Search Engines & Platforms: the category you allow, then control
Blocking search breaks the internet for users. Leaving it unmanaged lets explicit images through. This page covers what the category contains and how filters enforce SafeSearch on top of it.
What the Search Engines & Platforms category includes
A site belongs here when its main job is to help users find content across many other sites. Shown below as a results page, because that is what these sites produce.
Full-web search engines
The large crawl-based engines and their country domains, plus their image, video and news search tabs on the same domain.
Private and independent engines
Engines that promise no tracking or run their own index, including smaller national and regional search engines.
Metasearch and aggregators
Sites that send one query to several engines and merge the results into a single list.
Web portals and start pages
Home pages that bundle a search box with news, weather, mail links and shortcuts, typical of browser start pages.
Image and reverse image search
Dedicated image search sites and reverse image lookup services, a priority for SafeSearch policy.
Web directories and link indexes
Curated directories that list sites by topic, a smaller but still active part of the category.
Search APIs and widgets
Domains that serve search boxes, suggestion endpoints and result pages embedded in other sites.
Exclusions and neighbouring categories
Many sites have a search box. That does not make them search engines. Vertical search for one topic usually takes the topic's category.
In Search Engines & Platforms
- General engines and their localized domains
- Metasearch that queries several engines
- Portals whose centre is a search box
- Image search across the whole web
- Directories covering many topics
Labelled elsewhere
- Job search engines: Job Search/Careers
- Flight and hotel search: Travel
- Product price comparison: Shopping
- Academic paper search: Education/Reference or Science
- Code search: Developer Tools / Code Hosting
- AI chat and answer tools: AI / LLM Tools
- Torrent search sites: File Sharing/P2P
Why the split matters: torrent and adult "search engines" use the word search but serve one risky content type. Labelling them by content means blocking them never touches general search.
Typical site types and their SafeSearch status
For filtering, the most useful fact about a search engine is whether its explicit results can be locked off from the network. Status below describes the general picture; check each provider's current documentation.
| Site type | Labels | Network-level SafeSearch | Usual school action |
|---|---|---|---|
| Major general engine | Search Engines & Platforms | Documented enforcement method | Allow with enforcement |
| Video platform search | Streaming Media | Restricted mode via DNS or policy | Allow with restricted mode |
| Privacy search engine | Search Engines & Platforms | Some offer a safe endpoint, some do not | Allow only if enforceable |
| Metasearch site | Search Engines & Platforms | Rarely enforceable | Block |
| Reverse image search | Search Engines & Platforms | Often not enforceable | Block for younger students |
| Kids' search engine | Search Engines & Platforms, Education/Reference | Filtered by design | Allow, often as default |
| Browser start page | Search Engines & Platforms, News/Media | Depends on the engine behind it | Review |
To check how a specific engine or portal is labelled, use the domain category lookup tool.
SafeSearch enforcement: the four layers
SafeSearch is a setting inside each search engine that hides explicit images and results. A user can turn it off, so networks enforce it from outside. Strong setups use more than one layer.
DNS redirection
The resolver answers search hostnames with the provider's enforced endpoint, so every device on the network gets filtered results.
Browser policy
Managed browsers force SafeSearch and restricted video modes through policy, which also works off the school or office network.
Proxy or gateway
A web gateway that inspects traffic can add enforcement parameters or headers that the provider supports.
Category control
The category database blocks engines that cannot be enforced, plus the proxies and encrypted DNS routes that would bypass layer 1.
The DNS endpoints providers document
These are the hostnames the main providers publish for network enforcement. Your resolver returns them, usually as a CNAME, for the matching search hostnames.
| Provider | Hostnames to redirect | Enforced endpoint | Notes |
|---|---|---|---|
| Google Search | www.google.com and country domains you allow | forcesafesearch.google.com | Country domains are many; cover every one you allow, or redirect them to one domain |
| Bing | www.bing.com | strict.bing.com | Also check search built into the operating system and office suites |
| YouTube | www.youtube.com, m.youtube.com and the API hostnames used by apps | restrict.youtube.com (strict) or restrictmoderate.youtube.com (moderate) | Apps call API hostnames; check the provider's current list |
| DuckDuckGo | duckduckgo.com and www.duckduckgo.com | safe.duckduckgo.com | Covers the main web interface |
Check the current guidance. Providers change hostnames and supported methods from time to time. Always confirm against each provider's own documentation before you deploy, and test from a client device afterwards.
Closing the bypass routes
DNS enforcement only works when devices use your resolver. Users who want unfiltered results look for a way around it. These are the usual gaps, and the category that closes each one.
Encrypted DNS
Browsers and apps can send DNS over HTTPS to a public resolver, skipping your redirects.
Block public DoH resolvers; disable it by browser policyProxies and VPNs
Web proxies and VPN apps tunnel traffic past every network control.
Block VPN / Proxy / AnonymizersUnenforceable engines
Smaller engines and metasearch sites may have no lockable safe mode.
Block Search Engines & Platforms domains you cannot enforceTranslation and cache views
Translation services and cached-page viewers can display blocked pages inside an allowed domain.
Review translator domains; restrict where neededShortened links
Short links hide where a result leads until the click.
Resolve before deciding; see URL ShortenersCountry domains
A user types a foreign country domain of the same engine that your redirect does not cover.
Redirect every allowed country domain, or block the restSafeSearch myths that cause gaps
Most failed SafeSearch rollouts are not technical failures. They come from assumptions that sound right but leave a door open.
Myth
- "We set SafeSearch in the browser once." A user setting can be switched off by the user.
- "DNS redirects cover everything." Only for devices that use your resolver.
- "One engine is enough." Students try every engine they know, then the ones they find.
- "Video sites are separate." Video search returns thumbnails, which are images too.
- "Apps follow the website rules." Apps often call API hostnames that a web-only rule misses.
What works instead
- Lock it from outside with DNS redirects and managed browser policy together.
- Close encrypted DNS and proxies so the redirect cannot be skipped.
- Block by category, so every engine you cannot enforce is caught, including new ones.
- Enforce restricted video mode alongside web search.
- Cover app hostnames from the provider's current documentation.
Reporting tip: blocked attempts to reach unenforceable engines are a useful early signal. A sudden rise usually means a new bypass site is being shared among users.
Policy table: schools, businesses, guest Wi-Fi, families
The category is allowed almost everywhere. The difference between environments is how hard SafeSearch is enforced and which engines are permitted.
| Environment | Category | SafeSearch | Other settings |
|---|---|---|---|
| Schools (CIPA) | Allow | Enforced at DNS and browser level; strict video mode for younger students | Block engines that cannot be enforced, encrypted DNS and VPN / Proxy / Anonymizers. CIPA does not name SafeSearch; schools use it as part of their protection measure |
| Businesses | Allow | Often enforced to reduce exposure to explicit images at work | Allow privacy engines if policy permits; log search domains for incident review |
| Guest Wi-Fi | Allow | Commonly enforced in family venues, cafes and public buildings | Combine with Adult blocking; keep the rule set simple for guests |
| Parental control | Allow | Enforced; often the first switch parents turn on | Kids' search engines as default for young profiles; block image search for the youngest |
| Libraries | Allow | Enforced on children's terminals; adult patrons' rules depend on local policy | Many libraries follow their own board policy in addition to CIPA |
For the school side in more depth, see our K-12 school web filtering guide and the overview of DNS filtering vs web filtering, which explains why many enforcement setups rely on DNS.
Rolling out enforced search on a network
A practical order of work for admins and for vendors building a SafeSearch feature into a DNS filter or firewall.
- 1
List the engines you will allow
Pull every domain labelled Search Engines & Platforms and decide which engines you can enforce. The rest go on a block rule.
- 2
Add the provider redirects
Configure the documented endpoints for each enforceable engine, covering the country domains and app hostnames you allow.
- 3
Lock the browser
On managed devices, force SafeSearch and restricted video through browser policy and disable built-in encrypted DNS where your resolver must be used.
- 4
Block the bypasses
Block VPN / Proxy / Anonymizers, public encrypted DNS resolvers and unenforceable search sites.
- 5
Test from a real device
Search for a term that triggers filtering and confirm the result page shows SafeSearch locked. Repeat on phones and in apps.
- 6
Keep the lists fresh
New search front ends and mirror sites appear constantly. Daily category deltas pick up new domains so the block rule keeps up.
Multi-category cases
Domains carry several categories, ranked by how much of the site each one describes. Search domains often share a hostname with other services, which is where ranking matters.
Portal with mail
A portal that hosts search, news and webmail on related domains.
Search Engines & Platforms + News/Media + Email and MessagingEngine with AI answers
A classic engine that adds generated answers above results.
Search Engines & Platforms first, AI / LLM Tools secondKids' search
A filtered engine built for children and classrooms.
Search Engines & Platforms + Education/ReferenceMaps and local search
Map services that search businesses and places.
Search Engines & Platforms + TravelShopping search
Product search across many stores.
Shopping first, Search Engines & Platforms secondSearch hijacker domains
Fake engines installed by unwanted browser extensions.
Malware / Phishing / Suspicious, not searchHow vendors use this category
For product teams, Search Engines & Platforms is less about blocking and more about building a SafeSearch feature customers trust.
| Product | What the category powers |
|---|---|
| DNS filtering service | A one-click "enforce SafeSearch" switch, plus an automatic block on engines that cannot be enforced |
| School web filter | Locked SafeSearch presets for each age group and reports of blocked search attempts |
| Firewall and SWG | Search category in policy, with enforcement and search term logging where the product supports it |
| Parental control app | Safe defaults on new child profiles and alerts when a child tries an unfiltered engine |
| Router and ISP family filter | Network-wide enforced search for every device in the home, with no software on the device |
All of this depends on a complete, current list of search domains. The web filtering database ships it with the other 58 categories, as files that run in your own systems, with exports such as DNS RPZ and hosts files for licensed customers.
Search engines and SafeSearch FAQ
Why not just block the Search Engines category?
Search is how people find everything else, including school and work resources. Organisations allow the category and control what search returns, mainly by enforcing SafeSearch and blocking engines that cannot be enforced.
How do you force SafeSearch on a network?
The common method is DNS: point Google, Bing, YouTube and DuckDuckGo hostnames to their enforced endpoints, such as forcesafesearch.google.com, strict.bing.com, restrict.youtube.com and safe.duckduckgo.com. Managed browsers can also enforce it through policy.
Does CIPA require SafeSearch?
CIPA requires a technology protection measure against obscene, child pornography and harmful-to-minors images on computers used by minors. It does not name SafeSearch, but many schools enforce it as part of that measure. Check the current guidance for your situation.
What about search engines that cannot enforce SafeSearch?
Schools usually block them. A label for every search engine domain lets a filter allow the enforceable engines and block the rest without building lists by hand.
Are AI answer engines in the Search Engines category?
AI chat and answer tools carry AI / LLM Tools. Classic engines that add AI answers keep Search Engines & Platforms as their first label.
Does SafeSearch catch everything?
No. It reduces explicit results a great deal, but it is one layer. Category blocking of Adult content and of bypass tools is still needed behind it.
Can SafeSearch be enforced on devices outside the network?
Yes, through managed browser policy or a device-level filter agent that applies the same redirects. DNS enforcement on the school or office network alone does not follow a laptop home.
How do new search front ends get labelled?
About 300,000 newly registered domains are categorized every day and checked again after a week and a month. New search mirrors and front ends arrive in the daily delta files, so a block on unenforceable engines keeps up.
Do search suggestion and autocomplete domains need attention?
They can show text suggestions that some policies want filtered. Most providers apply SafeSearch to suggestions when it is enforced, but test this on your own setup.
Is this category available on its own?
It is delivered as part of the full database. Starter database tiers start from $999; enterprise and OEM licences are quoted per deployment.
Build SafeSearch enforcement on complete category data
120 million categorized domains, about 300,000 new domains categorized every day, delivered as files for your own DNS filter, firewall or school product.
Talk to usLicense the databaseGoogle, YouTube and SafeSearch are trademarks of Google LLC; Bing of Microsoft Corporation; DuckDuckGo of Duck Duck Go, Inc.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.