How to set up the hosted CIPA filter

What you receive

When your account is ready, you receive four things. Keep the welcome email somewhere safe, because every step in this guide uses something from it.

A short test plan

Run these checks in the browser that has the test link. They show you exactly what patrons and students will see later, so you can explain it to staff before the switch.

1. A normal site opens. Open a site such as wikipedia.org. It loads as usual. Try your own website and the sites on your must-work list too.
2. An adult site is blocked. On a plain http site you see This website is blocked, with your name, the site and the reason.
3. Secure sites show a warning. Most sites use secure https. There the browser shows a security warning instead of the block page. This is normal for DNS filtering: the browser expected the real site and received the filter's answer. If you click past the warning, you only reach the block page, never the site.
4. Your lookups are recorded. Sign in to the dashboard and open Activity. Your lookups appear there, allowed and blocked, with the time and the category.
5. The staff page works. Open the staff page from your welcome email, type the Staff PIN, then click 15, 30 or 60 minutes. There is no need to press Enter. Changes take effect within about 15 seconds, so wait a moment, then open the adult site again in a new tab: it now loads.
6. The filter comes back. It switches back on by itself when the time runs out, or within about 15 seconds when you click Turn the filter fully back on. To check that the site is blocked again, close the browser and start it again first, then open the site: a browser keeps its connection to a website it has already used, even after the tab is closed, and while that connection lasts the website keeps working there without asking the filter again, so a new tab alone is not enough. You can check activity on the Activity page in the dashboard.

A line for the desk: "That warning means our filter blocked the site. If you need it for your work or research, tell us the name and we will help."

Write down the times. If any check gives an odd result, note the time and the site. With those two facts we can look up exactly what the filter answered.

How the staff bypass works

CIPA lets an authorized person disable the filter for an adult's bona fide research or other lawful purpose. The staff page does this with a PIN. Before staff use it, make sure everyone knows exactly what it opens and how it ends.

In the dashboard, the Staff bypass page has the same buttons for each network, so IT can switch a bypass on or off without the staff page. If your children's area has its own network, many libraries never use the PIN there and send adults to the adult PCs instead.

On request: a bypass for one PC

Libraries with several public PCs in one room often want the bypass on one computer only, and want it to end when the patron logs out. We set this up on request.

For the desk procedure and the records to keep, see CIPA adult unblocking in libraries.

Troubleshooting

Most problems in the first weeks come from computers that do not ask the filter at all. The checks below find the cause in a few minutes, and none of them needs us.

A few PCs cannot open a site that works everywhere else

For example, your library catalog or booking system works on most computers, but two or three PCs show an error such as "This site can't be reached". The filter gives every PC on the network the same answer, so when the site opens on the other PCs, the filter is not blocking it. Those few PCs are most likely not asking the filter at all. There are two usual causes.

Cause 1: the browser uses its own secure DNS service

Browsers can send their lookups to a secure DNS service of their own instead of the network. The filter blocks such services on purpose, because they would let anyone go around it. A browser that insists on one cannot look up sites, so pages fail to load. Switch the setting off in that browser:

Cause 2: a fixed DNS address left on the network adapter

A PC can keep a DNS address typed into its network adapter, often from an earlier filter or an old server. It then ignores the router and the filter. Set the adapter back to automatic:

1. Press Windows + R, type ncpa.cpl and press Enter.
2. Right-click the adapter in use, choose Properties, select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
3. Select Obtain DNS server address automatically and click OK. If Internet Protocol Version 6 (TCP/IPv6) also has a fixed DNS address, do the same there.
4. Open a command prompt and run ipconfig /all. Next to DNS Servers you should now see your router or the two filter addresses from your welcome email, or your own DNS server if your PCs use one. Anything else is a setting left on that PC.

On PCs that restore themselves on every restart, make the change in the saved image as well, or it comes back the next morning.

The nslookup check

One command tells you which DNS server a PC really asks. It takes ten seconds and works on every Windows PC.

C:\> nslookup wikipedia.org
Server:   UnKnown
Address:  192.168.1.1     <- your router: good

Non-authoritative answer:
Name:    wikipedia.org

Why the filter cannot treat some PCs differently

The filter knows your site only by its public address. All PCs behind your router share that one address, so the filter cannot tell one PC from another. It cannot block a site on some PCs and allow it on others, and it cannot fail on three PCs while answering the rest. When a site behaves differently on a few PCs, the difference is on those PCs.

Kiosk-mode PCs

Kiosk mode limits what a person can open on a PC, for example one browser and a list of allowed sites. It does not change how Windows looks up addresses: the PC still asks the DNS server in its normal network settings, like every other PC.

1. Sign in to the kiosk PC with an admin account, so you can open a command prompt.
2. Run the nslookup check and ipconfig /all. If the Server line is wrong, fix the adapter as in Cause 2.
3. If the kiosk uses an Edge list of allowed sites, check that it covers every part of the site. Many sites load from several subdomains, for example a separate name for sign-in or for images. An entry for the main domain covers its subdomains.
4. Open edge://policy on the kiosk to see whether a secure DNS policy is set there as well (Cause 1).

A change seems not to apply

Changes in the dashboard are live within seconds. Browsers, however, can keep an old answer for about a minute. Wait a minute and open the site in a new tab. If it still shows the old result, close the browser completely and open it again, or run ipconfig /flushdns in a command prompt to clear the PC's own memory of old answers.

Still stuck

Write to [email protected] and tell us:

• The exact time you tried, with your time zone.
• The site you opened.
• Which PC or network you used.
• What the browser showed. A screenshot helps.

We check those lookups on our side and tell you what the filter answered. If no lookup arrived at that time, the PC did not ask the filter, and we go through Cause 1 and Cause 2 with you.