Staff bypass PIN: open adult research for a set time, then close it again
Libraries and schools often need a way for an authorized adult to reach a blocked site for lawful research. Our managed DNS filter gives every network a simple staff page: enter the PIN, pick 15, 30 or 60 minutes, done. It switches back by itself and every use is logged.
Who the staff bypass is for
The bypass is built for front-line staff who are not IT people. It needs no login, no app and no training beyond the PIN.
Library desk staff
A patron researching a health topic, art history or a legal question hits a blocked page. The librarian opens adult categories on that network for a short time.
School staff
A teacher preparing a lesson on a staff network needs a page the filter labels adult. The bypass covers that network only, never the student networks.
Directors and IT contacts
They need proof that the bypass is controlled: limited to adults, timed and recorded. The logs and monthly reports provide that record.
Under CIPA, an administrator, supervisor or other authorized person may disable the filter during use by an adult for bona fide research or another lawful purpose. Check your own policy and legal guidance for the rules that apply to you; see our CIPA web filtering overview.
Why a timed PIN beats switching the filter off
Without a bypass, the usual answer is to log in to a router or filter console and turn rules off. That needs an IT person, opens far more than intended and is easy to forget.
No IT call
Desk staff handle the request in under a minute from a phone, with no access to the rest of the configuration.
Narrow opening
Only adult categories open, so bypass tools, gambling or your custom blocks never open by accident.
Nothing to forget
The timer closes the opening even if nobody remembers, which is the usual failure of manual switching.
How a bypass works, minute by minute
This is the full sequence from a blocked page to the filter closing again, as it runs on a real network.
A blocked page appears
The browser shows the block page, or on a secure site a browser warning. The visitor asks at the desk.
Open the staff page
Staff open the network's staff link, usually bookmarked on a desk PC or a work phone. The page shows the account name, the network and whether the filter is fully on.
Enter the PIN and choose a time
Type the PIN and press the 15, 30 or 60 minute button. The page confirms and shows how many minutes remain.
Adult categories open on that network
Within seconds, lookups from that network are no longer blocked for adult categories. Everything else stays as the profile sets it. A browser that kept the earlier block may need about a minute.
Time runs out, filter closes
When the time ends, adult categories are blocked again automatically. Staff can end it early with Turn the filter fully back on.
The event is on record
The start, the minutes and any early end appear in Activity, in the bypass log CSV and in the monthly report, with the network and the source.
What opens and what stays closed
A bypass is narrow on purpose. It answers the research case and nothing more, so a forgotten bypass cannot turn into an open network.
Opens for the chosen time
- The Adult category
- Lingerie/Swimsuits/Intimate Apparel, where a profile blocks it
- Only on the network the bypass was started for
- Only for 15, 30 or 60 minutes
Stays blocked throughout
- VPN / Proxy / Anonymizers and every other blocked category
- Categories added by a time schedule
- Your always blocked lists
- Public encrypted DNS services that would skip the filter
- Every other network in the account
SafeSearch and YouTube Restricted Mode also stay as the profile sets them. If a research task needs unrestricted search results, that is a policy decision to make with your IT contact, not something the bypass changes.
One staff page and PIN per network
Each network gets its own link and PIN when it is created. That keeps a bypass at one branch or on one Wi-Fi from touching anything else.
| Setting | Where to change it | What happens |
|---|---|---|
| Change the PIN | Network page, Staff page card | The new PIN works at once. The old one stops working. PINs are 4 to 8 digits. |
| New staff link | Network page, New staff link | A fresh link is created. The old link stops working, so update bookmarks. |
| Start or stop from the dashboard | Staff bypass page | Same effect as the staff page, logged with the source dashboard. |
| See current state | Staff bypass page, Networks list | Shows Filter fully on, or Adult bypass on with minutes left. |
| Delete the network | Network page | Its staff link stops working and any running bypass ends. |
Controls that keep the bypass safe
The staff page is reachable without an account, so it carries its own protections. None of them need configuring.
PIN required
Nothing changes without the right PIN for that network.
Attempt limit
Repeated wrong PINs from one address lead to a short wait before the next try.
Hard time limit
The longest bypass is 60 minutes. There is no open-ended option.
Not indexed
Staff pages tell search engines not to list them, and links are long and random.
Network scope
A bypass applies to one network only, never the whole account.
Narrow effect
Only adult categories open. Bypass tools and other categories stay closed.
Full record
Every start and early end is logged with time, network, minutes and source.
Easy rotation
A new PIN or a new link takes one click when staff change.
Rolling it out to staff
A ten-minute briefing is usually enough. These are the points worth putting on a card at the desk.
Bookmark the link
Save the staff link on the desk PC and on any work phone. Do not post it on a public screen or in a patron guide.
Pick the shortest time
Start with 15 minutes. Staff can start another bypass if the research takes longer, and each start is logged.
Close it when done
Press Turn the filter fully back on when the patron finishes. It closes on its own anyway, but early closing is good practice.
Treat the PIN like a key
Share it only with staff allowed to approve research access. Change it when someone leaves.
Allow a minute
If the page still shows blocked, wait about a minute or open a new private window. Browsers keep answers briefly.
Know what it does not do
It does not open VPN sites, gambling or anything on the always blocked list. For a wrongly blocked site, use the always allowed list instead.
Bypass or always allowed: which one to use
Two tools solve two different problems. Picking the right one keeps the logs meaningful and saves staff time.
| Situation | Use | Why |
|---|---|---|
| An adult needs an adult-labelled site for research today | Staff bypass | Short, logged, limited to adult categories and one network |
| A harmless site is blocked by mistake | Always allowed list | Fixes it for everyone, permanently, without a timer |
| A site in another blocked category is needed | Always allowed list for that network | The bypass does not open non-adult categories |
| Staff need a category open every day | Change the profile | A daily bypass is a sign the policy needs adjusting |
| Children's PCs need something opened | Ask the IT contact | The bypass is for adults; children's networks follow their own profile |
What the bypass record looks like
Every event lands in the same place, in your account's time zone. The monthly report lists them in a Staff bypass use table; the CSV has the same columns for your own files.
| Time (local) | Network | Event | Minutes | Started from |
|---|---|---|---|---|
| Tue 10:18 | Staff Wi-Fi | Adult bypass started | 15 | staff page |
| Tue 10:29 | Staff Wi-Fi | Filter fully on | staff page | |
| Wed 14:02 | Oak Street Branch | Adult bypass started | 30 | dashboard |
| Fri 18:26 | Public Wi-Fi | Adult bypass started | 60 | staff page |
Sample rows for illustration. A bypass that runs to its end has no closing row; the minutes column tells you when it ended. Networks that were deleted later keep their name in the record, marked as deleted.
Four everyday scenarios
How the bypass behaves in situations that front desks describe to us. Each one follows the same rules: adults only, one network, a fixed time.
Health research at the public PCs
A patron studying a medical topic finds a page labelled adult. Staff start a 15 minute bypass on the public PC network from the desk phone, then close it when the patron leaves.
Lesson preparation in the staff room
A teacher on Staff Wi-Fi needs an art history page. A 30 minute bypass on Staff Wi-Fi opens it. Student networks keep the full filter the whole time.
A patron asks for a VPN site
The bypass will not open it. VPN / Proxy / Anonymizers stays blocked during any bypass, because opening it would switch off the filter for that device.
A harmless shop is blocked
A clothing store carries an intimate apparel label. Rather than a daily bypass, the IT contact adds it to always allowed once, and it stays open for everyone.
Putting the bypass into your written policy
Boards and auditors usually ask how unblocking is controlled. A short paragraph in your internet safety policy, backed by the record, answers most of those questions.
Who may approve
Name the roles allowed to use the PIN, such as librarians on duty or senior staff.
For whom
State that the bypass is for adults and lawful purposes, as your policy and applicable law define them.
How long
Say that access is time-limited to 15, 30 or 60 minutes and ends automatically.
How recorded
Note that each use is logged by time and network and reviewed monthly.
The dashboard can print a one-page policy record of your blocked categories, lists and bypass rules. It supports your own documentation and is not legal advice.
Limits of a DNS-level bypass
The bypass works at the DNS level, like the filter itself. That makes it simple, and it also sets a few boundaries.
Whole network
Every device on that network gets the opening for the chosen time, not only one PC. Give public PCs their own network if that matters.
No per-person PINs
All staff on a network share one PIN. The log shows when and where, not which staff member.
HTTPS warnings
A secure site that was blocked moments ago may still show a browser warning until the browser asks again.
Domain level
DNS filtering never sees full URLs, so a bypass opens whole sites in the adult categories, not single pages.
Website category filtering is one layer. It does not monitor what people read or type, and the bypass record shows network events, not personal activity. Background on the approach: what is DNS filtering and library web filtering.
Test it once before go-live
A five-step check on each network confirms that the bypass, the switch-back and the record all work as described. It takes about twenty minutes in total.
Confirm the block
From a device on the network, open a site in the Adult category and confirm it is blocked. On a secure site, expect the browser warning.
Start a 15 minute bypass
Open the staff page for that network, enter the PIN and choose 15 minutes. The status line shows the minutes left.
Check the opening
Open the same site in a new private window. It loads. Then try a VPN site: it stays blocked.
Close it early
Press Turn the filter fully back on. After about a minute the adult site is blocked again on that device.
Read the record
Open Activity or download the bypass CSV. You should see the start, the 15 minutes and the early end, with the network name.
Staff bypass questions
What does the staff bypass unblock?
Only the adult categories, on one network, for the time chosen. Every other blocked category, the always blocked list and the block on bypass tools stay in place.
Do staff need a dashboard account?
No. Each network has its own staff link and PIN. Staff open the link, enter the PIN and choose 15, 30 or 60 minutes.
Does the filter switch back on by itself?
Yes. When the time ends, adult categories are blocked again automatically. Staff can also end it early.
Is every bypass logged?
Yes, with time, network, minutes and source. See Activity, the bypass log CSV and the monthly filtering reports.
Can each staff member have their own PIN?
Not today. The PIN belongs to the network. Change it whenever staff leave or it has been shared too widely.
What happens after several wrong PINs?
The staff page asks the person to wait a few minutes before trying again.
Does the staff page work on a phone?
Yes. It is a single page with large buttons, made for a phone screen as much as a desk PC. The phone does not need to be on the filtered network; the bypass applies to the network the page belongs to.
Can staff see who is browsing what?
No. The staff page only starts and ends a bypass. Lookups are visible to dashboard users in Activity, and the filter does not record names of people.
Can a bypass be started for every branch at once?
No. Each branch or network has its own staff page, and a bypass covers only that network. This is deliberate, so one desk cannot open other sites.
What if the staff link gets shared with patrons?
Create a new staff link and change the PIN on the network page. The old link stops working at once. Without the PIN the page cannot change anything anyway.
Does a running bypass survive a profile change?
Yes. The bypass belongs to the network, so it keeps running until its time ends, and the network's new profile applies to everything except the adult categories during that time.
Can we change the time options?
The options are 15, 30 and 60 minutes. Talk to us if your policy needs something different and we will discuss it.
See the staff bypass on your own network
Tell us how many sites and networks you run. We will set up the networks, PINs and staff links with you.
More guides: profiles and networks · branded block page · managed DNS filter overview · adult content category
YouTube is a trademark of Google LLC. It is used here only to identify the service discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by its owner.