult Websites
#   Never Allow (custom): reddit.com, discord.com, 4chan.org
#   App Store Purchases:  Require Password (always)
#   Allowed Apps:         Camera, Messages, Safari (only)
#
# App Limits:
#   Social Networking:    30 minutes per day
#   Entertainment:        1 hour per day
#
# Downtime:
#   Schedule:             9:00 PM – 7:00 AM (Mon–Sun)
#   Always Allowed:       Phone, Messages (call/text parents only)
#
# Screen Time Passcode:   [6-digit code, unrelated to device PIN]
How Kids Circumvent It
Guessing or watching you enter the Screen Time passcode Counter: Use a genuinely random 6-digit code with no connection to birthdays, addresses, or the device PIN. Do not enter it while your child can see the screen. Change it every few months.
Factory resetting the iPhone to erase Screen Time restrictions Counter: Enable Apple's Activation Lock by ensuring the device is linked to your Apple ID (the parent's) in Family Sharing. A factory-reset device locked to your Apple ID cannot be activated without your iCloud credentials.
Creating a second Apple ID or Google account not under Family supervision Counter: On iOS, Screen Time can block the ability to create new Apple IDs: Content & Privacy Restrictions → Account Changes → "Don't Allow." This prevents account switching without your passcode.
Why

Home network controls (router, Firewalla, DNS filtering) apply zero protection the moment a child leaves the house. A family-managed VPN installs a network profile on the device that routes all DNS queries — and optionally all traffic — through a parental filtering proxy regardless of whether the device is on home WiFi, a school network, a friend's WiFi, or LTE. This is the only category of control that extends coverage everywhere the device goes.

How to Set It Up
  1. Choose a service: NextDNS (DNS-only, free tier available, most configurable), Circle Go (full traffic proxy, requires Circle Home Plus hardware + subscription), or Bark (monitoring focus with device-level VPN for iOS/Android).
  2. NextDNS approach: Create an account at nextdns.io. Configure blocklists and parental controls in the dashboard. On the child's iPhone: install the NextDNS app, tap "Link to Account," enable the VPN profile when prompted. The profile persists across reboots and network changes.
  3. Circle Go approach: Set up Circle Home Plus on your router (plug it in, pair via app). Subscribe to Circle Go ($4.99/month additional). In the Circle app, tap your child's profile → Enable "Circle Go" → Follow the prompts to install the profile on their device. This applies the same rules you set at home to the device on any network.
  4. After installation, verify: turn off home WiFi on the device, use LTE, and attempt to access a blocked domain. It should be blocked.
Example Configuration
# NextDNS Profile on iOS (installs as DNS-over-HTTPS profile)
# nextdns.io → Setup → iOS → Download Profile
# Install in: Settings → General → VPN & Device Management
#
# Lock the profile (prevent deletion):
# Use Apple Configurator 2 (free, Mac App Store) to:
#   1. Supervise the device (one-time setup, requires USB)
#   2. Push the NextDNS profile as "non-removable"
#   3. Set a supervision passcode separate from Screen Time
#
# NextDNS Dashboard settings:
#   Blocklists: OISD Full, HaGeZi Multi-Pro
#   Parental Controls:
#     SafeSearch:          Enforce (all search engines)
#     YouTube Restricted:  Strict
#     Block: TikTok, Instagram, Snapchat, Discord
#     Block Bypass Methods: ON  ← blocks VPN-over-VPN attempts
How Kids Circumvent It
Deleting the VPN/DNS profile in Settings → General → VPN & Device Management Counter: If the device is supervised via Apple Configurator 2, the profile is flagged as non-removable and the delete option does not appear. Supervision is a one-time USB process but makes all profiles and restrictions permanent until you explicitly remove them.
Installing a competing VPN app to override the DNS profile Counter: Use Screen Time to block the App Store category "Utilities" or specifically block VPN apps by name. Also block the VPN Services category in NextDNS so known VPN domains cannot be resolved.
Using a friend's device that has no profile installed Counter: This requires an honest conversation. No technology fully addresses a child determined to use another person's device. Build trust and set clear expectations about device use at friends' homes.
Why

Search engines are often the first vector through which children encounter graphic content — a homework search for "anatomy" or "war history" can surface deeply inappropriate images without SafeSearch. YouTube's recommendation algorithm can lead from innocuous content toward increasingly extreme material within minutes. Configuring SafeSearch enforcement at the DNS level makes it mandatory on every device simultaneously, without needing to change any device's settings individually.

How to Set It Up
  1. The most effective method is to add DNS CNAME overrides in your Pi-hole, NextDNS, or router so that Google, Bing, and YouTube resolve to their SafeSearch-enforced endpoints rather than their regular IPs.
  2. Google SafeSearch via DNS: Create a CNAME record mapping google.com and www.google.com to forcesafesearch.google.com.
  3. Bing SafeSearch via DNS: Create a CNAME record mapping bing.com and www.bing.com to strict.bing.com.
  4. YouTube Restricted Mode via DNS: Create CNAME records mapping youtube.com, www.youtube.com, and m.youtube.com to restrict.youtube.com.
  5. NextDNS handles all of the above with one-click toggles in the Parental Controls dashboard. OpenDNS FamilyShield applies Google and Bing SafeSearch automatically.
Example Configuration
# Pi-hole: Local DNS → CNAME Records
google.com              → forcesafesearch.google.com
www.google.com          → forcesafesearch.google.com
google.co.uk            → forcesafesearch.google.com
google.ca               → forcesafesearch.google.com
bing.com                → strict.bing.com
www.bing.com            → strict.bing.com
youtube.com             → restrict.youtube.com
www.youtube.com         → restrict.youtube.com
m.youtube.com           → restrict.youtube.com

# NextDNS equivalent (one-click in dashboard):
# Parental Controls → Force Google SafeSearch:    ON
# Parental Controls → YouTube Restricted Mode:    Strict
# (Automatically applies to all regional Google domains)

# Verify SafeSearch is locked (on any device on the network):
# 1. Go to google.com/search?q=test
# 2. Look for "SafeSearch is locked" text at the top of results
How Kids Circumvent It
Using alternative search engines (DuckDuckGo, Yandex, Brave Search) that are not covered by these DNS overrides Counter: Block alternative search engine domains at the router or DNS level. Add duckduckgo.com, search.brave.com, yandex.com, and search.yahoo.com to your DNS blocklist, leaving only Google and Bing accessible.
Using regional Google domains (google.co.uk, google.fr) which may not be covered by a simple google.com override Counter: NextDNS and OpenDNS automatically apply SafeSearch enforcement across all regional Google domains. If using Pi-hole manually, add entries for the most common regional domains: co.uk, ca, com.au, de, fr, co.in.
Accessing YouTube content directly by URL or embedded video without going through the main YouTube search Counter: The CNAME override applies to all youtube.com traffic, not just the homepage. Restricted Mode is enforced at the YouTube server level when restrict.youtube.com is the resolved endpoint, so direct video URLs are also filtered.
Why

No DNS filter is perfectly comprehensive. Browser extensions intercept page loads before rendering begins, blocking specific URLs, injecting ad and tracker blocking, and enforcing usage time limits. uBlock Origin with adult-content filter lists blocks categories that DNS resolvers miss, particularly content hosted on CDNs shared with legitimate sites. BlockSite adds schedule-based access controls and session limits directly in the browser.

How to Set It Up
  1. Install uBlock Origin in Chrome, Firefox, or Edge from the browser's extension store.
  2. Open the uBlock Origin dashboard (click the icon, click the gear). Go to "Filter Lists."
  3. Under "Malware domains," enable all available lists. Under "Annoyances," enable uBlock filters. Add custom lists via URL (see example below).
  4. Install BlockSite from the Chrome or Firefox extension store. Create a free account (enables cloud sync). Add blocked categories: Adult, Gambling.
  5. Lock extensions so the child cannot remove them: on Windows, use Group Policy; on macOS, enable Chrome Managed Browser enrollment; or use Screen Time to block the ability to manage browser extensions at the OS level.
Example Configuration
# uBlock Origin → My Filters tab (custom block rules):
||tiktok.com^
||snapchat.com^
||reddit.com^
||discord.com^
# Block any page mentioning specific terms (advanced):
! example.com##.adult-content-class

# Add HaGeZi Multi-Pro list (comprehensive, maintained daily):
# uBlock Origin → Filter Lists → Custom → Add:
# https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt

# Windows Group Policy (Chrome managed):
# HKLM\SOFTWARE\Policies\Google\Chrome
#   ExtensionInstallForcelist:
#     1 = "cjpalhdlnbpafiamejdnhcphjbkeiagm"  ← uBlock Origin
#     2 = "eiimnmioipafcokbfikbljfdeojpcgbh"  ← BlockSite
#   ExtensionInstallBlocklist: *
#     (Prevents installation of any other extension)
#   IncognitoModeAvailability: 1
#     (Disables Incognito mode entirely)
How Kids Circumvent It
Installing a different browser (Brave, Opera, Tor) where the extensions are not present Counter: Use Screen Time (iOS/macOS) or Group Policy (Windows) to whitelist only Chrome and Safari and block installation of new applications. On Windows, also use Group Policy to restrict executable launches to the approved browser list.
Disabling extensions from the browser's extension manager page Counter: The Group Policy approach above with ExtensionInstallForcelist makes extensions permanently active and non-removable. The remove button simply does not appear for force-installed extensions.
Using Incognito / Private Browsing mode, where extensions are disabled by default in Chrome Counter: Set IncognitoModeAvailability = 1 in Group Policy to disable Incognito entirely. Alternatively, manually enable uBlock Origin in Incognito from the extensions page (requires admin/parent access to change).
Why

The leading risks on social media are not content exposure alone but behavioral: cyberbullying, predatory contact, self-harm conversations, and depression. These occur in private messages, not public posts — content filters cannot see them. Bark uses AI to analyze message content across 30+ platforms and alerts parents only when genuinely concerning patterns emerge, without requiring parents to read every message. This preserves age-appropriate privacy while maintaining a safety net for serious threats.

How to Set It Up
  1. Create a Bark account at bark.us. The standard plan is $14/month for up to five children.
  2. Install the Bark app on the child's device and grant the required permissions (Accessibility service on Android; Screen Recording and VPN on iOS).
  3. In the Bark parent dashboard, connect the child's social accounts: enter the child's Instagram, Snapchat, Gmail, iCloud, TikTok, and Discord credentials to grant Bark read-access to messages.
  4. Configure alert sensitivity: Self-Harm to High, Sexual Content to High, Cyberbullying to High, Drug/Alcohol to Medium (reduces false positives).
  5. Bark will send you a text and email alert only when it detects something concerning, not for every message.
Example Configuration
# Bark Dashboard → Alert Preferences → [Child Name]
#
# Alert me immediately (SMS + email) for:
#   [HIGH] Self-harm / suicidal content
#   [HIGH] Sexual content / predatory contact
#   [HIGH] Cyberbullying (as sender or recipient)
#   [HIGH] Depression and anxiety indicators
#   [MED]  Drug and alcohol references
#   [LOW]  Profanity (weekly digest only — reduces alert noise)
#
# Platforms monitored by Bark:
#   iMessage, Instagram DMs, Snapchat, Gmail, Google Docs,
#   TikTok DMs, Discord, YouTube comments, Twitter/X DMs,
#   Facebook Messenger, WhatsApp, Kik, email (20+ providers)
#
# Bark does NOT show parents the full message text.
# It shows a context snippet around the flagged content only.
How Kids Circumvent It
Creating a secondary "finsta" or burner account that was never connected to Bark Counter: Bark monitors device activity logs and new app installations. New unrecognized accounts may appear in the activity report. Combine with App Store purchase approval so new social apps require your explicit permission to install.
Using gaming chat (Xbox Live, PlayStation Network, Roblox, Discord) instead of traditional social media, since parents rarely think to monitor it Counter: Bark monitors Discord. For Xbox and PlayStation, configure console-level parental controls in the account dashboard: Microsoft Family Safety app controls Xbox messaging and content; PlayStation Family Management controls PS5/PS4 messaging. Roblox has parental pin controls and message filtering for children under 13.
Deleting message history before Bark's periodic sync captures it Counter: Bark syncs frequently and attempts to capture messages before deletion in most cases, but it is not foolproof against immediate deletion. The most resilient counter is an ongoing open conversation with your child about online safety, trust, and consequences — technology alone cannot substitute for relationship.
By the Numbers

The Scale of the Problem

Every figure below comes from the peer-reviewed studies cited in the next section. The charts fill in as you scroll.

95%
Have a Smartphone
of U.S. teens have access to a smartphone (Pew Research)
58%
Cyberbullied
lifetime victimization rate, 2025 (Cyberbullying Research Center)
59%
Exposed to Porn
of adolescents exposed to online pornography (J. Adolescent Health)
1 in 9
Solicited Online
receive unwanted sexual solicitations (Crimes Against Children RC)

The Awareness Gap: What Kids See vs. What Parents Know

Children who saw something upsetting online last month
53%
Parents who were aware it happened
19%

Source: Internet Matters and Ofcom surveys of UK children and parents. The gap between what children encounter and what parents realize is the single strongest argument for active monitoring.

Section 2

Why Monitoring Matters: The Research

Ten peer-reviewed studies and authoritative reports documenting the documented harms of unmonitored youth internet use — and the measured benefits of parental engagement.

Common Sense Media 2021
The Common Sense Census: Media Use by Tweens and Teens
Key finding 8 hrs 39 min per day — average teen screen time, excluding schoolwork

The largest ongoing study of youth media consumption in the United States, surveying over 1,500 children ages 8-18. The 2021 edition documented a 17% acceleration in screen time over two years, with tweens averaging 5 hours 33 minutes daily and teens averaging 8 hours 39 minutes. These figures do not include time spent on screens for school assignments.

commonsensemedia.org/research
Pew Research Center 2022–2024
Teens, Social Media and Technology
Key finding 48% of teens say they are online "almost constantly"

Pew's annual survey of 1,316 U.S. teenagers documents near-universal social media adoption and the platforms' dominance in daily teen life. YouTube is used by 93% of teens, followed by TikTok (63%), Snapchat (60%), and Instagram (59%). More than nine-in-ten teens report using the internet at least daily, with nearly half reporting near-constant connectivity.

pewresearch.org/internet
American Academy of Pediatrics 2016
Media and Young Minds — AAP Policy Statement
Key finding No screens before 18 months; max 1 hr/day ages 2–5

The foundational AAP policy statement synthesizing research on cognitive development, attention, sleep disruption, and social development in relation to screen exposure. The statement establishes evidence-based guidelines across developmental age groups and emphasizes the importance of parental co-viewing and active engagement rather than passive consumption. Published in the journal Pediatrics, November 2016.

publications.aap.org
Cyberbullying Research Center 2004–2025
Summary of Cyberbullying Research: Hinduja & Patchin
Key finding Lifetime victimization rose from 33.6% (2016) to 58.2% (2025)

The most comprehensive longitudinal research on cyberbullying prevalence in the United States, spanning 21 years of data collection. Researchers Sameer Hinduja and Justin Patchin have tracked a consistent rise in both perpetration and victimization rates, with strong correlations between cyberbullying victimization and depression, anxiety, self-harm, and academic decline. Recent data shows boys are now more heavily involved than in earlier cohorts.

cyberbullying.org
JAMA Pediatrics 2019
Association of Screen Time and Depression in Adolescence — Boers et al.
Key finding Social media and TV use associated with measurable depressive symptom increases

A longitudinal cohort study following 3,826 adolescents measuring screen time and depression scores at multiple time points. The study found significant within-person associations between social media use and television viewing with subsequent increases in depressive symptoms, controlling for prior depression. The dose-response relationship was stronger for social media than for other screen activities. Published in JAMA Pediatrics, 173(9), 2019.

jamanetwork.com
Clinical Psychology: Science & Practice 2018
Depressive Symptoms, Suicide Rates, and Increased Screen Time After 2010 — Twenge et al.
Key finding 50% increase in teen major depression since 2011; 5+ hrs/day users 2x more likely to be depressed

Analysis of data from 612,000 adolescents via the National Survey on Drug Use and Health (2005-2017) found a 50% increase in major depressive episodes among teens between 2011 and 2015, coinciding precisely with the mass adoption of smartphones. Adolescents reporting five to seven hours of daily phone use were twice as likely to report depression and suicidal ideation compared to those using phones one to two hours daily. Published in Clinical Psychological Science.

journals.sagepub.com
Internet Matters (UK) 2023
Children's Wellbeing in a Digital World Index
Key finding 53% of children saw something uncomfortable online; only 19% of parents were aware

Annual UK-based index measuring children's online wellbeing across safety, relationships, skills, and opportunity dimensions. The 2023 report surveyed 2,000 parents and children and identified a significant gap between children's reported experiences and parental awareness of those experiences. 27% of children were contacted by strangers, and 22% encountered violent content, yet the majority of parents reported no awareness of these incidents.

internetmatters.org
Journal of Adolescent Health 2015–2020
Adolescent Exposure to Online Pornography — Beyens, Vandenbosch & Eggermont
Key finding 59% of adolescents exposed to online pornography; 24% weekly; most first exposure before age 13

Cross-sectional analysis of over 10,000 European adolescents examining prevalence, frequency, and psychosocial correlates of online pornography exposure. The study found that frequent pornography exposure correlates with distorted sexual attitudes, increased sexual risk behaviors, anxiety, depression, and academic performance decline. A systematic review published in the same journal in 2020 confirmed the findings in a broader sample of 110,000 young people across 39 studies.

adolescenthealth.org
NSPCC (UK) Annual
How Safe Are Our Children? Annual Report
Key finding Online child sexual abuse reports to the IWF increased 360% over five years to 2023

The NSPCC's authoritative annual report aggregates data from UK child protection services, police records, and national surveys to provide year-on-year trend data on child safety risks including online offenses. The 2020 edition reported approximately an 80% increase in online child sexual abuse crimes recorded by police in recent years. The Internet Watch Foundation data shows exponential growth in online child sexual abuse material being reported and removed annually.

nspcc.org.uk
Child Mind Institute 2017
Children's Mental Health Report: Smartphones and Social Media
Key finding Girls using social media 5+ hrs/day are 66% more likely to have at least one suicide risk factor

The Child Mind Institute synthesizes clinical and research evidence on the mental health impacts of smartphone and social media use in adolescents, drawing on data from over 1,500 clinical cases and peer-reviewed literature. The report is widely cited by pediatricians and school counselors and covers the mechanisms behind anxiety amplification, depression, sleep disruption from nighttime device use, and social comparison effects specific to image-heavy platforms. Available free at childmind.org.

childmind.org
American Psychological Association 2023
Health Advisory on Social Media Use in Adolescence
Key finding Social media use before age 15 significantly elevates risk of harm; parental monitoring is protective

The APA's first-ever formal health advisory on adolescent social media use, drawing on decades of research to issue concrete recommendations to parents, policymakers, and platform designers. The advisory states that adolescent brains are uniquely susceptible to social comparison, reward feedback loops, and addictive platform design. It recommends parental oversight of content and usage, technology-free bedrooms, and warns particularly against use before age 15.

apa.org
Stanford Internet Observatory 2023
Minors and CSAM: How Instagram's Systems Enabled Exploitation Networks
Key finding Instagram's own recommendation algorithm actively connected adults seeking to exploit minors

Stanford Internet Observatory researchers created test accounts presenting as minors and documented that Meta's recommendation systems surfaced accounts explicitly offering child sexual abuse material within minutes. The investigation revealed that adult accounts seeking to exploit children were being algorithmically connected to minor accounts through Instagram's "suggested accounts" and "explore" features, despite Meta's stated policies prohibiting such content. The findings prompted Congressional hearings.

cyber.fsi.stanford.edu
Sleep Medicine Reviews 2020
Screen Time and Sleep Disruption in Children and Adolescents: A Meta-Analysis
Key finding Screen use near bedtime reduces sleep duration by an average of 52 minutes per night

A meta-analysis synthesizing 35 studies covering 30,000 children found that screen use near bedtime is consistently associated with reduced sleep duration, delayed sleep onset, and poorer sleep quality. The blue-light suppression of melatonin, combined with cognitive stimulation from social content, creates a neurological pathway from screen use directly to sleep deficit. Sleep deprivation in adolescents is itself independently associated with depression, poor academic performance, and obesity.

sleepfoundation.org
Ofcom (UK) 2023
Children and Parents: Media Use and Attitudes Report
Key finding 40% of 8-17 year olds have seen content online that bothered or upset them in the past week

Ofcom's annual survey of 3,000 UK children and their parents tracks media consumption, online harms encountered, and parental awareness gaps. The 2023 edition found that children are encountering harmful content at significantly higher rates than parents estimate, with a growing gap between child-reported exposure and parental awareness. The report also documents that children are developing coping strategies for online harms independently rather than turning to parents, partly due to fear of losing device privileges.

ofcom.org.uk
JAMA Network Open 2022
Online Predatory Behavior and Child Victimization — Wolak, Finkelhor & Mitchell
Key finding 1 in 9 children receives unwanted sexual solicitations online; only 25% tell a parent

This landmark longitudinal study from the Crimes Against Children Research Center followed thousands of internet-using youth and documented the prevalence of online sexual solicitation, grooming tactics, and the pathways from online contact to offline abuse. The research established that most predatory contacts begin on platforms children use daily for social interaction, and that parental awareness and monitoring significantly reduces the likelihood of children maintaining contact with online predators.

jamanetwork.com
Section 3

Platform-by-Platform Safety Settings

The six platforms most used by children, with exact settings to configure and the risks each one poses if left at defaults.

TT
TikTok
High Risk

Threat

TikTok's "For You Page" algorithm surfaces content based on engagement, not age-appropriateness. Children are exposed to eating disorder content, violent trends, sexual material, and adult creators within minutes of opening the app. The default allows anyone to send direct messages to anyone over 16.

Family Pairing (the right way to set it up)

  1. Open TikTok on your phone. Go to Profile → Menu (three lines) → Settings → Family Pairing → Parent.
  2. A QR code appears. On your child's phone, go to the same menu → Family Pairing → Teen → Scan the QR code.
  3. Once linked, you control all settings below from your phone, not theirs.

Settings to lock

  • Screen Time: Set a daily limit (e.g., 60 min). Enable Screen Time Management → set a 4-digit passcode the child does not know.
  • Direct Messages: Set to "No one" for under-16. For 16-17, set to "Friends only."
  • Search: Restrict search to prevent finding specific creators or content.
  • Restricted Mode: Enable to filter mature content. Not perfect but removes the most obvious material.
  • Duet & Stitch: Set to "No one" — this prevents strangers from using your child's videos.
  • Who can see videos: Set to "Friends" or "Only me" by default.

What Family Pairing cannot do

Family Pairing does not block TikTok entirely, does not monitor message content, and does not prevent your child from creating a second TikTok account on another device. Combine with Bark for message-level monitoring.

IG
Instagram
High Risk

Threat

Instagram is the platform most associated with social comparison, body image distortion, and depression in adolescent girls. Its Explore and Reels algorithms surface content far beyond what a child follows. The DM system allows any account to contact any other account, including minors, by default. Research by the Stanford Internet Observatory found that Meta's own recommendation systems actively connected adults seeking to exploit minors.

Instagram Supervision (Meta's parental tool)

  1. Both parent and child must have Instagram accounts.
  2. Child's account: Profile → Settings → Supervision → "Invite your parent or guardian."
  3. Parent receives an email or in-app notification and accepts.
  4. Parent can then see: time spent, accounts followed/following, content reported, and set daily time limits.

Privacy settings to lock

  • Account Privacy: Settings → Privacy → Private Account: ON. Only approved followers see posts.
  • Message Controls: Settings → Messages → Message Controls → "People you follow" only. Prevents strangers from sending DMs.
  • Comment Filters: Settings → Privacy → Comments → enable "Advanced Comment Filtering."
  • Story Sharing: Settings → Privacy → Story → "Close Friends" list or "Off."
  • Activity Status: Settings → Messages → Show Activity Status: OFF. Prevents strangers knowing when your child is online.
  • Sensitive Content: Settings → Content Preferences → Sensitive Content Control → "Limit Even More."
SC
Snapchat
High Risk

Threat

Snapchat's disappearing messages create a false sense that content cannot be screenshotted or preserved — which encourages sharing of explicit photos. The app is a primary vector for sexting among teens. The Snap Map feature reveals a child's precise location to all friends by default. "Quick Add" and "Discover" surface unknown adults and drug-related content.

Family Center setup

  1. Parent must have a Snapchat account.
  2. Your Snapchat: Profile → Settings → Family Center → Invite your teen.
  3. Teen receives a notification and must accept the connection (both must be willing).
  4. Parent sees: who the teen is friends with, who they have been messaging (not content), and any content the teen has reported.

Settings to lock

  • Snap Map: Settings → Privacy → See My Location → "Ghost Mode" (completely hides location). Never leave this at "All Friends."
  • Contact Me: Settings → Privacy → Contact Me → "My Friends" only. Prevents strangers sending snaps.
  • View My Story: Settings → Privacy → View My Story → "My Friends."
  • Quick Add: Settings → Privacy → See Me in Quick Add → OFF. Prevents strangers finding your child.
  • Notifications: Family Center allows parents to be notified when new friends are added.

Limitation

Family Center cannot read message content. Bark connects to Snapchat and monitors for keyword-triggered content before messages disappear.

DC
Discord
High Risk

Threat

Discord has no native parental controls whatsoever. The minimum age is 13 but is completely unenforced. Children join servers with adult strangers, receive unsolicited DMs, and encounter explicit imagery, radicalization content, and drug sales. Discord is particularly dangerous because it is primarily accessed through gaming — children perceive it as a gaming tool, not a social media platform, and parents often do not monitor it.

For children under 13: block it entirely

# DNS blocklist entry or router rule:
# Block: discord.com, discordapp.com, cdn.discordapp.com
# Also block the iOS/Android app via Screen Time / Family Link

For teens (13+): harden the account

  1. 2FA: User Settings → My Account → Enable Two-Factor Authentication. Prevents account takeover.
  2. Safe Direct Messaging: User Settings → Privacy & Safety → Safe Direct Messaging → "Keep me safe" (scans and deletes explicit images from DMs automatically).
  3. DMs from server members: User Settings → Privacy & Safety → "Allow direct messages from server members" → OFF. Only existing friends can DM your child.
  4. Friend Requests: Set to "Friends of Friends" only, not "Everyone."
  5. Explicit Image Filter: Server Settings → Safety Setup → Explicit Image Filter → "Keep me safe."

Monitoring

Bark monitors Discord DMs and server messages for concerning keywords. This is the most practical monitoring option for teens who use Discord for legitimate gaming communities.

RB
Roblox
Med Risk

Threat

Roblox is marketed as a child-friendly game platform but hosts user-generated content including games with sexual themes, violent content, and gambling mechanics. The in-game chat system is an active vector for grooming. Real-money purchases (Robux) are addictive by design. Children aged 7-12 make up the majority of the user base, making it a target for predatory adults.

Account settings to lock (do these now)

  1. Account PIN: Settings → Security → Account PIN → Enable with a 4-digit code only you know. This prevents your child from changing any settings.
  2. Privacy Settings: Settings → Privacy → Set all options (Who can message me, Who can chat with me, Who can invite me) to "Friends" or "No one."
  3. Under-13 accounts: Roblox automatically restricts chat to approved messages for accounts registered as under 13. Verify the birth date is set correctly on the account.
  4. Parental PIN for purchases: Settings → Billing → set a spending limit and enable purchase verification so every Robux purchase requires your approval.
  5. Two-Step Verification: Settings → Security → Two-Step Verification → use your email address, not the child's phone. This ensures account recovery goes to you.

Content to watch for

Search your child's favorite Roblox games by name on a review site. Some user-created games have embedded inappropriate content. The Roblox platform cannot guarantee all games are age-appropriate despite moderation efforts.

YT
YouTube
Med Risk

Threat

YouTube's recommendation algorithm is engineered to maximize watch time, not wellbeing. Studies have documented pathways from age-appropriate content to increasingly extreme material in a handful of recommendation steps. Autoplay is on by default. Comments on videos expose children to adult language and inappropriate contact. The standard YouTube app has no meaningful age filter — any content on the platform is accessible.

YouTube Kids app (ages up to ~9)

YouTube Kids is a completely separate application with curated, moderated content. Set it as the only YouTube-type app available:

  1. Install YouTube Kids (free). Set the content level to match your child's age.
  2. Enable "Approved Content Only" mode: Settings → (lock icon) → Approved Content Only. You manually approve individual channels or videos your child can watch.
  3. Block full YouTube via DNS or Screen Time so the child cannot switch to the main app.

YouTube Supervised Experience (ages 9-12)

  1. Create a Google account for your child through families.google.com (supervised account).
  2. In YouTube, sign in with the child's supervised account.
  3. Go to youtube.com/kids/supervised to link the parent account.
  4. This enables "Supervised Explore" — broader content than YouTube Kids but filtered through Google Family Link's content controls.

Restricted Mode & SafeSearch (all ages, network-wide)

# Router DNS CNAME override (covers all devices at once):
youtube.com     → restrict.youtube.com
www.youtube.com → restrict.youtube.com
m.youtube.com   → restrict.youtube.com

# Or use NextDNS dashboard:
# Parental Controls → YouTube Restricted Mode: Strict

Settings to change on every YouTube account

  • Autoplay: Account → Settings → Autoplay: OFF. Stops the "one more video" trap.
  • Comments: Your child should not have a YouTube channel with comments enabled. If they do, set comments to "Hold all comments for review."
  • History: Review watch history weekly in YouTube Studio or the account's My Activity page.
Section 4

What to Allow — By Age

Controls that are appropriate at eight are too restrictive at fifteen. This guide gives age-appropriate defaults that gradually extend autonomy as children demonstrate judgment.

Ages 4–7 Supervised Only
Devices
  • Shared family tablet or computer only — no personal device
  • Device stays in common areas, never in the bedroom
  • All use is co-viewed with a parent
  • No smartphone
Content
  • YouTube Kids only — Approved Content mode
  • Educational apps only, pre-approved by parent
  • No web browsing without a parent present
  • No social media of any kind
Time
  • Maximum 1 hour/day of recreational screen time
  • No screens in the 1 hour before bedtime
  • No screens during meals
Tools to use
  • YouTube Kids (Approved Content)
  • Router time schedules
  • Physical device storage in a locked drawer at night
Ages 8–11 Monitored Access
Devices
  • Shared or individual device with full parental controls enabled
  • Device charges outside the bedroom at night
  • Basic phone for calls/texts only — no smartphone with internet
Content
  • YouTube with Supervised Experience or Restricted Mode via DNS
  • SafeSearch locked network-wide
  • No social media accounts (minimum age for most platforms is 13)
  • Approved game platforms only (Roblox with Account PIN and privacy locked)
  • /etc/hosts blocking of inappropriate domains
Time
  • 1–2 hours/day recreational screen time
  • Devices off at 8:30 PM — enforced by router or Screen Time
Tools to use
  • Screen Time / Family Link (full restrictions)
  • DNS filtering (CleanBrowsing or NextDNS)
  • Router time schedules
  • YouTube Kids or Supervised Experience
Ages 12–14 Supervised Social Access
Devices
  • Personal smartphone with parental controls active
  • Device charges in a common area or parent's room overnight — no exceptions
  • Parent knows all account usernames and passwords
Content
  • One or two social platforms at most, with privacy settings configured by parent
  • All new app installs require parental approval
  • Bark or Qustodio monitoring active on all accounts
  • No anonymous platforms (Whisper, anonymous question apps)
  • No streaming services without a parent-controlled profile
Time
  • 2 hours/day recreational screen time (enforced by Screen Time / Family Link)
  • No devices after 9:30 PM; device leaves bedroom at bedtime
  • No devices during homework time or meals
Tools to use
  • Bark (social media monitoring)
  • Screen Time / Family Link (app limits, downtime)
  • NextDNS device profile (works away from home)
  • Carrier family controls (mobile data)
Ages 15–17 Graduated Autonomy
Devices
  • Personal smartphone with lighter-touch monitoring
  • Device ideally still charged outside bedroom, though increasingly a negotiation
  • Transparency over surveillance: teen knows monitoring tools are in place
Content
  • Social media allowed with ongoing conversations about risks
  • Bark still active — framed as a safety net, not surveillance
  • App approvals may be relaxed for 17-year-olds with demonstrated judgment
  • Adult content still filtered via DNS — explain why, not just "because I said so"
Time
  • Negotiate screen time rather than enforce it top-down
  • Set clear expectations: no devices during sleep hours, grades must stay up
  • Weekly check-ins on what they are consuming and who they are talking to
Tools to use
  • Bark (alert-only, not full monitoring)
  • DNS filtering still active (adult content)
  • Open conversations as the primary safety tool
  • Clear, agreed-upon household rules written down
Section 5

Warning Signs: When Something Is Wrong

Know what you are looking for Technology controls catch a significant fraction of problems, but not all of them. Children who are being groomed, cyberbullied, radicalized, or are struggling with addiction or self-harm will often show behavioral changes before the content is ever detected. These warning signs are not proof of a problem — they are reasons to open a conversation.
Behavioral
Hiding the Screen When You Walk By

A child who flips their phone face-down, switches apps, or minimizes the browser whenever a parent enters the room is not simply seeking privacy — they are concealing specific content. Occasional privacy is normal; reflexive concealment is a signal.

Emotional
Extreme Distress When Devices Are Removed

Some frustration when a device is taken away is normal. Disproportionate anger, crying, panic, or threats at the prospect of losing device access can indicate psychological dependence or that an ongoing online relationship is being severed. Screen addiction is clinically recognized and treatable.

Social
Withdrawal from Family and Long-Time Friends

A child pulling away from in-person relationships to spend more time online, or whose online friendships have become their primary social context, may be developing an unhealthy relationship with the internet or may have found an online community (not always benign) that meets needs their real-world relationships do not.

Safety
Receiving Gifts, Money, or Game Credits from Unknown Sources

Adult predators commonly use gift-giving as part of the grooming process: Amazon gift cards, Steam gift cards, Robux, PayPal transfers. If your child has received anything of value from an online contact that you did not authorize, treat this as a serious red flag and ask direct questions about who gave it to them.

Behavioral
Switching Apps or Closing Browser Abruptly When Asked

If your child cannot calmly show you what they were looking at when you ask, or produces an immediate excuse for why the screen was blank, that is information. Children with nothing to hide typically do not react defensively to a parent glancing at their screen.

Physical
Disturbed Sleep or Being Awake Late Using Devices

Social media is engineered to be used at night — notification cycles, live stories, and DM conversations all peak after 10 PM. A child who is chronically tired, irritable in the morning, or whose light you can see under the door at midnight is likely using a device that should be charged in a common area.

Developmental
Sexual Knowledge or Language Beyond Their Age

Children who are using language, referencing concepts, or demonstrating knowledge about sex that is beyond what would be expected for their age have likely been exposed to pornography or sexual content. This warrants a calm, direct conversation — not punishment — to understand what they have seen and help them process it.

Social
Secretive About Online Friends or Refusing to Describe Them

It is normal for children to have online gaming friends. It is not normal for them to refuse to describe who those friends are, become defensive or hostile when asked, or insist that a parent would "never understand." Adults who build relationships with children online typically encourage secrecy as a protective strategy.

Technical
Multiple Accounts or Unknown Apps on the Device

If you find apps on your child's device you did not approve, or if you discover secondary accounts on platforms you knew they used, do not immediately confiscate the device — instead ask curious questions to understand why they created them. Secondary accounts are often created to avoid detection of content that would violate household rules.

Emotional
Mood Closely Tied to Social Media Metrics

A child who checks their post's likes repeatedly, becomes visibly upset when a post receives little engagement, or whose emotional state tracks the performance of their social media content is experiencing the reward-feedback loop that social platforms are deliberately designed to create. This is a sign the relationship with the platform is becoming problematic.

Safety
Mentioning Meeting an Online Friend in Person

Online grooming typically progresses toward an in-person meeting. If your child mentions wanting to meet, or has made plans to meet, someone they know primarily from online — even if the contact appears to be a peer — this warrants immediate parental involvement. Predators often pose as age-matched peers for extended periods before revealing intent.

Mental Health
References to Self-Harm, Death, or "Not Being Here"

Online communities can normalize self-harm and suicidal ideation in vulnerable teenagers. If your child makes references to self-harm, suicide, or "the world being better without them" — even in what appears to be a casual or joking way — take it seriously. Contact a mental health professional. The Bark monitoring tool is specifically configured to detect this language in messages and alert parents.

Start Here

Your Ten-Step Action Checklist

Ranked by ease and impact. Start at the top and work down. Each step builds on the previous one.

Reference

Tool Comparison: Every Option at a Glance

Use this table to decide which tools to deploy first. "Away from Home" means the control still works on mobile data and other WiFi networks.

Tool Category Cost Covers All
Home Devices		 Works Away
from Home		 Monitors
Message Content		 Setup
Difficulty		 Best For
Firewalla
 Hardware firewall $109–329 one-time Yes No No Medium Whole-home visibility; consoles & smart TVs
OpenDNS FamilyShield
 DNS filter Free Yes No No Easy Instant adult content blocking, no account needed
CleanBrowsing Family
 DNS filter Free Yes No No Easy Drop-in adult & mixed-content blocker, router-only
NextDNS
 DNS filter + device VPN Free / ~$2/mo Yes Yes (with device profile) No Medium Most powerful free DNS; extends to mobile data via profile
/etc/hosts blocking
 OS-level DNS override Free No (per device) Yes No Medium Free offline fallback layer on managed computers
Apple Screen Time
 OS parental control Free No (iOS/macOS only) Yes No Easy App limits, content ratings, downtime on Apple devices
Google Family Link
 OS parental control Free No (Android only) Yes No Easy App approval, bedtime lock, location on Android
Net Nanny
 Parental control app ~$55/yr (5 devices) Partial Yes Page content Medium HTTPS inspection, category filtering, instant alerts
Circle Go
 Family VPN proxy $99 device + $9.99/mo Yes Yes No Medium Same home rules applied on mobile data via device profile
uBlock Origin
 Browser extension Free No (per browser) Yes No Easy Ad, tracker, and adult filter lists inside the browser
BlockSite
 Browser extension Free / paid tier No (per browser) Yes No Easy Scheduled browser blocking and per-site bans
Bark
 Social media monitor $14/mo (up to 5 kids) No Yes Yes Easy AI alerts for grooming, self-harm, bullying in messages
Qustodio
 Parental control + monitor $55–100/yr Partial Yes Yes Medium Combined filtering + social monitoring + location + Panic Button
Easy setup
Medium setup
Hardware
DNS / Network
OS controls
Parental apps
Browser extensions
Monitoring
Glossary

Glossary: Terms Parents Need to Know

Plain-language definitions for every technical term used in this guide and in conversations about child online safety.

Algorithm
Platform

A set of rules a platform uses to decide what content to show each user. Social media algorithms prioritize content that keeps users watching longest, not content that is healthiest. They learn from every tap, pause, and scroll your child makes, and they get increasingly good at surfacing content that provokes strong emotional reactions.

CNAME Record
Network

A DNS configuration entry that redirects one domain name to another. Used in this guide to redirect google.com to forcesafesearch.google.com so Google always returns SafeSearch results. Set in your router, Pi-hole, or NextDNS dashboard; takes effect for all devices on the network instantly.

CSAM
Safety

Child Sexual Abuse Material. Images or videos depicting the sexual abuse of minors. It is illegal to possess, distribute, or view in all jurisdictions. Its presence on major platforms like Instagram and Discord has been documented by researchers and is a primary reason why unmonitored platform access for children carries serious risk beyond "bad language."

DNS
Network

Domain Name System — the internet's phone book. When your child's device types "youtube.com," it asks a DNS server for the numerical IP address that corresponds to that name. DNS filtering works by answering those requests with "no address found" for blocked domains, so the connection never starts. Every internet connection begins with a DNS lookup.

DNS over HTTPS (DoH)
Network

An encrypted version of DNS that runs through port 443 (the same port as normal web traffic), making it invisible to most router-level filters. Firefox and Chrome support DoH built-in. A child can enable it in browser settings to bypass traditional DNS filtering. Counter with NextDNS's own DoH endpoint or by blocking DoH providers at the firewall.

Family Pairing
Platform

TikTok's built-in parental control system. Links a parent's TikTok account to a child's account by QR code scan. Gives the parent remote control over screen time limits, direct message settings, content restrictions, and search access from their own phone. Requires both parent and child to have TikTok accounts and for the child to accept the connection.

Filter List
Tool

A text file containing tens or hundreds of thousands of domain names or URL patterns that should be blocked. Used by DNS filters (NextDNS, Pi-hole) and browser extensions (uBlock Origin). Community-maintained lists like HaGeZi Multi-Pro and OISD are updated daily. A single filter list can block more domains than any parent could manually curate.

Finsta
Platform

A "fake Instagram" — a secondary Instagram account a teenager uses for content they do not want their primary followers (including parents) to see. Common among teens aged 13–17. The account is set to private with a small list of trusted friends. Bark detects secondary account activity on devices it monitors. Combine with App Store purchase approval to prevent new account creation going unnoticed.

Firewall
Network

A device or software that monitors and controls incoming and outgoing network traffic based on security rules. A hardware firewall like Firewalla sits physically between your modem and router and inspects every packet passing through. A software firewall (like Windows Defender Firewall) runs on a single device. Hardware firewalls cannot be bypassed by deleting an app.

Grooming
Safety

The process by which an adult builds trust and emotional intimacy with a child in order to facilitate sexual abuse, exploitation, or trafficking. It typically involves establishing a relationship, gradually introducing sexual topics, encouraging secrecy, and eventually moving toward in-person contact. Online grooming most commonly starts on gaming platforms, social media DMs, and Discord. Bark's AI is specifically trained to detect grooming language patterns in messages.

HTTPS
Network

HyperText Transfer Protocol Secure. The encrypted version of web browsing. The padlock icon in your browser means the connection is HTTPS. While HTTPS protects your data in transit (good), it also means basic network filters cannot read the content of web pages — only the domain name. This is why application-layer tools like Net Nanny (which install a local certificate to inspect HTTPS traffic) are more powerful than DNS-only filters.

IP Address
Network

The numerical address of a device or website on the internet (e.g., 104.18.22.68). DNS translates domain names into IP addresses. Blocking a domain name via DNS does not block access via its IP address directly. This is one way children bypass hosts-file blocking: they look up a site's IP and connect directly, skipping DNS entirely. Network-level firewall rules can block specific IP ranges to close this gap.

ISP
Network

Internet Service Provider — the company providing your home internet connection (Comcast, AT&T, Verizon, etc.). By default your router uses your ISP's DNS servers, which have no parental filtering. The first thing this guide recommends is replacing the ISP's default DNS with a filtering DNS like CleanBrowsing or NextDNS.

MAC Address
Device

A unique hardware identifier burned into every network card at manufacture (e.g., AA:BB:CC:DD:EE:FF). Routers use MAC addresses to identify and distinguish individual devices. Parental controls that restrict "Mia's iPhone" do so by tracking the MAC address of that device. Children can sometimes "spoof" (fake) a different MAC address in software to appear as an unrestricted device.

MDM Profile
Device

Mobile Device Management Profile. A configuration file installed on iOS or Android that gives a parent or organization control over device settings at the OS level. Used by Net Nanny, NextDNS, and Circle to push restrictions that cannot be deleted without a password. Apple Configurator 2 (free Mac app) allows parents to "supervise" an iPhone, making MDM profiles non-removable.

Port
Network

A numbered channel on a network connection used to direct traffic to specific services. Port 80 is standard web traffic; port 443 is HTTPS; port 1194 is OpenVPN; port 51820 is WireGuard. Firewalls can block specific ports — blocking port 1194 and 51820 prevents most VPN apps from connecting, which is one way to stop children from tunneling around network filters.

Restricted Mode
Platform

YouTube's content filter. When enabled, it hides videos that have been flagged by users, algorithms, or age-restricted by creators. It is not comprehensive — many inappropriate videos are never flagged — but it removes the most obvious explicit content. Locked at the DNS level using CNAME records (pointing youtube.com to restrict.youtube.com), it applies to every device on the network without needing to set it in each account.

Router
Network

The device that connects your home to the internet and distributes that connection to all your home devices via WiFi and ethernet. All internet traffic from every device in your home passes through the router, making it the most powerful single point for applying parental controls. Changing the DNS settings in your router applies content filtering to every device simultaneously.

SafeSearch
Platform

A filtering setting offered by Google, Bing, and DuckDuckGo that removes explicit sexual content from search results and Google Images. It is off by default on standard accounts. "Locking" SafeSearch (via the parent Google account or via DNS CNAME override) prevents the child from turning it off. It does not block all inappropriate content but eliminates the most obvious search-result pathways to adult material.

VPN
Network

Virtual Private Network. A technology that encrypts all internet traffic from a device and routes it through a server in a different location. Adults use VPNs for privacy and security. Children use consumer VPN apps (Windscribe, ProtonVPN, 1.1.1.1 WARP) specifically to bypass parental DNS filters and network controls. A family-managed VPN like NextDNS or Circle works differently: it routes traffic through a parent-controlled proxy, so the filtering happens at the VPN server rather than being bypassed by it.