Router content filtering for OEMs
Parents, small offices and internet providers now expect category-based content filtering built into the router. Not a list of typed-in addresses, but simple choices like "block adult sites and gambling on the kids' tablets".
This guide is for product managers and firmware teams at router, mesh and gateway makers. It covers architecture choices, data sizing on constrained hardware, updates, profile design and licensing.
Why built-in category filtering matters for router makers
Content filtering has moved from a niche setting to a feature buyers compare on the box. Several forces push it into router and mesh roadmaps at the same time.
Parent demand
Families want one place to protect every device in the home, including consoles and TVs that have weak controls of their own.
Provider tenders
Internet providers choosing home gateways increasingly list parental controls and security filtering as requirements.
Differentiation
Hardware specs converge. Software features such as profiles, schedules and reports set products apart in reviews.
Service plans
Advanced filtering and security are common in optional subscription bundles that sit alongside the hardware.
| Question parents ask | Router-level filtering | App on each device |
|---|---|---|
| Does it cover the game console and smart TV? | Yes, every device on the home network | Only where the app can be installed |
| Do I have to set up each device? | No, just assign it to a profile | Yes, one by one |
| Does it work at a friend's house or school? | No, only at home | Yes, it travels with the device |
| Can my child remove it? | Not from their device | Sometimes, depending on the platform |
| Can it block single pages on a site? | Usually no, whole domains | Sometimes, with deeper access |
The two approaches complement each other. Many households use the router for every device in the home and an app on the child's own phone.
A router is a natural place for this because it already serves DNS to the home and sees every connection. The concept behind it is explained in what is DNS filtering and what is URL filtering.
Three architecture options
The central decision is where category lookups happen. Each option trades storage on the device against dependence on a cloud service. Many makers use different options for different hardware tiers in the same product family.
Full data on the router
The category set lives in flash and loads into memory. Every decision is local.
- Works offline and with no per-lookup cost
- Strongest privacy story
- Needs storage and RAM, so suits higher-end models
- Updates via daily delta files
Router asks a cloud service
The router sends domains to your cloud, which returns categories. A local cache keeps repeat lookups fast.
- Minimal storage on the device
- Easy to update centrally
- Adds latency on first lookup
- Needs a resilient cloud and a privacy notice
Compact local set plus cloud
The router holds the most visited domains locally and asks the cloud only for rare ones.
- Nearly all lookups decided locally
- Small footprint on the device
- Graceful when offline
- The most common design for consumer lines
Build the data yourself or license it?
Building in-house means
- Categorizing tens of millions of domains before launch
- Labelling hundreds of thousands of new domains every day
- Rechecking sites as their content changes
- Running manual validation to measure accuracy
- Handling review requests from parents and providers
Licensing means
- Your team focuses on firmware, app and cloud features
- Category coverage is ready on day one
- Daily deltas arrive as files your pipeline consumes
- Validation reports are available to licence holders
- One contract can cover every product line
Why hybrid works: the 20 million most visited domains cover 99.99% of web traffic and usage. A well-chosen local subset of the most popular domains handles almost every lookup in a typical home, and the cloud fills in the long tail from the full 120 million.
Sizing category data for consumer hardware
Router makers ask the same first question: how much space does this take? The answer depends on how many domains you hold locally and how you encode them. These are planning ranges, not fixed numbers, and your engineers will tune them.
| Local set | Typical use | Storage approach | Fits |
|---|---|---|---|
| Threat and adult core | Entry routers, security plus basic parental control | Hashed domains with a category byte | Low-memory devices |
| Top popular domains, all categories | Mid-range routers and mesh nodes, hybrid design | Compact hash table, delta updates | Most current mesh systems |
| Top 20 million domains | High-end routers, small business gateways | Compressed sorted file with an index | Devices with generous flash and RAM |
| Full 120 million | Cloud service backing the router fleet | Server-side database | Your cloud or the lookup API |
Encoding tips
- Store domain hashes instead of strings where collisions are acceptable
- Keep only the primary category on-device, fetch secondary ones from the cloud
- Map 59 categories to a single byte
- Split the set into shards by hash prefix for partial updates
Lookup order on the router
- Parent's manual allow and block lists
- Full hostname in the local set
- Registered domain in the local set
- Cloud lookup, result cached with an expiry
- Uncategorized: apply the profile's default
Data is delivered as CSV, Parquet or JSON files, and licensed customers can export compact list formats too. See blocklist formats for the options.
Turning 59 categories into choices parents understand
Parents should not see 59 switches. Most products group categories into a handful of plain-language sets, with an advanced screen for the full list. This is one way to group them.
Age presets then switch groups on or off in one tap. A young child preset might block every group below and schedule the last one, while a teen preset keeps the harmful, adult and gambling blocks and relaxes the rest.
Harmful and scams
Always on for every profile.
Malware / Phishing / Suspicious, Parked / For-Sale Domains
Adult content
Blocked for child and teen profiles.
Adult, Lingerie/Swimsuits/Intimate Apparel, Dating
Gambling
Blocked for child and teen profiles.
Gambling, Cryptocurrency (optional)
Dangerous topics
Blocked for children, review for teens.
Illegal Drugs, Weapons, Violence, Hate/Discrimination, Alcohol, Tobacco
Filter bypass
Blocked for child and teen profiles.
VPN / Proxy / Anonymizers, URL Shorteners (optional)
Time and focus
Scheduled, not blocked: homework hours and bedtime.
Social Networking, Gaming, Streaming Media, AI / LLM Tools
Each source category is described on its own page, such as social media, gaming and streaming. Parents who want a whole type of site gone, rather than one app, can follow the guide on how to block websites by category, which shows the same idea from the network side.
Features buyers expect in a filtering router
Reviewers and provider tenders check for a familiar set of capabilities. Category data powers most of them. The rest depend on good device identification and a clear parent app.
Ship the basics well before adding extras. A filter that blocks the right sites, updates daily and cannot be switched off from a child's tablet earns better reviews than a long feature list that works only some of the time.
- Profiles per person, with devices assigned to each
- Age-based presets that set categories in one step
- Schedules for bedtime and homework
- Pause internet for a profile from the app
- Safe search enforcement on search and video
- Per-profile allow and block lists
- Reports of top categories and blocked attempts
- Alerts for new devices joining the network
- Security blocking for every device
- Bypass protection for child profiles
- Request-access button for children
- Settings sync across mesh nodes
Small business gateways need a different set
Staff and guest networks
Separate policies per SSID, with a family-safe guest profile and a lighter staff profile. See guest Wi-Fi content filtering.
Remote access control
Block Remote Access Tools except the one the business uses, a common defence against support scams.
Monthly reports
A one-page summary of threats blocked and top categories, which MSPs can forward to clients.
Privacy as a feature: when category decisions run on the router, browsing data never has to leave the home. That is a strong message for parents and for privacy-focused markets.
Closing bypass routes in firmware
Children are resourceful. A router filter that only answers its own DNS is easy to get around. These firmware features keep child profiles effective without breaking adult devices. Apply them per profile, so adults keep full freedom over their own settings.
| Bypass route | Firmware response |
|---|---|
| Device set to a public DNS server | Intercept outbound port 53 and answer locally for filtered profiles |
| Browser encrypted DNS | Answer the browser canary domain, block known public DoH hostnames for child profiles, offer a local encrypted resolver |
| DNS over TLS on port 853 | Block outbound 853 for filtered profiles |
| VPN and proxy apps | Block the VPN / Proxy / Anonymizers category and common VPN protocols for child profiles |
| MAC address randomization | Prompt parents to assign new devices, apply a default profile to unknown devices |
| Hostname hidden by encrypted handshakes | Rely on DNS-level decisions, which see the name before the connection |
Tests to run before each firmware release
Filtering tests
- A fixed list of test domains per category resolves or blocks as expected
- Profile changes take effect within a minute
- Schedules switch on and off at the right local time
- Safe search rewrites still work for each search service
Bypass and resilience tests
- A child device set to a public resolver is still filtered
- Browser encrypted DNS stays off on child profiles
- Filtering survives a cloud outage using the local set
- A failed data update rolls back cleanly
For deeper background, read DNS over HTTPS and web filtering and how to block VPN apps.
Keeping category data fresh on a device fleet
New adult, gambling and scam domains appear every day. A filter that updates monthly will miss many of them. Update design matters as much as the initial data.
Keep the update path separate from full firmware upgrades. Data patches should be small, frequent and safe to apply on a running router, while firmware updates stay on their own slower cycle.
Ingest
Your cloud receives the daily delta file with about 300,000 newly categorized domains.
Select
Pick the entries that belong in each device tier's local set.
Package
Build small signed patches per tier and shard.
Distribute
Routers fetch patches on a schedule with random spread to avoid load peaks.
Verify
Check the signature and apply without a reboot.
Refresh
Apply the monthly full refresh as a larger, less frequent update.
Domains are also checked again after a week and after a month, because many sites add content after launch. Those changes arrive in the same delta files, so a parked domain that becomes a casino moves to Gambling without any extra work on your side.
Selling to internet providers
Many routers reach homes through internet providers rather than retail. Providers have their own requirements for filtering features in the gateways they deploy, and they often score them in formal tenders alongside price and Wi-Fi performance.
What providers ask for
- Remote configuration of profiles through standard management protocols such as TR-069 or TR-369 (USP)
- Their own branding in the parent app
- Alignment with any network-level filtering they already run
- Clear data processing terms for subscriber privacy
- Category data they are allowed to use under the router's licence
How to prepare
- Expose filtering settings in the device data model
- Keep profile and category IDs stable across firmware versions
- Document how router and network filtering work together
- Offer a group-wide data licence option for provider deals
- Read ISP-level content filtering for the provider's view
Security and regulatory expectations
Connected device rules are tightening. The EU's cybersecurity requirements under the Radio Equipment Directive have applied to many wireless devices since 1 August 2025, and the UK has product security rules for connectable products. Secure, signed updates for filtering data fit naturally with these expectations. Check current requirements for each market with your compliance team.
Licensing category data for routers and mesh systems
Our data is licensed for embedding in products under an OEM licence. Terms depend on deployment model, device volumes and whether the data runs on the device, in your cloud or both.
Coverage
120 million categorized domains in 59 filtering categories, plus the IAB Content Taxonomy in one file.
Freshness
Daily delta files for new domains, monthly refresh of all others, rechecks after a week and a month.
AI tools
16,000+ AI-tool domains in 18 categories, updated daily, for parents who want to manage AI chat apps.
Lookup API
Included with licences for long-tail lookups from your cloud. See the API.
Licence models
- OEM licence for embedding in firmware and your cloud service
- Group-wide licence for makers with several product lines
- No resale or publication of the raw data
- Starter database tiers from $999; enterprise and OEM licences are quoted per deployment
What we need to quote
- Product lines and expected device volumes
- On-device, cloud or hybrid design
- Markets and channels, retail or provider
- Update frequency you plan to ship
From evaluation to shipping
| Phase | What happens |
|---|---|
| Scoping | We discuss hardware tiers, markets and whether data runs on the device, in your cloud or both |
| Data fit | Your team checks category labels against your own test lists with the domain lookup tool and API |
| Integration | Firmware and cloud teams build the local set, lookup order and update pipeline |
| Beta | A small fleet runs daily updates, and you measure local hit rate and wrong-block reports |
| Launch | The licence covers your shipping product lines, and daily deltas continue for the life of the agreement |
Full terms are on the OEM licensing page. You can check how individual domains are labelled with the domain lookup tool.
Frequently asked questions
How does content filtering work on a router?
The router serves DNS to the home and often sees connection hostnames. Each lookup is checked against a domain category database and the device's profile, then allowed or blocked.
What is a URL filter in a router?
A feature that blocks websites from a manual list or by category. Category filtering lets parents choose types of sites instead of typing addresses.
Should category data live on the router or in the cloud?
Many products use a hybrid: a compact local set of popular domains plus a cloud lookup for rare ones.
How often should router category data be updated?
Daily for new domains, using small delta files, with a periodic full refresh.
Can router filtering be bypassed?
Yes, unless firmware intercepts DNS, blocks encrypted DNS endpoints and VPNs for child profiles, and answers browser canary domains.
How is category data licensed for routers?
Through an OEM licence for firmware and cloud use. Terms depend on volumes and deployment model and are quoted per deployment.
Build category filtering into your next router
Tell us about your product line, hardware tiers and markets. We will help you size the on-device set and quote an OEM licence.
Talk to us about licensing