How much does a web filter cost? Pricing models for business
You have two or three web filter quotes and each one counts something different: people, devices, sites or lookups. This guide turns them into the same unit so you can see which is really cheaper for your network.
It is for owners, office managers and IT providers who sign the order, not only the people who set the filter up.
The short answer
- Web filters are priced per user, per device, per site, per lookup, as an appliance with a yearly subscription, or inside a security bundle.
- The unit decides your bill more than the headline price. Guests, phones and a second site are where quotes grow.
- Compare the total for three years, including setup, hardware, renewals and your own time.
- Our managed DNS filter is priced per site: $99 a month for one site, with several sites on one quote.
Six ways web filters are priced
Every model is fair for someone. The trouble starts when the unit on the quote is not the thing that grows in your business.
| Model | You pay for | The bill grows when | Usually suits | Watch for |
|---|---|---|---|---|
| Per user | Each named person, often with a minimum | You hire | Offices with one login per person | Guests and shared PCs are not users |
| Per device | Each laptop, phone or tablet with the agent | People get a second or third device | Managed laptop fleets | Unmanaged and guest devices stay uncovered |
| Per site | Each location or network you filter | You open a new location | Offices, shops, clinics, libraries | Ask what counts as one site |
| Per lookup | DNS lookups per month, in bands | Traffic grows or devices get chatty | Small, steady usage | Overage fees, or filtering that stops at the cap |
| Appliance | A box plus a yearly content subscription | Throughput grows or the box ages | Large networks with an existing firewall | Hardware refresh and two renewals to track |
| Bundled | A higher tier of a security suite | The suite renews | Teams already on that suite | Filtering may need the top tier |
One price per location, whoever connects to it
Our managed DNS filter counts sites, not people, phones or lookups. Staff, visitors and shared PCs on that network are covered by the same monthly price.
- No user, device or lookup count on the invoice.
- Category switches, allow and block lists, a staff PIN bypass and reports come with the site.
- A main and a backup filter server answer for every site.
What actually moves the price
Before you compare numbers, count these eight things for your own network. Most quotes are built from two or three of them.
Headcount
The base of every per-user quote. Check whether part-timers, contractors and seasonal staff count as full users.
Devices per person
A laptop, a phone and a tablet can mean three device licences for one person. Per-device prices multiply quietly.
Number of sites
Each office, shop or branch needs its own filtering point. Per-site pricing grows here and nowhere else.
Guests and shared PCs
Visitors, patients and public computers rarely fit a per-user model. See guest Wi-Fi content filtering for how they are handled.
Devices that leave
Laptops at home or on the road need filtering that travels. That is often an add-on, or the reason for an agent.
Records and retention
How long you keep activity, and whether you can export it, can move a quote up a tier.
Encrypted page inspection
Looking inside encrypted pages needs certificates and usually hardware or a proxy. Read SSL inspection and URL categories before you pay for it.
Setup and support
Onboarding fees and support tiers sit outside the unit price. Ask for them in writing.
Same network, four different bills
Four example networks, counted the way each pricing model would count them. Multiply by the unit prices in your own quotes to see the real difference.
A small office
12 staff, about 20 devices, 1 site, visitor Wi-Fi
- Per user
- 12 seats; visitors are outside the licence
- Per device
- About 20 agents; visitor phones cannot have one
- Per site
- 1 site, visitors included
- Per lookup
- Depends on traffic, which you cannot know in advance
A clinic group
3 sites, 40 staff, patient Wi-Fi at each site
- Per user
- 40 seats, and patients on top if covered at all
- Per device
- Every staff device, patient devices uncovered
- Per site
- 3 sites, with a separate profile for patient Wi-Fi
- Appliance
- One box per site, or traffic sent back to one
A public library
1 branch, 22 public PCs, 6 staff, visitor Wi-Fi
- Per user
- Visitors are not users, so the model barely fits
- Per device
- 28 PCs and staff devices; visitor phones uncovered
- Per site
- 1 site covering PCs, staff and Wi-Fi
- Records
- Needed for funders and boards on every model
An IT provider
15 client offices, 5 to 30 staff each
- Per user
- The sum of every client's seats, tracked monthly
- Per device
- Agents to deploy and update at 15 clients
- Per site
- 15 sites in one console, one policy per client
- Resale
- See hosted DNS filtering for MSPs
Five office tools and the category that decides whether they open
Unblock requests are a cost that never shows on a quote. These rows from our data show which switch touches each tool, so you can predict the tickets before you turn a category on.
| Site | Categories in our data | What that means for the bill of staff time |
|---|---|---|
| zoom.us | Webinars/E-learning, Web-based Applications, Business | None of these is a blocking switch, so calls keep working |
| linkedin.com | Social Networking, Job Search/Careers, Business | Blocking social networks will reach the sales team; plan an allow entry |
| spotify.com | Podcasts, Streaming Media | Closing streaming to save bandwidth also closes training podcasts |
| anydesk.com | Remote Access Tools | Blocking it closes a favourite route for support scams; allow only the tool your IT provider uses |
| twitch.tv | Streaming Media, Gaming | Caught by either switch, a common lunchtime request |
Costs that rarely appear on the first quote
The unit price is the top of the pile. These lines sit underneath it, and most of them recur.
Unit price
Per user, device, site or lookup band, usually for a fixed term.
Term and minimum
A yearly term and a minimum count are common, even when the monthly figure looks small.
Setup and onboarding
One-off fees for configuration, training or a migration from your old filter.
Hardware and its replacement
Appliances age, and a faster connection can mean a bigger box before the old one is paid off.
Agent rollout and upkeep
Installing, updating and troubleshooting software on every device takes hours each month.
Add-on modules
Reports, filtering away from the office, forced SafeSearch or longer records may each be a separate line.
Support tiers
Help by email only on the base tier, a phone line on the next one up.
Renewal increases
The first year can be discounted. Ask what years two and three cost before you sign.
Your own time
Every unblock request, every "what was blocked?" and every bypass you chase is paid in staff hours.
What one site on the managed DNS filter includes
The $99 monthly price for a single site covers the category switches, always-allow and always-block lists, the staff PIN bypass, the activity log with reports, and the main and backup filter servers. It is a monthly agreement with nothing to install, and you can cancel at any time.
Ten questions to put to every web filter quote
Send the same list to every vendor, including us. The answers make the quotes comparable.
What exactly is the unit?
Named users or active users, devices installed or devices seen in a month, sites or networks.
Are guests and shared PCs covered?
If they are, at what price; if not, what protects them.
Is there a minimum count or term?
A low unit price with a 25-seat minimum is a different offer for a 10-person office.
What is in the base price?
List the features you need and ask which ones are add-ons, line by line.
What happens at renewal?
Ask whether the price is fixed for the next term and how increases are announced.
Are there setup or hardware fees?
Include delivery, installation and any box you would have to replace later.
What happens above the count?
Overage fees, throttled service, or filtering that stops are three very different answers.
How long are records kept?
And can you export them for your board, insurer or auditor without a higher tier?
Who supports us, and how?
Email, chat or phone, and whether the people answering can see your settings.
How do we leave?
Notice period, and whether you can take your allow and block lists with you.
Words you will meet on a web filter quote
Quotes use a small vocabulary of licensing terms. Each one changes what you actually pay, so it is worth knowing them before the call with sales.
Named user
A licence tied to one person, paid for whether or not they used the service that month.
Active user
Only people seen using the service in the billing period are counted. Fairer for part-time teams, harder to predict.
True-up
A later invoice for users or devices added above the number you bought. It often arrives at renewal, all at once.
Overage
The fee for going over a plan's limit, common on plans priced by lookups or bandwidth.
Minimum commitment
The smallest count or spend you pay for, however little you use. Check it against your real headcount.
Price lock
A written promise that the unit price will not rise for a stated period. Without it, the renewal price is open.
Co-terming
Licences bought mid-term are set to end on the same date as the original contract, usually charged pro rata.
Site
One location or network. Ask whether a branch with two buildings, or a separate guest network, counts as one site or two.
Where a per-site price fits, and where another model is better
Per-site DNS filtering is the simplest bill for most locations. It is not the right unit for every team, and it helps to know which you are.
Per site fits best when
- Most people work at one or a few locations.
- Visitors, patients or the public use your Wi-Fi or shared PCs.
- You want to filter phones and smart devices without installing anything.
- Headcount changes often, with seasonal or part-time staff.
- An IT provider runs several small client offices.
Look at per-device or a gateway when
- Almost everyone works remotely with no office network at all.
- You must inspect pages inside encrypted traffic, not only domains; see what a secure web gateway does.
- Your contracts require file scanning on every download.
- A security suite you already pay for includes filtering at the tier you own.
A per-seat quote next to our per-site price
The same office, counted two ways, as the business changes over a year.
| When this happens | Typical per-seat web filter | Managed DNS filter, per site |
|---|---|---|
| Visitors join the Wi-Fi | Outside the licence, or extra seats | Covered by the site price, with their own profile if you want one |
| You hire five people | Five more seats on the next invoice | No change to the price |
| Staff bring phones and tablets | More licences if devices are counted | Filtered on the network with nothing installed |
| A manager asks what was blocked | Depends on the reporting tier | Searchable activity, reports and CSV exports included |
| You open a second site | Seats move with people, plus setup at the new site | One more site on the same dashboard and quote |
| You want to stop | Often the end of a yearly term | Single-site plan is monthly, cancel at any time |
Web filter cost: frequently asked questions
How much does a web filter cost for a small business?
It depends on what the vendor counts: users, devices, sites, lookups or hardware. Our managed DNS filter is priced per site, at $99 a month for one site, with staff, guests and shared PCs on that network covered by the same price.
Is per-user or per-site web filter pricing cheaper?
Per-site pricing tends to win when one location has many people or guest devices. Per-user or per-device pricing tends to win for a few people who work mostly away from any office network.
Are there free web filters for business?
Free filtering DNS addresses exist and block a fixed profile, usually malicious and adult sites. Our guide to free DNS filtering services covers what they leave out: your own categories, allow lists, records and rules per network.
What hidden costs come with a web filter?
Setup fees, hardware and its replacement, agent rollout, minimum seat counts, add-on modules, higher support tiers and renewal increases. Add overage fees on lookup plans and the staff time spent on unblock requests.
Does a web filter need hardware?
A DNS filter needs no hardware: you change the DNS server on your router. Filters that inspect encrypted traffic page by page usually need an appliance, a cloud proxy or an agent on every device.
Can I pay for a web filter monthly?
Many vendors sell yearly terms only. Our single-site managed DNS filter is a monthly agreement that you can cancel at any time.
How do IT providers price web filtering for their clients?
Most add it to a managed service per client site or per seat. Our partner plan puts several customers in one console, each with its own policy, so the provider can price per site.
A single site on the managed DNS filter is $99 a month with no count of users or devices, and several sites share one quote. Put it on one location in a pilot first and compare it with the other offers on your desk.
Get a per-site price for your network
Tell us how many locations you run and which networks need filtering: staff, visitors, public PCs. We will send one price that covers all of them.