Web filtering for small offices
Accountants, law firms, estate agents, architects, charities and trade offices often run on one router, a few laptops and nobody whose job is IT. They are also prime targets for invoice fraud and stolen passwords.
This guide shows how a small office of 2 to 50 people can set up sensible web filtering in an afternoon, keep it working for staff who travel or work from home, and stay on the right side of staff privacy. Larger teams should also read our small business web filtering overview.
The short version
- Separate staff and guest Wi-Fi
- Point the office router's DNS at a category filter
- Block security categories first, then a short content list
- Cover laptops that leave the office
- Tell staff what is filtered and why, in one page
What small offices actually face
The threat to a small office is rarely a dramatic attack. It is an ordinary email, link or download on an ordinary day. Web filtering stops many of these at the point where the browser looks up the site.
Invoice and payment fraud
A supplier's look-alike domain sends new bank details. The link to "view the invoice" leads to a fake login page.
Stolen email passwords
Fake sign-in pages for email and file sharing harvest credentials, which are then used to send more fraud from your real mailbox.
Malware downloads
Fake software updates, cracked tools and "free" templates carry ransomware and info-stealers.
Brand-new domains
Many phishing domains are only days old. Blocking newly registered domains for their first days removes a large share of them.
HR and liability issues
Explicit or hateful content on a shared screen can become a harassment complaint, even in a team of five.
Client data in AI tools
Staff paste client documents into AI chat tools without checking whether that is allowed by your contracts or regulator.
Which categories to block: three tiers
Security first, legal and HR risk second, productivity last and only if you really need it. Category names come from our 59 web filtering categories.
Tier 1: securityEvery small office
Malware / Phishing / Suspicious, newly registered domains, Parked / For-Sale Domains. Consider URL Shorteners if your team rarely needs them.
Turn on todayTier 2: legal and HRMost offices
Adult, Illegal Drugs, Hate/Discrimination, Gambling, Violence. Add File Sharing/P2P to avoid copyright complaints and malware from pirated software.
RecommendedTier 3: data handlingFirms with client confidentiality
VPN / Proxy / Anonymizers (allow your own business VPN), Cloud Storage / File Hosting except approved services, AI / LLM Tools except approved tools.
Decide per firmTier 4: productivityOptional
Social Networking, Streaming Media, Gaming, Shopping. Most small teams leave these open or use schedules rather than blocks.
Usually leave openPolicy suggestions by type of office
The tiers stay the same, but what you add on top depends on the work you do and the data you hold.
| Office type | Main concern | Suggested additions | Keep open |
|---|---|---|---|
| Accountants and bookkeepers | Payment fraud, client financial data | Tier 3 in full, strict newly registered domain blocking during tax deadlines | Government & Legal, Online Banking, Financial Services |
| Law firms | Client confidentiality, email account takeover | Tier 3 in full, approved AI tools only | News/Media, Government & Legal, research sites in every category |
| Estate and letting agents | Deposit and completion fraud | Tier 1 and 2, URL Shorteners blocked | Real Estate, Marketplaces / Classifieds / Auctions, Social Networking |
| Design and architecture studios | Malware in downloaded assets and plugins | Freeware/Software reviewed, File Sharing/P2P blocked | Arts & Entertainment, Cloud Storage / File Hosting, Streaming Media |
| Trades and field service offices | Shared PCs, phones on office Wi-Fi | Tier 1 and 2, guest network for visiting crews | Automotive & Transportation, Shopping for suppliers |
| Small charities | Donor data, volunteer devices | Tier 1 and 2, separate volunteer network | Social Networking for campaigns, Health & Medicine |
The one-afternoon setup
No new hardware is needed in most offices. If the terms are new to you, start with what DNS filtering is.
Find your router
Locate the router, its admin login and whether it can run a separate guest network. Change the default admin password if it is still set.
Split the network
Create a guest network for visitors and personal phones. Keep office PCs, printers and the file server on the staff network.
Point DNS at the filter
Enter the filter's DNS addresses in the router for each network. With our managed DNS filter, staff and guest networks each get their own profile.
Choose and test
Turn on tiers 1 and 2. Test from a laptop: try a few blocked categories, then check your banking, accounting software and client portals.
Router DNS only
2 to 10 people, one site- Uses the router you already have
- Covers every device on the network
- Does not cover laptops away from the office
Hosted filter with device links
5 to 50 people, hybrid work- Office network plus a private encrypted link on each laptop
- Same policy in the office, at home and on the road
- Reports and schedules in one dashboard
Business firewall
20 to 50 people, several sites- Forces DNS through the filter
- VPN for remote staff back to the office
- Usually set up by an IT provider
Hybrid and remote staff
In many small offices half the team is at home on any given day. A router-only filter protects nobody there.
Company laptops at home
Give each laptop the filter's private encrypted DNS link, so the policy follows it on any network. Encrypted DNS also stops a home router from overriding it.
Company phones
Phones can use the same encrypted DNS setting, or a profile pushed by device management if you have it.
Personal devices
Do not try to filter staff's own phones and home PCs. Give them access to work systems through the browser and protect accounts with multi-factor sign-in.
Travel and hotels
Hotel and cafe Wi-Fi are where phishing pages and fake portals catch travellers. Device-level filtering matters most here.
Browsers can switch on their own encrypted DNS and skip the office filter. Read DNS over HTTPS and web filtering to see how to keep control on company devices.
Reading the monthly report
A small office does not need a security team to get value from filter reports. Ten minutes a month with the summary is enough to spot most problems.
Phishing blocks rising
A jump in blocked phishing lookups often follows a wave of fake emails. Warn staff and check whether anyone entered a password.
Lookups at night
Office devices contacting unusual sites when nobody is working can be a sign of malware. Check that machine first.
One site blocked repeatedly
Usually a legitimate tool the team needs. Review it and add it to the always-allow list if it is safe.
Printers and cameras
Devices you forgot about show up in the report. Make sure they only reach their maker's services.
AI tool use
The AI / LLM Tools category shows which assistants the team relies on, which helps you write a sensible AI policy.
Trends, not people
Look at categories and devices, not at individual browsing. That keeps the review useful and proportionate.
Common mistakes in small offices
Most small office incidents we hear about trace back to one of these, not to a gap in the filter itself.
One Wi-Fi password for everyone
Visitors, contractors and staff phones share the network with the file server and accounts PC. A guest network fixes this in minutes.
Filtering only in the office
Laptops that leave the building lose the protection exactly where they need it most.
Blocking the business VPN
Blocking VPN / Proxy / Anonymizers without allowing your own VPN or remote access tools stops staff from working.
Leavers keep access
Former staff still know the Wi-Fi password and filter login. Change both when someone leaves.
Joiners and leavers
Staff changes are when small office settings drift. Add these steps to whatever list you use for new starters and leavers.
When someone joins
- Set up the filter's encrypted DNS link on their laptop and phone
- Give them the one-page policy and the unblock contact
- Explain which AI tools and file sharing services are approved
When someone leaves
- Remove their devices from the filter dashboard
- Change the staff Wi-Fi password and any shared admin logins
- Delete logs linked to them on your normal retention schedule
Offices in shared buildings
If your office sits in a serviced building or coworking space, the landlord's network may already apply a filter. Ask what it covers and whether you can have your own network.
If the building provides the network
- Ask for a private network or Wi-Fi key for your team
- Ask which categories the building blocks and what it logs
- Use device-level filtering on company laptops for your own policy
If you bring your own router
- Set your own DNS filtering profile on it
- Keep guest devices off your network
- Our coworking space web filtering guide explains the operator's side
Write a one-page policy
Staff accept filtering when they know what it does and what it does not do. A single page is enough for a small office.
What to include
- Why the office filters: security and a respectful workplace
- Which networks and devices are covered
- What categories are blocked, in plain words
- How to ask for a site to be unblocked
- What is logged, for how long and who can see it
- Rules for AI tools and client data
What to avoid
- Reviewing individual browsing without a clear, stated reason
- Keeping full browsing histories indefinitely
- Secret monitoring that staff have not been told about
- Blocking so much that staff switch to their phones
- Policies nobody has signed or seen
Small office web filtering checklist
Use this list once a year, or whenever someone joins or leaves the office.
- Router admin password changed from the default
- Router firmware updated
- Guest Wi-Fi separate from the staff network
- Tier 1 security categories blocked on all networks
- Newly registered domains blocked
- Tier 2 categories blocked on the staff network
- Company laptops filtered away from the office
- Browser encrypted DNS managed on company devices
- Business VPN and remote tools allowed
- Banking, tax and client portals tested and working
- One-page policy shared with staff
- Named person handles unblock requests
- Logs kept for a short, stated period
- Policy reviewed once a year
Legal pointers
General information, not legal advice. Employment and privacy law differ by country and state, so check how they apply to you.
UK: monitoring workers
The UK data protection regulator published guidance on monitoring workers in 2023. It expects monitoring to be necessary, proportionate and transparent, and suggests an impact assessment for intrusive monitoring.
EU: proportionality
Under GDPR, logs of staff browsing are personal data. The European Court of Human Rights ruling in Barbulescu v. Romania (2017) stressed that employees must be told in advance about monitoring of their communications.
United States
Employers generally have wide latitude on company networks and devices, but some states have notice rules for electronic monitoring. Tell staff in writing what is filtered and logged.
Security schemes
In the UK, the Cyber Essentials scheme covers firewalls, secure configuration, user access control, malware protection and security updates. Web filtering is not a named control but supports several of them.
Professional rules
Law firms, accountants and financial advisers may have regulator or insurer requirements on handling client data, including use of cloud and AI tools. Match tier 3 to those rules.
Cyber insurance
Some insurers ask about DNS or web filtering on their questionnaires. Keep a short record of what you run and since when.
For IT providers, router makers and SMB security vendors
Small offices buy filtering through someone else: an IT provider, a broadband bundle, a router, or a security suite. If you build or sell those, category data is the part worth licensing rather than building.
See OEM licensing to embed our data, router content filtering for OEMs for hardware makers, and MSP web filtering for providers managing many small clients.
- 120 million categorized domains in 59 web filtering categories
- About 300,000 newly registered domains categorized every day, rechecked after a week and a month
- AI tools set with 16,000+ domains in 18 categories, updated daily
- Runs inside your own systems, with a lookup API included
- DNS RPZ, hosts and firewall list exports for licensed customers
- Starter database tiers from $999; OEM licences quoted per deployment
Small office web filtering FAQ
Does a small office need web filtering?
Most small offices benefit from at least security filtering, which blocks phishing, malware and newly registered domains. Small firms are frequent targets of invoice fraud and credential theft.
What should a small office block?
Start with Malware / Phishing / Suspicious, newly registered domains and Parked / For-Sale Domains. Most offices add Adult, Illegal Drugs, Hate/Discrimination and Gambling. Productivity blocks are optional.
How do I set up web filtering without an IT person?
Change the DNS server setting on your office router to a DNS filtering service and choose categories in its dashboard. Every device on the office network is then covered.
Are staff laptops filtered when they work from home?
Not by the office router. Use a filter with a per-device encrypted DNS link or an agent, or route traffic through a business VPN back to the office.
Is it legal to filter and log employees' web use?
Filtering is generally lawful. Logging and reviewing individual browsing is more sensitive and must be proportionate and transparent in the UK and EU. Take advice for your country.
Should a small office block AI tools?
Not by default. Decide which AI tools are approved for client data, allow those, and block the rest of the AI / LLM Tools category if your contracts or regulator require it. Explain the rule in your one-page policy.
Do we still need antivirus if we filter the web?
Yes. Web filtering stops many threats before they load, but it does not scan files, email attachments or USB drives. Use it alongside endpoint protection, updates and multi-factor sign-in.
What about visitors and contractors who need Wi-Fi?
Put them on a separate guest network with its own filtering profile. They get internet access without reaching your file server, printers or accounts PC.
How often should we review the filter settings?
Look at the monthly summary for a few minutes, and review the policy itself once a year or when your work changes, for example when you take on clients with stricter data rules.
Will web filtering slow down our internet?
DNS filtering adds no noticeable delay, because it answers the lookup before a site loads.
Protect your office this afternoon
Tell us how many people and sites you have, or what your router or IT service needs. We will suggest the hosted filter or a data licence.