How to Lock SafeSearch So Your Child Can't Turn It Off
There are two completely different jobs hiding behind the phrase "turn on SafeSearch", and almost every guide online treats them as one. Switching SafeSearch on is a preference. It lives in a browser profile or a Google account, it takes about four seconds to set, and it takes about four seconds to unset. Locking SafeSearch means enforcing it from somewhere your child cannot reach - the network, the device's policy layer, or a supervised account - so the toggle either isn't there or doesn't do anything when they press it.
If you've already turned SafeSearch on and found explicit results showing up again a week later, nothing broke. You set a preference, and someone changed it back. This guide covers how to enforce it properly on Google, Bing, DuckDuckGo and YouTube, what each method actually covers, and - the part most articles skip - what SafeSearch fundamentally cannot do no matter how well you lock it.
SafeSearch On vs SafeSearch Locked: The Distinction That Matters
Answer first: turning SafeSearch on is a per-browser, per-profile, per-account setting stored on the device or in a Google account. Locking it means an outside authority - your router's DNS, a device management policy, or a parent-supervised account - imposes the setting and removes the child's ability to change it.
Here's why the difference is so easy to miss. When you flip SafeSearch on in Google's settings while signed into your own account, you've changed your account's preference. Your child signed into their own account, or browsing signed out, or using a different browser, or using a private window, gets a different profile and a fresh default. Nothing you did applies to them.
Even setting it directly on your child's account only holds until they open the settings page and turn it off. There's no password on it. A ten-year-old who can find the Settings link can undo it, and search-result pages usually put that link right there at the top.
So when you read "how to turn on SafeSearch", read it as step one of two. Step two is enforcement, and there are genuinely only a handful of ways to do it.
Turning Google SafeSearch On (Step One)
Google's SafeSearch has three states: Filter (hide explicit results), Blur (blur explicit images but show other results), and Off. Blur is the default for many signed-out users; Filter is what you want.
To set it manually:
- Go to
google.com/safesearchwhile signed in as the person you're setting it for - Choose Filter
- Repeat in every browser and every browser profile your child uses, signed in and signed out
That's the preference. On a shared family computer where nobody is signed in, this is stored as a cookie in that browser profile - which means clearing cookies, switching browsers, or opening a private window resets it. It is genuinely useful for reducing accidental exposure in a household of cooperative people. It is not a control.
Google itself distinguishes the two: their documentation for schools and families covers "SafeSearch" and separately covers forcing SafeSearch through network settings and account management. The next three sections are the forcing part.
Enforcement Route 1: The forcesafesearch DNS Method
This is the strongest, cheapest and most widely used way to lock Google SafeSearch, and it covers every device on your home network at once - phones, tablets, consoles, laptops, guests.
Google operates a special address that always returns SafeSearch-filtered results. If your network resolves www.google.com to that address instead of the normal one, every Google search from every device on the network comes back filtered, and there is no setting on the device that turns it off. The child can open the SafeSearch preference page and switch it to Off; the results stay filtered, because the filtering isn't happening on their machine.
The hostname to map Google's domains to is:
forcesafesearch.google.com
Confidence: high. This is Google's documented, long-standing hostname for this purpose, and it's the one router and DNS vendors implement against.
How you apply it depends on what you have:
On a router or DNS server that supports custom DNS entries. Create a CNAME record pointing www.google.com (and the country domains your family actually uses, e.g. google.co.uk) at forcesafesearch.google.com. Consumer routers vary wildly in whether they expose this; DD-WRT, OPNsense, pfSense and Pi-hole all do.
On a family DNS service. This is the easy route and what I'd suggest for most people. Filtering DNS providers - OpenDNS, CleanBrowsing and NextDNS among them - all have a single toggle along the lines of "Force SafeSearch", which applies this mapping for Google plus the equivalents for other engines automatically. You point your router's DNS servers at theirs once, tick the box, and you're done. No per-device work.
Do not hardcode the IP address. Some older guides list a specific IP for the SafeSearch VIP. Google can and does change these. Use the hostname; let DNS do its job.
One caveat worth knowing up front: this method breaks if the browser resolves names itself via DNS-over-HTTPS, or if the device is on mobile data. Both are covered in the bypass section below.
Enforcement Route 2: Family Link and Supervised Accounts
If your child has their own Google account and it's supervised through Family Link, you can enforce SafeSearch on the account itself, which follows them to any device they sign into - including one at a friend's house.
In the Family Link app, select your child, then open their content restrictions for Google Search. You'll find a Search filter setting with options roughly equivalent to "Filter explicit results" or "Don't filter". Set it to filter, and your child cannot change it from their side; the setting is greyed out or absent in their own Google settings.
What this covers: Google Search on any device where they're signed into the supervised account. That's a genuinely different coverage shape from the DNS method, which covers every device but only on your network.
What it doesn't cover: signed-out searching, a second Google account added to the browser, a different browser where they never signed in, and every non-Google search engine. Family Link on a Chromebook is much tighter than Family Link on a shared Windows PC, because Chrome OS can be locked to that one account - see our Chromebook parental controls guide for the settings that close the guest-mode and secondary-account gaps.
Google renames and reorganises Family Link menus fairly often. If the wording above doesn't match what you see, look under Controls > Content restrictions > Google Search, and check Google's own Family Link help pages rather than trusting any third-party screenshot including mine.
Enforcement Route 3: Chrome Policy (ForceGoogleSafeSearch)
If you manage the computer itself, Chrome has a policy that forces SafeSearch on regardless of what the user or the account says. The policy name is:
ForceGoogleSafeSearch
Confidence: high. This is the current Chrome enterprise policy for Google SafeSearch. Set to enabled, Chrome appends the SafeSearch parameter to Google searches and the user cannot override it.
There's a companion policy for YouTube:
ForceYouTubeRestrict
Confidence: high on the name; it takes a numeric value where 0 is off and higher values apply moderate and strict Restricted Mode. Check Chrome's policy documentation for the exact value mapping before you set it rather than guessing.
On Windows these live under the Chrome policies key in the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome - confidence: high on the path), and are far easier to set through the official Chrome ADMX templates in Group Policy than by hand. On macOS they're applied as a configuration profile. Both routes are documented in Chrome's enterprise policy list, which is the source I'd point you at rather than reproducing a registry recipe here.
Microsoft Edge has an equivalent policy for forcing Bing SafeSearch. I'm not confident enough in the exact name to print it, so look it up in Microsoft's Edge browser policy reference - search that page for "SafeSearch" and you'll find it in seconds.
The honest limitation of browser policy: it applies to that browser. Install Firefox, and it's gone. Policy-based enforcement is worth doing on a managed family computer, but treat it as a layer, not the answer.
Bing and DuckDuckGo: Locking One Engine Is Not Enough
This is where most SafeSearch guides quietly fail. A child who can't get unfiltered results from Google will type their query into Bing instead. It takes them one attempt to discover this. If Google is locked and nothing else is, you've filtered one search box out of several.
Bing has three SafeSearch settings - Off, Moderate (filters explicit images and video, not text) and Strict (filters all explicit results). Strict is the equivalent of Google's Filter. Set it at Bing's settings page. For enforcement, Bing supports a network-level forcing hostname the same way Google does:
strict.bing.com
Confidence: high. Point www.bing.com at this via a DNS CNAME and Bing returns strict-filtered results for everyone on the network. This is also what the "Force SafeSearch" toggle in filtering DNS services applies on your behalf.
DuckDuckGo has a safe search setting with Strict, Moderate and Off, and also supports enforcing it at the network level by resolving its domain to a dedicated safe-search host. DuckDuckGo documents the exact hostname in their help pages - I'd rather you copy it from there than from me, because I'm not confident enough in the current value to print it as fact. If you use a filtering DNS provider, their SafeSearch toggle likely handles DuckDuckGo too; check their feature list.
And then there's everything else: Yahoo, Ecosia, Brave Search, Startpage, Yandex, and the search box built into the browser's address bar pointed at whatever default the child picks. You cannot chase them one at a time. This is the single strongest argument for enforcing at the network or device level rather than engine by engine - a filtering DNS service covers the majors and blocks adult domains outright, and a system-level allowlist doesn't care which search engine is involved because unapproved sites don't load regardless of how the child got to them.
YouTube Restricted Mode: How to Lock It, and an Honest Assessment
YouTube's Restricted Mode hides videos that YouTube's systems flag as potentially mature. Turning it on is a per-browser, per-profile setting: click your profile picture on youtube.com, scroll to Restricted Mode, and switch it on. Exactly like SafeSearch, it's a preference your child can reverse in two clicks.
To lock it, you have the same three shapes of enforcement:
Network level. YouTube publishes two hostnames for forcing Restricted Mode - one for Moderate and one for Strict - which you map www.youtube.com to via a DNS CNAME, exactly as with forcesafesearch.google.com. Confidence: high that both exist and that Google documents them; medium on my recall of the precise strings, so take them from Google's "Manage YouTube settings for your network" documentation or, far more simply, use the Restricted Mode toggle your filtering DNS provider offers.
Chrome policy. ForceYouTubeRestrict, described above.
Supervised account. Family Link's YouTube content settings for a supervised account.
Now the honest part, because Restricted Mode is routinely oversold. It filters by signals - creator self-ratings, age restrictions, community flags, automated classification, comment activity - not by anyone at YouTube reviewing each video against your family's standards. That means two things in practice. Unsuitable videos get through, especially content that's crude or upsetting rather than explicitly adult. And plenty of perfectly fine videos get hidden, including educational content on health, sexuality and violence in history, which is a real source of homework friction.
Restricted Mode also disables comments on videos, which is a meaningful benefit in its own right and probably the most reliably good thing it does.
Use it. It removes a large slice of obviously adult material and it costs nothing. But do not conclude from having it on that YouTube is now safe for a young child. If your goal is a genuinely curated YouTube, approved-channel viewing is a different mechanism entirely - our guide to blocking YouTube on a child's computer covers that route and where Restricted Mode fits alongside it.
Router and DNS-Level Enforcement for the Whole House
If you only do one thing from this article, do this one. Setting filtering DNS at the router applies SafeSearch enforcement to every device that joins your Wi-Fi, without installing anything on any of them, and it takes about fifteen minutes.
The mechanics: every time a device wants to load a website, it asks a DNS server to turn the name into an address. Change which DNS server your router hands out, and you change the answers every device on the network receives. A family-filtering DNS service uses that position to do three jobs at once - return the SafeSearch-forced addresses for the major search engines, refuse to resolve known adult domains at all, and apply YouTube Restricted Mode.
The setup is the same regardless of which provider you choose: log into your router (typically 192.168.1.1 or 192.168.0.1), find the DNS settings under WAN, Internet or LAN configuration, replace the DNS server addresses with the ones your provider gives you, save, and reboot. Then enable the SafeSearch enforcement toggle in the provider's dashboard. Several providers offer a free family tier that's perfectly adequate for this.
Two limitations to plan around. Everyone in the house gets filtered results, adults included - which some families are fine with and others aren't. And it stops applying the second a device leaves your network, so a laptop on school Wi-Fi or a phone on mobile data is completely unaffected. Network filtering is the best-value layer available to a parent; it just isn't a portable one.
Comparison: Which Enforcement Method Should You Use?
| Method | Engines covered | Can a child undo it? | Difficulty |
|---|---|---|---|
| SafeSearch toggle in settings | One engine, one browser profile | Yes - two clicks, no password | Very easy |
| Filtering DNS at the router | Google, Bing, usually DuckDuckGo + YouTube | Not on your network, unless they change the device's DNS or use DoH | Easy |
| Manual DNS CNAME to forcesafesearch/strict.bing | Whichever you configure | Same as above | Medium - needs a capable router |
| Family Link supervised account | Google Search + YouTube, any device they sign into | No, while the account is supervised | Easy |
| Chrome policy (ForceGoogleSafeSearch) | Google + YouTube, in Chrome only | Not without admin rights - but another browser sidesteps it | Medium |
| macOS Screen Time / Windows Family Safety | Varies; often ties to one browser | Only with the parent passcode | Easy |
| System-level allowlist app | All of them - engine doesn't matter | Not without the parent password | Easy |
The pattern is the same one that shows up everywhere in parental controls: the further down the stack you enforce, the harder it is to defeat. A setting in a search engine is the top of the stack. The network and the operating system are the bottom.
How Kids Get Around Locked SafeSearch
Assume it will be tested - not because your child is devious, but because curiosity plus a friend with a suggestion is a normal childhood. Here's what actually happens and what closes each door.
| Bypass | Why it works | The fix |
|---|---|---|
| A different search engine | You locked Google; Yahoo, Ecosia and Startpage don't care | Filtering DNS at the router, which covers the majors and blocks adult domains outright |
| A different browser | Chrome policy applies only to Chrome | Enforce at the network or OS level; remove admin rights so new browsers can't be installed |
| Incognito / private window | Resets cookie-stored preferences instantly | Preference-based SafeSearch is worthless here; DNS enforcement is unaffected. You can also disable incognito mode |
| VPN or proxy app | Routes DNS and traffic outside your network entirely | Block VPN installs by removing admin rights; some filters block known VPN domains. See can a VPN bypass parental controls |
| DNS-over-HTTPS in the browser | Chrome and Firefox resolve names themselves, ignoring your router's DNS | Turn off "Use secure DNS" in each browser's security settings, and block known DoH resolvers at the router if it supports it |
| Image search on other sites | Reddit, Imgur, Tumblr, Pinterest and social apps have their own search | SafeSearch never covered these. Needs domain blocking or an allowlist |
| Phone on mobile data | Never touches your Wi-Fi | Manage the phone separately with iOS Screen Time or Family Link |
| A second Google account | Supervision applies to the supervised account only | Restrict sign-in to the managed account (straightforward on Chrome OS, harder elsewhere) |
Notice that the top two entries are defeated by the same fix, and that DNS enforcement survives four of the eight. That's the case for doing the router work even though it feels more technical than clicking a toggle. For the wider picture on this, how parental controls get bypassed goes through the same dynamic across every kind of control.
The Honest Limitation: SafeSearch Filters Search, Not the Internet
This is the most useful sentence in this article, and it's the one most guides bury under their setup steps: SafeSearch filters search results. It does not filter the internet.
A locked, forced, strict-mode SafeSearch does exactly one thing - it changes which links a search engine shows. It has no effect whatsoever on:
- A URL typed directly into the address bar
- A link clicked from a Discord message, a group chat, a forum post or a YouTube comment
- A bookmark
- Content inside an app that isn't a browser
- Any site reached from another site
- Adult sites, which remain fully accessible and load completely normally
If a child gets a link from a friend at school, SafeSearch is not in the story at all. It was never designed to be. It's a filter on a discovery mechanism, and discovery in 2026 is mostly not search - it's links from people and feeds.
So set SafeSearch up, and lock it properly, because it removes a real and meaningful amount of accidental exposure from ordinary searching, which is how a lot of younger children first encounter this material. Just be clear with yourself about what you've bought. If your goal is that adult content doesn't reach a child's computer at all, you need something that filters what loads, not what's listed: DNS-level adult-domain blocking as a minimum, and ideally an allowlist.
That difference is structural, not a matter of degree. A blocklist has to know a site is bad; an allowlist only has to know a site wasn't approved. 3Eyes takes the allowlist-first approach on Windows and Mac, enforcing at the system level across every browser - which means the search engine your child chooses is irrelevant, because an unapproved destination doesn't load however they arrived at it. If you've already found SafeSearch coming undone, or you're dealing with the aftermath of a discovery, our guide on what to do when you find out your kid watched porn covers the conversation side, which matters more than any of this.
A Sensible Order to Do This In
If you want a plan rather than a menu:
- Set filtering DNS at your router with SafeSearch and YouTube Restricted Mode forced. Whole house, fifteen minutes, biggest single win.
- Turn off "Use secure DNS" in Chrome, Edge and Firefox on the children's computers, or step 1 leaks.
- Make your child's computer account a Standard user, not an Administrator. Almost every bypass in the table above needs admin rights.
- Supervise their Google account with Family Link if they have one, so Google Search and YouTube stay filtered off your network too.
- Decide whether search filtering is actually your goal, or whether what you want is control over what loads. If it's the latter, add device-level filtering or an allowlist - a laptop that leaves the house needs on-device enforcement regardless.
- Tell your child what you've set up and why. Transparent controls produce far less workaround energy than discovered ones.
Frequently asked questions
How do I lock SafeSearch so my child can't turn it off? Enforce it outside the browser. The three working routes are network DNS (map Google's domains to forcesafesearch.google.com, easiest via a filtering DNS service), a Family Link supervised Google account, or the Chrome ForceGoogleSafeSearch policy on a managed computer.
Why does SafeSearch keep turning itself off? It almost certainly isn't. SafeSearch is stored per browser profile and per account, so a different browser, a private window, cleared cookies, or signing out all present an unfiltered default. Nothing reset - you're looking at a different profile.
Does locking Google SafeSearch cover Bing and DuckDuckGo? No. Each engine has its own setting and its own enforcement hostname - Bing uses strict.bing.com. A child who can't use Google will simply switch engines, which is why network-level enforcement covering all of them beats configuring engines one at a time.
Is YouTube Restricted Mode enough to make YouTube safe for kids? No. It filters using automated signals and creator ratings rather than review, so unsuitable videos get through and plenty of harmless ones get hidden. It's worth enabling - it also disables comments - but treat it as a reduction in exposure, not a safe environment.
Can SafeSearch block adult websites? No, and this is the most common misunderstanding. SafeSearch only changes which results a search engine shows you. Any adult site typed directly, bookmarked, or reached from a link loads completely normally. Blocking sites needs DNS filtering or a device-level allowlist.
Does SafeSearch work on my child's phone? Only if the phone is on your filtered Wi-Fi, or the setting is tied to a supervised Google account. On mobile data with a signed-out browser, none of your home network enforcement applies. Phones need managing separately.
What's the easiest option if I'm not technical? Set a family-filtering DNS service at your router and turn on its Force SafeSearch toggle. It's one settings change on one device and it covers Google, Bing, YouTube and usually more, for every device in the house.
Related guides
- How Kids Bypass Parental Controls (and What Actually Stops Them)
- You Found Out Your Kid Watched Porn - What to Do Next
- How to Block YouTube on a Computer, Mac or Chromebook
If you'd rather not depend on the search engine cooperating at all, 3Eyes enforces an approved-sites allowlist at system level on Windows and Mac - $16.99/month or $169.90/year for up to 4 children, with a 14-day free trial.