School web filters

GoGuardian

Liminex, Inc., trading as both GoGuardian and Pear Deck Learning · majority owner Sumeru Equity Partners since May 2018 · goguardian.com

The market leader and the default answer for Chromebook districts — roughly 20 million students at 14,000+ institutions by the company's own count. Sold as three products sharing one extension pair: Admin does the filtering, Teacher gives individual teachers session-scoped overrides, Beacon scans browsing and mail for self-harm and violence indicators.

Architecturally it is the simplest thing on this page: two force-installed Chrome extensions pushed from Google Admin Console → Devices → Chrome → Apps & extensions, targeted at user organisational units rather than device ones. No proxy, no appliance, no certificate. Google's own Admin Console rules are evaluated before GoGuardian's, and it cannot filter Play Store apps. A separate agent covers Windows, Mac and iPad. The January 2024 "rebrand" was a product-line split — the curriculum tools became Pear Deck Learning while Admin, Teacher and Beacon kept the GoGuardian name.

Games: Games, with subcategories Online Games, Gaming Information and Educational Games. Adjacent categories are Entertainment and Time Wasting. A Block Uncategorized toggle catches domains the database has not seen.

Securly

Securly, Inc. · portfolio company of Golden Gate Capital since March 2021 · securly.com

The main structural alternative to GoGuardian, at 10 million-plus students across 3,000-plus districts. Four filtering modes, and the differences between them matter more than the marketing suggests: a Chrome/Edge extension built on Google's on-device filtering API, which does no interception and needs no certificate; SmartDNS, which uses DNS as a selective proxy and does decrypt, requiring the Securly certificate; SmartPAC, a PAC file, same certificate requirement; and GuestDNS, domain blocking with no user identity at all.

Only the extension follows a student off campus. The other three are keyed to the school network. Securly recommends districts self-host the extension because the Google- and Microsoft-hosted builds lag on updates. Securly Classroom is the former Dyknow, acquired 1 March 2022; Aware reaches past web traffic into Gmail, Drive, Outlook and Teams.

Games: Games, defined as single or multiplayer online game sites. Worth noting that coolmathgames.com is classified under Reasoning instead, which is a good illustration of how much the taxonomy, rather than the technology, decides what a student can reach. Securly categorises at URL level, not just domain level.

Lightspeed Systems

Lightspeed Systems, Inc., Austin, Texas · founded 1999 · privately held · lightspeedsystems.com

Technically the deepest of the Chromebook-era filters, because it moved decryption to the endpoint. SmartAgent performs full SSL decryption locally — the company's central claim is "no proxies, VPNs, PAC files, trust certificates, or hardware" — which removes both the bandwidth cost of a central proxy and the certificate-distribution problem, and lets a school laptop stay filtered at home with no tunnel back to campus. ChromeOS gets an extension through Google Admin; Windows and macOS get a system-level agent with tamper protection; iOS gets an MDM-pushed app. SmartShield is the DNS half, for BYOD, guest and IoT devices that cannot take an agent.

Self-reported footprint is 23 million students, 15 million devices and 31,000 schools — static across several years of press boilerplate, so treat it as marketing. Lightspeed also markets a "Live Intelligence" layer that identifies pages by what executes in the browser rather than by URL, specifically naming the Ruffle, Nebula and Interstellar loader libraries.

Games: yes, but the console label is unverified — the category database documentation sits behind a customer login.

Linewize / Classwize

Qoria Ltd — formerly Family Zone Cyber Safety, renamed May 2023 · acquired by Aura, completed 17 July 2026 · linewize.com

The North American face of the group that also owns Smoothwall, Cipafilter, NetRef and Qustodio, and the only vendor here still shipping a genuine inline appliance — though once the device clients are deployed the appliance "only makes decisions for unmanaged devices". The on-device clients see full path URLs rather than just DNS traffic, and the Chromebook App Filter works at OS level both on and off the network.

Whether a root certificate is required is genuinely unclear: one Linewize page advertises "SSL inspection and decryption" with deep packet inspection on Windows, Mac and iOS, and another promises "no more certificates and proxies". The vendor does not reconcile the two. Classwize — still the name most teachers use, though it is now officially Classroom Manager — is the teacher-facing console.

Games: a category near-certainly exists, but Linewize publishes no filtering taxonomy at all. Its public pages expose only alert and report classifications, not blockable categories.

Blocksi

Blocksi · blocksi.net

Smaller than the top three but with unusually broad platform coverage — its MDM deployment guides cover more configurations than several larger competitors, Android included. It is the only product here offering three enforcement paths at once: a force-installed extension, an OS-level agent, and a DNS proxy, with an optional on-premises appliance for IoT and BYOD. Claims 500-plus districts and 3 million users, with Los Angeles USD, San Diego USD and Irvine USD named among them.

Its taxonomy runs to 85-plus categories and appears to be derived from FortiGuard's rather than built in-house, which explains labels that read oddly for a school product.

Games: category filtering is present across 85+ categories, but the literal label is unverified.

Deledao

Deledao · deledao.com

Sells on real-time analysis rather than list lookup: InstantAI judges a page as it loads instead of consulting a pre-built category database, which is the same architectural argument Smoothwall makes. Its distinctive feature is GameChanger, which infers that a student is playing a game from keyboard and mouse activity patterns rather than from the URL — and does so, the vendor says, without logging keystrokes. Its reseller relationship with Hāpara ended on 1 September 2025.

Games: no published category name. GameChanger is a behavioural detector rather than a taxonomy entry, so there may not be a conventional category at all.

Dyknow

Acquired by Securly on 1 March 2022 · dyknow.com routes into Securly's classroom pages

A classroom monitoring tool rather than a filter — it showed teachers student screens and let them close tabs, but it never did category-based content filtering. Listed here because it is still named in district documentation and in old procurement records. Its knowledge base now lives at support.securly.com and the product is sold as Securly Classroom.

Games: not applicable. Dyknow blocked by application and tab, never by content category.

Hāpara

Business unit of Cordance Operations LLC · hapara.com

Best known for Highlights, the teacher view of what a class has open, and Workspace, its assignment tool. The part people misattribute is the filtering: Hāpara does not build a web filter. It resells one — previously Deledao's, currently Gaggle's. A district buying "Hāpara Filter" is buying another vendor's engine behind a Hāpara console, which matters when comparing category behaviour.

Games: depends on the underlying engine, and neither Hāpara nor Gaggle publishes a taxonomy.

Bark for Schools

Bark Technologies · free tier for schools · bark.us

Around 3,700 districts, largely because the school tier costs nothing. The important detail is in Bark's own documentation: the monitoring extension "does not block any sites" — it scans content for signs of self-harm, bullying, violence and predation and alerts the district. Blocking is a separate product, either a DNS filter or a distinct filtering extension. Districts that believe Bark is their CIPA filter usually have the monitoring half only.

Games: not applicable to the monitoring extension. The separate filter product publishes no taxonomy.

Gaggle

Gaggle.Net, Inc. · gaggle.net

Scans the district's Google Workspace or Microsoft 365 tenant through the provider's API rather than intercepting traffic. The asymmetry is worth knowing: email is blocked in real time, documents are moderated after the fact — a flagged Doc has already been written and possibly shared before a human reviewer sees it. A BuzzFeed News investigation found roughly 80% of flags were profanity. Gaggle also sells a separate Web Filter, now the engine behind Hāpara's, whose architecture it does not publish.

Games: no published taxonomy for the Web Filter.

Impero → Ativion StudentKeeper

Impero Solutions Ltd, trading as Ativion since 2024 · Investcorp-backed · ativion.com

The acquisition engine of this market. Impero bought Netop in January 2021 and ContentKeeper in January 2022, then rebranded the whole group to Ativion in 2024. StudentKeeper, launched 15 January 2025, is the current classroom-management product; ContentKeeper remains the filtering engine and is profiled separately below. Claims 700-plus US districts.

Games: see ContentKeeper — Game Sites.

NetSupport

NetSupport Ltd, UK · netsupportsoftware.com

NetSupport School, NetSupport DNA and classroom.cloud are classroom and asset-management tools. The architectural fact that distinguishes them from everything else here: no category filtering at all. Restriction is done with approved and restricted URL lists a school types in itself, plus application blocking matched on window title. That is a deliberate design, not a gap — it is a teacher tool, not a CIPA filter.

Games: no category exists. A school blocks named URLs and named application windows.

Senso.cloud

Renato Software Ltd, UK · senso.cloud

UK-centric, and unusual in deriving two products from one input stream: the same captured activity feeds both a category-based filter and a keyword alerting system, so a district gets safeguarding alerts and content blocking from a single agent. Its market is British schools and multi-academy trusts, where KCSIE duties drive the keyword half.

Games: a category filter exists; the literal label is unverified.

Qustodio

Qustodio Technologies S.L., Barcelona → Family Zone, completed 1 August 2022 for US$52M → Qoria → Aura · qustodio.com

A consumer parental-control app, not a district filter, and there is no standalone Qustodio district console. Districts running Linewize can hand it to parents as an after-hours companion on school-issued devices, marketed as Qustodio Connect. Linewize policy wins during school hours; Qustodio's parent-set rules apply outside them.

Per-device agent rather than a network appliance. On iOS it runs an on-device VPN; on Windows, Mac, Android and ChromeOS it hooks the supported browsers specifically and blocks unsupported browsers by default. Every rule offers Block, Alert me, or Ignore, so much of the product is monitoring rather than filtering.

Games: the web-filter label is not published. The one gaming label Qustodio does publish is on the app side — a Gaming apps category under Rules → Games & Apps.

Mobile Guardian

Mobile Guardian Limited, Reigate, Surrey, UK · founded 2011 · independent · mobileguardian.com

Cross-platform MDM, filtering and classroom management from one console, at roughly 2,500 schools across 50-plus countries. ChromeOS filtering deploys as a Chrome extension alongside existing Google Workspace policy; the iOS mechanism is not publicly documented beyond the claim that filtering "is not enforced at the network level" and needs no hardware, certificates or network dependency.

It is best known outside the UK for a breach. On 4 August 2024 an attacker reached the platform, unenrolled managed devices and triggered remote wipes; Singapore's Ministry of Education reported about 13,000 student iPads and Chromebooks wiped across 26 secondary schools. MOE ordered the app removed the next day, terminated the contract, and by January 2025 had replaced it with Jamf on iPads and Lightspeed on Chromebooks. The company itself did not wind down — Companies House shows it active with filings continuing through December 2025.

Games: Games. Mobile Guardian's own documentation uses it as the worked example, and it is separately selectable inside the YouTube filter.

Jamf Safe Internet

Jamf Holding Corp. (NASDAQ: JAMF), Minneapolis · built on Wandera, acquired 1 July 2021 for $400M · jamf.com

The clearest documentation of any product on this page, and the only vendor publishing its full taxonomy. Two layered mechanisms, neither of which is a cloud proxy. The default is Secure DNS: the activation profile installs Apple's DNSSettings payload pointing at Jamf's DNS-over-HTTPS gateway, and because an MDM-supplied DNS setting overrides DHCP's, the device uses it on any network. On ChromeOS the same thing is done natively by setting Chrome's DNS-over-HTTPS policy for the organisational unit.

The second layer is an On-Device Content Filter built on Apple's NEFilterProvider network-extension framework, analysing traffic at socket level on supervised iOS 16+ devices with the Jamf Trust app installed. It adds app blocking, full-URL filtering and post-TLS inspection without a man-in-the-middle certificate. Distinct from Apple's own Web Content Filter payload, which these consoles also expose and which has no category taxonomy at all — only automatic adult filtering, a denied-URL list, or a strict allowlist.

Games: Games — "online gaming sites and gaming apps" — with subcategories Video Games, Mobile Games, Other Games and Pokemon Go. Gambling is separate. One of 33 published top-level categories.

Mosyle

Mosyle Corporation · Apple-only · mosyle.com

An Apple-only MDM whose filtering rides an encrypted DNS profile pushed by MDM. Two details districts get wrong: web filtering is only in the paid OneK12 tier at $9/device/year, not the free MDM, and the category list — 100-plus categories — is not published anywhere. It does offer two filters almost nobody else has: by domain age and by hosting country, which catch newly registered sites the category database has never seen.

Games: a category exists among the 100-plus; the label is unverified.

LanSchool

Lenovo, via its Stoneware acquisition · lanschool.com

Screen monitoring and teacher-directed session blocking, and like NetSupport it has no category filtering. A teacher can freeze a screen or restrict a class to named sites for a lesson; there is no blockable category taxonomy. Lenovo's category filter is a separate product, Lenovo NetFilter, which is Netsweeper's engine under a Lenovo badge.

Games: not applicable. Category blocking requires the separate NetFilter product.

ManagedMethods

ManagedMethods, Boulder, Colorado · managedmethods.com

Cloud Monitor is explicitly "no proxy, no agent, no extension" — it connects to Google Workspace and Microsoft 365 through their APIs and inspects what is already stored there, which means it sees Drive and mail but never live browsing. Content Filter is the separate product that does the browsing half, applying in Chrome and Edge, with 30-plus categories.

Games: among the 30-plus Content Filter categories; the names are unverified.

Faronics Insight

Faronics Corporation · faronics.com

A classroom management tool in the same family as LanSchool and NetSupport: screen viewing, remote control, and explicit website and application allow and block lists a teacher maintains by hand. No categories, no content classification, no off-campus story. Faronics is better known in schools for Deep Freeze, which is unrelated to filtering.

Games: no category exists — named sites and named applications only.

ContentKeeper

ContentKeeper Technologies, Canberra, Australia · acquired by Impero January 2022, now trading as Ativion · ativion.com

The Australian-built appliance that quietly became a major American district platform: more than 40 of the 200 largest US school districts run it. Architecturally it is the traditional model done thoroughly — a hardware or virtual gateway doing TLS decryption inline, paired with clients for Windows, macOS, iOS and ChromeOS that identify the signed-in student without a login prompt and carry policy to take-home devices. An "App Defender" module handles non-browser app traffic and dynamic safelisting covers YouTube and Vimeo. Two ownership changes in three years have thinned its public documentation considerably.

Games: Game Sites, verified from a district-published export of the full 133-category taxonomy. EducationalGames, Entertainment, ChildEntertainment and Gambling are all separate entries.

Barracuda Web Security Gateway

Barracuda Networks, owned by KKR · barracuda.com

The classic CIPA appliance, in models 210 through 610 and up, with four deployment modes — inline transparent, forward proxy, WCCP redirection and PAC file. Its tiering is unusually consequential for schools: SSL inspection requires model 410 or higher, and SafeSearch enforcement in turn requires SSL inspection, so a district on a 210 cannot force SafeSearch at all. Cyberbullying keyword alerting needs a 610. Off-network coverage comes from the Web Security Agent for Windows and macOS and a Chromebook extension. Not formally end-of-life — existing subscriptions can be extended indefinitely — but removed from the current product navigation.

Games: two entries, Games and Online games, both under the Entertainment supercategory. 95 categories in total.

Barracuda Content Shield

Barracuda Networks · barracuda.com

Barracuda's answer to Cisco Umbrella rather than a school product — MSP and SMB channel, niche in K-12. Two layers: agentless DNS filtering keyed to the registered egress IP, and an agent whose Web Filtering Component is explicitly proxy-free, identifying the logged-in user and checking policy against the cloud service. Where both apply, the agent policy wins. The malware component was discontinued on 21 December 2021, leaving web filtering as the substantive capability.

Games: category filtering exists, but Barracuda publishes its taxonomy for the Web Security Gateway rather than separately for Content Shield, so the label here is unverified.

Sophos

Sophos Ltd, owned by Thoma Bravo · sophos.com

A security vendor that happens to do school filtering, and the split shows. Sophos Firewall does the heavy work — 91 URL categories, Xstream TLS inspection covering TLS 1.3 and explicitly not limited to browser traffic, built-in CIPA policy templates and forced SafeSearch. The endpoint client that follows a laptop home, Intercept X, drops to roughly 48 categories. Chromebooks are covered through Sophos Mobile rather than the firewall. Its strongest schools presence is British: it self-certifies with the UK Safer Internet Centre and ingests the IWF and CTIRU blocklists, obligations with no direct US equivalent. The dedicated Web Appliance was retired in 2023, so any district document naming it is stale.

Games: Games — "sites for game playing or downloading, game hosting or contest hosting, tips and advice on games". Distinct from Gambling, Entertainment, Sports, Hobbies and Video hosting.

Smoothwall

Smoothwall Limited → Family Zone, August 2021, £75.5m → Qoria, 2023 → Aura, 17 July 2026 · smoothwall.com

Three corporate names in five years, and a product that is not sold in the United States — the same parent deliberately sells Linewize into North America instead, so a US district encounters the sibling brand. In the UK it claims one school in three and holds UK Safer Internet Centre accreditation.

Its technical argument is that a list-based filter is always behind the web, so it classifies the page in front of it at request time — judging "content, context and construction at the point of request" — which lets it block a single URL on an otherwise permitted domain. That is also why full HTTPS visibility requires pushing its root certificate to every device; SNI alone gives it only the hostname. Client software is named Cloud Filter Extension (Windows, ChromeOS, macOS), Smoothwall Browser (iPadOS), Qoria Filter (Android) and Filter Backstop (Windows).

Games: Online games, and it is blocked by default — the only product here where that is documented. Smoothwall warns the category is domain-scoped and recommends pairing it with content modification, noting that blocking video games "won't prevent users from accessing Google Doodle games".

Netsweeper

Netsweeper Inc., Waterloo, Ontario · founded 1999 · independent, no acquisition · netsweeper.com

An outlier because K-12 is not its centre of gravity. The same nFilter engine sells to telecom carriers, national regulators and ISPs, which is why the deployment list is far broader than a school-only vendor needs — the vendor's own wording is "in-line appliance, cloud agents, hybrid cloud, Layer 7, VM infrastructure, DNS, GRE tunneling, and IPSec", plus out-of-band monitoring and BGP redirection at carrier scale. nClient is the endpoint agent, and it filters locally rather than backhauling: "all filtering occurs on the device, so no VPN is required". Classification runs against a proprietary Category Name Service database of 25 billion-plus URLs across "90+ categories". In North America its school business is concentrated in Canada.

Games: unverified. Netsweeper publishes only a dozen category names publicly and keeps the full taxonomy behind a gated partner portal. A games category almost certainly exists among the 90-plus; its literal name could not be confirmed.

Cipafilter

DerbyTech, Inc., East Moline, Illinois · launched 1999 · acquired by Family Zone March 2022 for $4.5M in shares plus ~$3.0M cash

A historical entry, included because it is still cited in district procurement records and old E-rate filings. A family-owned Illinois firm built it in 1999, named it directly for the statute, claimed the industry's first contextual filter and grew to roughly 400,000 students before the sale. It has since been absorbed completely: the domain 301-redirects wholesale, including every sub-path, no Cipafilter documentation survives on the successor's support site, and Qoria's own corporate timeline names it only as an acquisition. Districts that bought Cipafilter now run Linewize Filter.

Games: unverified and unverifiable — the taxonomy went with the domain.

Check Point

Check Point Software Technologies Ltd · checkpoint.com

Worth including for one architectural reason rather than for market share. The URL Filtering Software Blade is conventional: inline on a Quantum gateway, cloud category lookup, and HTTPS inspection that terminates and re-originates TLS, so a Check Point root certificate must be on every client — without it the gateway sees only domain names and certificate metadata.

Check Point Browser Security, renamed from Harmony Browse, is the interesting one: a browser extension providing "the industry's first in-browser protection to inspect 100% of SSL traffic", explicitly requiring no root CA and no MITM proxy, because it inspects after the browser has already terminated TLS. It is force-installed from the Google Admin console and marketed at K-12 Chromebooks on and off campus. Check Point SASE, the former Perimeter 81 acquired in 2023, is essentially absent from K-12.

Games: Games, listed separately from Gambling and Entertainment in Check Point's education solution brief.

Trend Micro

Trend Micro Inc. · trendmicro.com now redirects to trendaisecurity.com

Here to answer the question plainly: Trend Micro has no K-12 filtering offering, and at present no web content filtering product at all. The InterScan secure web gateway line, both appliance and SaaS, has been walked through staggered end-of-sale and end-of-life dates spanning 2022 to 2028. The successor platform, Vision One, includes no web filtering component. What remains is URL reputation blocking inside Apex One, which is antivirus behaviour rather than student filtering — no user identity, no age-banded policy, no Chromebook support, and nothing that would satisfy a CIPA audit.

Games: not applicable.

WebTitan

TitanHQ, a trading name of Copperfasten Technologies, Galway, Ireland · titanhq.com

An MSP-channel DNS filter that entered US K-12 chasing Cisco Umbrella and OpenDNS migrations rather than displacing the education specialists. Architecturally thin on purpose: point the router's DNS at TitanHQ's resolvers, key the tenant to the public egress IP, and a category policy covers the whole site with no appliance, no proxy and no backhaul. The OTG agent extends that to take-home devices by claiming the loopback resolver at 127.0.0.3 and capturing OS-level DNS queries; OTG 2 identifies user and device with an EDNS tag instead. The certificate it ships is for rendering block pages, not inspecting traffic — a distinction several competitors blur.

Games: Games, category #17 of 53 — "web pages consisting of computer games, game producers, and online gaming". The consequential detail: it is not blocked by any of the three preset levels. Essential, Enhanced and Optimum all omit it, so a district on a default WebTitan policy is not blocking game sites at all.

Arista NG Firewall

Formerly Untangle NG Firewall · acquired by Arista Networks in 2022 · sold under Arista Edge Threat Management · edge.arista.com

The cheap modular Linux UTM that let a one-person district IT shop buy CIPA compliance for a few hundred dollars, which is why it appears in small-school infrastructure at all. It operates as a gateway or transparent bridge — not an explicit proxy — and without decryption it falls back to SNI, then the server certificate hostname, then the server IP, treating the URI as /. TLS decryption is a separate app, SSL Inspector, and it is a prerequisite for search-term filtering, forced SafeSearch and YouTube restricted mode. Categorisation is licensed from Webroot BrightCloud. Arista has pruned the low end methodically: the Home tier died in April 2024 and the Q Series stops shipping in June 2026, though the software and virtual editions are still actively sold.

Games: Games, BrightCloud category ID 34 — "game playing or downloading, video games, computer games, electronic games, tips, and advice on games". Gambling is ID 27. Each category can be set to Block or to Flag, which allows the request but logs it as a violation.

Zorus Archon

Zorus, Inc., Tampa, Florida · founded 2017 by former Datto executives · zorustech.com

Included mainly to correct a persistent misattribution: Zorus was acquired by DNSFilter, not Kaseya. The confusion is understandable — the founders came out of Datto, which Kaseya did buy, and Zorus publishes a Kaseya VSA deployment guide — but that is an RMM integration, not ownership.

Architecturally it is the inverse of WebTitan: a Windows endpoint agent running a local proxy, which buys URL-path precision that DNS filtering cannot reach, at the cost of running only where the agent runs. It is a channel-only MSP product with a 100-seat minimum and no CIPA or E-rate positioning at all, which is close to disqualifying for federally funded K-12 procurement. The brand is dissolving: the support site redirects to DNSFilter's, the main domain's certificate fails validation, and neither "Zorus" nor "Archon" appears on the acquirer's product page.

Games: category filtering is a listed capability, but Zorus never published a taxonomy and the documentation has moved behind DNSFilter's help centre, so the label is unverified.

Palo Alto Networks

Palo Alto Networks, Inc. · Advanced URL Filtering / PAN-DB · paloaltonetworks.com

Designed around decryption, with a real K-12 practice behind it — a dedicated E-rate page, a published deployment automation repo that loads "a K-12 solution and an eSports solution", and a statewide managed service in North Carolina built on its technology. Off-campus coverage requires Prisma Access with GlobalProtect, which does support ChromeOS. Site Access actions are exactly allow, alert, block, continue and override; a single URL can carry up to four categories and the strictest action wins.

Games: Games in the console, lowercase games in logs and CLI. The recommended action is Alert, not Block, so on a default profile the traffic is logged and allowed. Game sites frequently also match streaming-media or content-delivery-networks, so the games category alone is not exhaustive.

Cisco Meraki

Cisco Systems · Meraki MX with Talos categories · meraki.cisco.com

Read Meraki as a network-edge filter, full stop. The MX does no TLS decryption for content filtering: it inspects either the URL in an HTTP payload or the Server Name Indication field of outbound TLS, so over HTTPS it is domain-granular only, and QUIC cannot be filtered at all — Meraki's own guidance is to block UDP 80 and 443 to force TCP. It needs an Advanced Security or Secure SD-WAN Plus licence and firmware MX17+; the legacy BrightCloud classifier stopped working on 1 January 2025.

The correction worth making loudly: Systems Manager provides no Chromebook content filtering. Its Chrome payload set is exactly six items — Enrollment, Sign-in, Device updates, Kiosk mode, Reporting and Miscellaneous Settings — with no URL blocklist payload at all. ChromeOS management runs through Google's MDM API, so URL policy lives in the Google Admin console. On Apple devices SM can push the OS-native Web Content Filter payload, which Meraki itself describes as "a basic, device-level filter". In FY2018 E-rate terms, MX Advanced Security licences were 50% eligible and Systems Manager licences not eligible at all.

Games: Games, from the Talos taxonomy. The MX caches Talos results up to 100,000 records for up to 20 minutes.

SonicWall

SonicWall Inc. · Content Filtering Service and Content Filtering Client · sonicwall.com

93 categories in CFS 5.0, with the default behaviour stated plainly by the vendor: "the operation for categories 1 through 12 is blocked, and the operation for other categories is allowed". The endpoint half, CFC, is effectively legacy — SonicWall has moved endpoint filtering into Capture Client, where Policies → Web Content Filtering offers allowed and forbidden domain lists, forbidden URL keywords and forced SafeSearch behind an Advanced licence. Cloud Secure Edge is its current Chromebook answer. A note that cuts against the usual funding story: SonicWall's own E-rate page says wireless products are fully eligible, firewalls partially, and content filtering services not eligible.

Games: Games, category 22 — which sits outside the 1–12 band blocked by default, so a district must add it deliberately. Gambling, at 11, falls inside the default-blocked range.

DNSFilter

DNSFilter, Inc. · acquired Zorus April 2025 · dnsfilter.com

A DNS-layer security company that reached K-12 sideways, through MSPs and through CIPA, which it markets as "one click CIPA compliance". It never proxies, never decrypts, and resolves or refuses at the domain level — fast and trivially deployable across mixed fleets including guest and IoT devices, but blind to URL paths. Its Chromebook story is real: a Manifest V3 Chrome Extension Roaming Client force-installed from the Google Admin console, validating DNS-over-HTTPS on managed devices, with traffic attributed to the logged-in user so shared-cart reporting stays per-student. The root certificate it ships is, again, for block-page presentation rather than inspection. Largest public US district reference is Fresno Unified.

Games: Games, a standalone top-level category distinct from Entertainment and Streaming Media. DNSFilter's own CIPA guidance treats Gambling as mandated and Games as not, so blocking games is a district policy choice.

Cloudflare Gateway

Cloudflare, Inc. · within Cloudflare One / Zero Trust · free K-12 tier: Project Cybersafe Schools · cloudflare.com

Entered K-12 as a security vendor rather than a filtering vendor, and it still shows. Project Cybersafe Schools gives any US public district under 2,500 students free Email Security and Gateway indefinitely — an addressable pool of roughly 9,800 of the ~14,000 US districts — with about 120 districts enrolled at the one-year mark in August 2024.

The layer split matters. DNS filtering needs no software: a district creates a DNS location and gets a unique DoH hostname to point at. But HTTP policies — the ones that can see URLs, headers and uploads — require the WARP client, a PAC file or a network tunnel, plus mandatory TLS decryption with Cloudflare's root certificate on every device. And there is no native ChromeOS client and no force-installable Chrome extension, so Chromebook districts are largely confined to resolver-level DNS filtering per network location, with no user identity attached.

Games: the string is Gaming, not "Games" — subcategory ID 100, nested under the top-level Entertainment category, ID 7. There is no category named "Games" anywhere in the list. Gaming is absent from Cloudflare's one-click recommended CIPA rule, which blocks 27 subcategories including Gambling.