Coworking space web filtering
A coworking space sells internet to businesses. Members are paying customers, not employees, so the filter cannot behave like a corporate one. The operator still owns the line, the public IP address and the reputation.
This guide shows coworking operators, flexible office providers and their IT partners how to build a security-first filter that protects everyone without policing members' work.
The coworking filtering dilemma
Two reasonable positions pull in opposite directions. A good policy sits between them and is written into the membership terms.
What members expect
- Internet as open as their own office
- VPNs, remote access and developer tools that just work
- No one reading their browsing history
- Freedom to set their own rules for their own staff
- Fast fixes when something legitimate is blocked
What the operator needs
- No malware spreading across shared floors
- No explicit content on screens in open areas
- No copyright complaints tied to its IP address
- Fair bandwidth during peak hours
- A defensible position if the network is misused
Risks a coworking operator actually faces
Coworking networks combine many small companies, freelancers and visitors on one connection. That mix creates a specific set of risks.
Lateral malware
One infected laptop on a flat network can scan and attack every other member device. Filtering helps, but client isolation and segmentation matter more.
Phishing against members
Small firms rarely have their own security tools. A shared DNS filter that blocks phishing domains protects members who have nothing else.
Copyright notices
Torrent traffic from a hot desk lands as a complaint on the operator's account, with no easy way to tell which member caused it.
Open-plan screens
Explicit content on a monitor in a shared space is a complaint and a potential harassment issue for everyone nearby.
Bandwidth crunch
Large uploads, game downloads and P2P clients slow video calls for everyone at the busiest time of day.
IP reputation
A compromised device sending spam or joining a botnet can get the shared public IP blocklisted, breaking email and logins for all members.
Network tiers and how strict each one should be
Coworking spaces work best with several networks. Each network gets its own filtering profile, sized to who uses it and who can see the screens.
| Network | Who uses it | Suggested filtering | Notes |
|---|---|---|---|
| Open floor | Hot desk and flex members | Security categories, Adult, File Sharing/P2P | The shared baseline. Client isolation on. |
| Private office | One member company | Security categories, plus whatever the member asks for | Own VLAN or private Wi-Fi key per member. |
| Enterprise suite | Larger tenants | Often none from the operator; tenant runs its own | Tenant may bring its own firewall and filter. |
| Meeting rooms | Members and their visitors | Same as open floor | Screens and projectors make content visible to groups. |
| Events | Public attendees | Guest profile: add Gambling, Illegal Drugs, Hate/Discrimination | Time-limited network per event. |
| Café and lounge | Visitors and day passes | Guest profile | Unknown users, so stricter. |
| Operator back office | Community and finance staff | Staff policy with newly registered domains blocked | Holds member contracts and payment data. |
| Building systems | Door access, printers, cameras | Allow list only | Never on the same network as members. |
Which categories matter in a coworking space
Think in three buckets. The first is on everywhere, the second never gets blocked by the operator, and the third belongs to each member.
Always block
Every network the operator runs- Malware / Phishing / Suspicious
- Newly registered domains (first days)
- Parked / For-Sale Domains
- Adult on shared floors and meeting rooms
- File Sharing/P2P on shared floors
Never block by default
Members need these to work- VPN / Proxy / Anonymizers
- Remote Access Tools
- Developer Tools / Code Hosting
- Cloud Storage / File Hosting
- Webinars/E-learning, Email and Messaging
Member's choice
Private offices only- Social Networking and Streaming Media
- Gaming and Gambling
- AI / LLM Tools
- Shopping and Job Search/Careers
- Any category in the full list of 59
Why keep VPNs open? Many members must use a corporate VPN for compliance. Blocking it pushes them to tethering, and you lose the security benefit on their device too.
Acceptable use policy: clauses that support the filter
A filter without a written policy feels arbitrary to members. These clauses, adapted with your lawyer, make the rules clear and explainable.
The network is provided for business use, and the operator applies security filtering to protect all members.
No illegal content, no copyright infringement, no attacks on other networks, no explicit content in shared areas.
Stricter rules apply on open floors, meeting rooms and event networks, because screens are visible to others.
Members with a private office may request their own filtering policy, applied only to their network.
What is logged, why, how long it is kept and who can see it. Keep this short and specific.
How the operator handles copyright and abuse notices, including when a member will be contacted.
How a member asks for a blocked site to be reviewed, and the contact for it.
How members are told about changes to the network policy before they take effect.
Handling an abuse or copyright complaint
Complaints usually arrive from the internet provider with a timestamp and the shared public IP. Without segmentation, you cannot tell which member caused it.
Receive and record
Log the notice, the time and the public IP. Do not forward member data to third parties without legal advice.
Find the segment
Use firewall and DNS logs to see which network or VLAN made the matching connections at that time.
Contact the member
If it maps to a private office, tell that member under your AUP. If it maps to the open floor, tighten the shared profile.
Fix the cause
Block or limit File Sharing/P2P on that segment, and check whether a device is compromised.
Review the policy
If complaints repeat, look at whether the shared baseline needs one more category.
How to deploy filtering in a coworking space
The goal is one baseline that covers every network plus per-member flexibility. Four approaches cover almost every space. New to the term? Start with DNS filtering vs web filtering.
Hosted DNS filter per network
Map each VLAN to its own profile in our managed DNS filter. The open floor gets the shared baseline; each private office gets its own rules, schedules and reports.
No software on members' devices.
Private Wi-Fi keys per member
Many enterprise Wi-Fi systems can give each member a personal key that places them on their own VLAN. Combined with per-VLAN DNS profiles, every member gets a private network on shared access points.
Firewall category filtering
A firewall with category filtering can enforce DNS, block known bad destinations at IP level and shape bandwidth. Avoid HTTPS inspection on member traffic: it needs certificates on their devices and raises trust issues.
Bring your own filter
Enterprise tenants often run their own firewall and filter. Give them a clean uplink, keep the operator's security baseline at the edge, and document who is responsible for what.
Policy suggestions by type of space
The same tiers apply everywhere, but the defaults move with the members you attract and the image you want to project.
Tech and startup hubs
Developers need package registries, code hosting, test environments and new domains that a strict filter might flag. Keep the shared baseline to security categories and Adult, and give teams a quick review path.
Serviced and corporate flex offices
Tenants often expect corporate-grade security. Add newly registered domain blocking and Parked / For-Sale Domains on every network, and offer per-tenant policies as a paid option.
Creative and media spaces
Photographers, designers and video teams move large files and visit image-heavy sites. Limit P2P, but keep Cloud Storage / File Hosting and Streaming Media fully open.
Community and family-friendly spaces
Spaces with a creche, student members or public events should treat shared floors more like guest Wi-Fi. Add Gambling, Dating and Violence to the shared baseline.
Lab and maker spaces
Shared equipment, connected tools and visitors in workshops call for a tight allow list on machine networks and a guest profile for visitors.
Multi-country operators
One policy model with local variations per country. Data protection, logging and complaint handling differ, so keep a short local annex per market.
Member onboarding and offboarding
Most filtering problems in coworking spaces start when a member joins or leaves. Build the network steps into the community team's checklist.
Explain the shared policy in one paragraph, show the review contact and ask private office members whether they want their own policy.
Create the member's VLAN or Wi-Fi key and attach the chosen DNS profile before move-in day.
Check the block report for the member's network and remove anything that obviously gets in the way of their work.
Revoke Wi-Fi keys, delete the member's profile and logs on schedule, and reset any devices left behind.
AI tools on shared networks
Operators increasingly get asked whether AI chat and coding tools are allowed. On member networks that is the member's decision, not the operator's.
Shared floors
Leave AI / LLM Tools open. Blocking it would break normal work for most members.
Private offices
Members with data rules can block or allow AI tools on their own profile.
Back office
Decide whether staff may paste member data into AI tools, and set the profile to match.
Kept current
Our AI tools set covers 16,000+ domains in 18 categories, updated daily.
A rollout plan for an existing space
Adding filtering to a space that already has members needs care. Announce it as a security improvement, start light and tighten only where there is a reason.
Week 1: audit
List every network, who uses it and which devices sit on it. Find building systems on member networks and move them off.
Week 2: security baseline in report mode
Apply Malware / Phishing / Suspicious blocking everywhere and watch what other categories show up in the logs without blocking them yet.
Week 3: announce and apply shared rules
Send members a short note with the policy, the review contact and the date. Then turn on Adult and File Sharing/P2P on shared floors.
Week 4: offer private policies
Invite private office members to choose their own categories, and set up their profiles one by one.
Every quarter: review
Look at review requests, complaints and block trends. Remove rules nobody needs and add only what incidents justify.
Privacy: treat member logs as confidential
DNS logs from a private office can show which clients, suppliers or acquisition targets a member is researching. That is commercially sensitive, so handle it with care.
Log less
Keep blocked lookups for security review. Do not keep full browsing histories unless there is a clear need.
Keep it short
Set a short retention period and state it in the membership terms.
Limit access
Only named operator IT staff, and the member for their own network, should see the logs.
Aggregate reports
Report by category and network, not by person. Members get their own reports if they want them.
Legal pointers
General information, not legal advice. Your obligations depend on country, contract and how you provide the connection.
Operators that pass member traffic through without selecting or changing it can usually rely on the "mere conduit" rule, now in Article 4 of the Digital Services Act. Courts may still order measures to stop repeat infringement.
Copyright law has safe harbours for some service providers, with conditions such as a repeat infringer policy. Ask counsel whether and how they apply to your setup.
DNS and firewall logs that can be tied to a member's staff are personal data under laws such as GDPR. You need a lawful basis, transparency and proportion.
Enterprise tenants may require specific security controls, data location or log handling in their contract. Check before applying a shared policy to their network.
Know who in your company handles requests from police or regulators, and do not answer them ad hoc from the front desk.
For flexible workspace platforms and IT providers
Workspace and network platforms
Companies that sell managed networks, member portals or network-as-a-service to coworking operators can add filtering as a native feature. Members choose categories in the same portal they use to book rooms.
Our OEM licensing provides the category data: 120 million domains, 59 categories, and about 300,000 new domains categorized daily, running inside your own platform with a lookup API.
IT providers managing spaces
If you manage several coworking sites or many small tenants, run one console with a profile per site and per member. Our MSP web filtering page explains the options.
For the general case of visitor networks, see guest Wi-Fi content filtering, and for a member's own staff policy see web filtering for small offices.
Coworking web filtering FAQ
Should a coworking space filter its internet?
Most operators apply a security-first filter that blocks malware, phishing and a small set of clearly unacceptable categories on shared networks. Members are businesses, so heavy content filtering on their traffic is usually unwelcome.
What categories should a coworking space block?
A typical shared-network baseline is Malware / Phishing / Suspicious, Adult and File Sharing/P2P, sometimes with Illegal Drugs and Hate/Discrimination. Private member networks often get only the security categories, or a policy the member chooses.
Can members have their own filtering policy?
Yes. Give each member company its own VLAN or private Wi-Fi key and map that network to its own DNS filtering profile.
Will filtering break members' VPNs and developer tools?
It should not. Keep VPN / Proxy / Anonymizers, Remote Access Tools, Developer Tools / Code Hosting and Cloud Storage / File Hosting open on member networks.
What should we do about copyright complaints from our ISP?
Block or limit File Sharing/P2P on shared networks, make sure you can trace which segment a complaint relates to, and handle it under your acceptable use policy. Take legal advice for your country.
Can a coworking space see what members browse?
With DNS filtering the operator can see which domains each network looked up, but not page contents of HTTPS sites. Good practice is to keep only blocked lookups for a short time and to report by network and category rather than by person.
How do we filter day pass and event guests?
Put them on a separate guest network with a stricter profile than members, a time limit and client isolation. Event networks can be created per booking and removed afterwards.
Do filter logs create privacy issues?
Yes. Logs from member networks can reveal confidential business activity. Keep them short, restrict access, state the purpose in member terms and avoid per-person browsing reports.
Security-first filtering for every floor
Tell us how many sites, members and networks you run, or what your workspace platform needs. We will suggest the hosted filter or a data licence.