Filtering and monitoring in schools: a DSL's guide

Filtering blocks harmful websites and content before a child sees them. Monitoring watches activity on school devices and networks and alerts you when something looks risky.

The two jobs are different. Filtering prevents, and monitoring reacts. The Department for Education (DfE) in England says no filter is 100% effective, so you need to know where yours falls short.

Keeping Children Safe in Education (KCSIE) 2026 is statutory in England only. Many international schools use it as a benchmark, and your accreditation body may ask for similar evidence. Read how it applies in KCSIE for international schools.

KCSIE 2026 says the designated safeguarding lead (DSL) takes lead responsibility for online safety, including understanding the filtering and monitoring systems in place. It also says this should be written into the DSL's job description. See the DSL role in international schools for more.

You do not run the filter yourself. The DfE standards share the work across several roles.

• Governors or proprietors hold overall responsibility and need assurance that the systems work.
• A senior leadership team (SLT) member and a governor are named as accountable.
• The senior leader buys the systems, records what is blocked and why, and reviews results.
• You check the reports, respond to concerns and tell governors whether the systems work.
• IT staff or your provider run the systems, supply reports and fix problems after checks.
• All staff know the rules and report problems.

An alert tells you to look. A search for a worrying term could be homework, a joke or a child in trouble. You need a calm, quick way to tell which.

A good alert shows who, which device, what time and which search term or page. The DfE standards ask for this detail, with weekly reports and immediate alerts for high-risk events as the minimum. If an outside company runs your IT, put both in the contract.

Use the same steps for every alert, so nothing depends on who is on duty.

• Read high-risk alerts at once and all others the same school day.
• Sort each one: child in danger, safeguarding concern, behaviour issue or false alarm.
• If a child may be in immediate danger, call local emergency services, then follow your child protection procedure.
• For a concern, speak to the child kindly and record what you saw and what they said.
• For a false alarm, note why and ask IT to tune the rule.
• Log every alert you act on in your safeguarding record.

Keep it light and open. You could say: "Something came up on the school system and I wanted to check you are okay. You are not in trouble."

Listen more than you talk, and do not promise to keep a secret. Follow your school's child protection procedure and record the conversation the same day.

If you find child sexual abuse material, do not open, copy, forward or screenshot it. Secure the device and tell your head of school. Ask local authorities or counsel which body to report to in your country.

Look for patterns over weeks. Three small alerts about one child can say more than one loud alert. Limit who can see reports, because they hold private information.

Over-blocking means the filter stops content that teachers and students need. KCSIE 2026 warns governors to be careful that over-blocking does not lead to unreasonable limits on what children can be taught about staying safe online.

Examples include a sexual health page blocked for a relationships lesson, a news site blocked for history, or a help page from a mental health charity.

Make it easy to ask for a change. Name who decides, set a reply time and keep a log of requests and decisions.

Here is a reply you can copy: "Thanks for flagging this. IT and I will check the site within two school days and tell you what we decide and why."

Use different settings for different ages and roles, as the DfE standards advise. A seven-year-old and a seventeen-year-old need different rules. A filter that is too tight also has a cost, because students may turn to phones or VPNs that you cannot see.

Rules differ by country. In some countries the state filters the internet or limits VPN use. Ask local counsel what you may block, allow or monitor before you change settings.

Monitoring records personal data about children and staff. Check your local data protection law, tell families and staff what you monitor, and limit who sees the reports.

A filter covers only the networks and devices it manages. Walk through each way a child can get online and ask whether it is covered. Phone rules and teaching fill the gap that filters leave, as in mobile phones and social media school rules.

• Phones on mobile data skip the school network.
• Personal devices on guest Wi-Fi may get a looser profile.
• Virtual private networks (VPNs) and proxies can hide traffic from the filter.
• School laptops used at home or on trips may leave the filter behind.
• Artificial intelligence (AI) chat and image tools create content on the spot, which a simple block list can miss.
• Boarding houses and after-school clubs may sit on a different network.
• Shared logins make it hard to know who did what.

Staff are your second layer. A teacher who glances at a screen may see something a report misses. KCSIE 2026 says induction training for all staff should cover filtering and monitoring roles.

Give staff a short list they can remember at induction and in every update.

• Tell the DSL the same day. Say what you saw, on which device and when.
• Do not search the device or question the child alone.
• If a child may be in immediate danger, call local emergency services.
• Report sites that are blocked for no good reason.
• Report harmful sites that are not blocked.

KCSIE 2026 says governing bodies should make sure the systems are reviewed at least once every academic year. The senior leader responsible should lead the review, with support from you and IT staff. It should include checks on all internet-connected devices in all relevant locations, and a record of those checks.

Review again when things change. The DfE standards list new AI tools, remote access, personal devices, major software updates and network changes as triggers. Do smaller checks more often too, for example each term.

Run the same checks every year so you can compare results.

• Confirm the named people are still right.
• Test filtering for each user group, site and device type, including guest and off-site devices.
• Use the South West Grid for Learning (SWGfL) Test Filtering tool to check that illegal and adult content is blocked.
• Check that no one has switched off or changed settings.
• Review last year's alerts and unblock requests: how many, how fast you replied and what changed.
• Log the date, who checked, what was tested and what was fixed.
• Tell governors what you tested, what failed, what is fixed and what is open, as in safeguarding reports to governors.

You do not need a new system to begin. Start with what you already have, and keep a record as you go.

• Write down who is accountable for filtering, monitoring and IT support.
• Ask your IT provider for last month's alert and block reports.
• Run the filtering test on one student device and one guest device.
• Set up a route for unblock requests, with a reply time.
• Book the annual review and add the date to the governors' calendar.