How to switch library web filters without disrupting patrons
Switching filters can look risky: a day of broken sites, confused desk staff and a gap in the CIPA record. None of that has to happen. This guide walks through the timing around your contract and the E-Rate year, an inventory of what the old filter does, moving your lists and rules, a test on one branch or network, the cutover for a DNS-based filter with a rollback plan, what to tell staff and patrons, and the first 30 days.
Switching to our hosted CIPA filter?
- One libraryFrom $99 a month per site, with help importing your old lists. See plans and prices
- A library systemA written quote within one business day, each option priced. Ask for a quote
- Check your starting pointSee which parts of CIPA you have in place before you change anything. Free CIPA readiness check
This guide is general information, not legal or E-Rate advice. Funding and legal statements come from USAC and the FCC, listed at the end of the page. The technical steps are written for a DNS-based filter. If you move to another kind of filter, the timing, inventory and communication steps still apply.
The switch at a glance
- 8 to 12 weeks beforeRead the old contract: end date, notice period, auto-renewal and export rights. Choose a switch window that lets the two filters overlap.
- 6 to 8 weeks beforeInventory what the old filter does, export the lists and write down every setting you rely on.
- 4 to 6 weeks beforeSet up the new filter with the same rules. Test it on one staff computer.
- 3 to 4 weeks beforeMove one branch or one network. Run it through normal opening hours with the old filter still in place everywhere else.
- 1 to 2 weeks beforeBrief staff, update the desk notes and the sign by the public computers, and set the rollback plan.
- Switch dayChange the DNS setting, run the test list, confirm the new filter sees the traffic.
- First 30 daysDaily checks in week one, weekly reviews after that, then file the records and end the old contract.
These durations are a planning guide, not a rule. A single library with one router can move faster. A system with many branches will move in waves.
Pick the date: contract, funding year and Form 486
Start with the old contract
The contract sets the earliest sensible date. Look for four things:
- End date and auto-renewal. Some filter contracts renew by themselves unless you give notice. Put the notice deadline in the calendar first.
- Notice period. Send the notice in writing, and keep the confirmation.
- Export rights. Check that you can take your allow and block lists and your reports with you.
- Your records after you leave. Ask how long the old vendor keeps browsing records, and ask for written confirmation of deletion when the contract ends.
Plan for a short overlap. Paying for two filters for a few weeks costs less than a day without one.
Keep the filter running every day of the funding year
E-Rate's funding year starts on July 1 and ends the following June. USAC says a library must be in compliance with CIPA before services start, and that USAC cannot pay discounts on services received during a period when the library is not in compliance. So the rule for switch day is simple: the library's computers move from one filter to the other with no unfiltered gap.
Form 486 and the CIPA certification
- A library that is its own billed entity certifies CIPA on FCC Form 486. A library in a consortium gives FCC Form 479 to the consortium's billed entity instead.
- Form 486 must be certified no later than 120 days after the service start date or 120 days after the date of the funding commitment decision letter, whichever is later. For funding year 2026, USAC gave October 29, 2026 as the deadline for a July 1, 2026 start with a decision letter dated on or before July 1.
- Form 486 can be filed early, before services start, if you have your decision letter, your services start in July, you can truthfully make all the certifications, and you file on or before July 31.
- For funding year 2027, which runs from July 1, 2027 to June 30, 2028, USAC says the Form 471 window opens in early 2027. The exact dates were not announced when we checked.
- From funding year 2028, the FCC has moved the CIPA certifications from Form 486 to the Form 471 application, in an order adopted on April 30, 2026 (FCC 26-30). Consortium leaders will collect Forms 479 before they certify the Form 471. Form 486 is still used until USAC's system is updated, and for commitments from earlier years.
What this means for your date
- You can switch in the middle of a funding year, as long as there is no gap. Keep the records of both filters for that year.
- A switch in spring gives the new filter a few weeks to settle before July 1, so the whole next funding year runs on one filter.
- Do not schedule the switch in the same week you certify. Certify with the filter that is running, and keep your file in order for both.
- Avoid your busiest weeks, such as the start of a school term, tax season or the summer reading launch. Switch day should be a quiet day with the right people in the building.
Our E-Rate FY2027 CIPA checklist and calendar and Form 486 guide have the details.
Inventory what the old filter does
A filter collects small decisions over the years. Staff rely on them without knowing they exist. Write them down before you change anything, branch by branch.
| Item | Where to look | What to write down |
|---|---|---|
| Profiles or zones | Old filter console | Each set of rules, such as adult public, teen, children, staff and Wi-Fi, and which computers or networks use it. |
| Blocked categories | Each profile | Category names and why each is on: CIPA, board choice or a past complaint. |
| Always-allow list | Each profile and system-wide | Every entry, with a note on why it is there if anyone knows. |
| Always-block list | Each profile and system-wide | Every entry and its reason. |
| Schedules | Time rules | Rules that change by hour or day, such as after-school limits. |
| Safe search and video settings | Profile options | Where safe search or restricted video modes are forced. |
| Adult disable | Desk procedure and console | How staff do it today, who can, how it ends and what is logged. |
| Block page | Console and desk signs | The wording patrons see and the contact it gives. |
| Reports | Console and your files | Which reports go to the board, the CIPA file or a funder, and how often. |
| Admin accounts | Console | Who can sign in, and who will need access to the new filter. |
| Things on each computer | Public and staff PCs | Agents, proxy settings, browser extensions and certificates from the old filter. |
| Lent devices | Device management | How lent laptops and tablets are filtered at home today. |
| Network settings | Router, firewall, DHCP and any DNS server | Current DNS servers, the public IP address of each line, and who can change them. |
| Other systems | PC booking, print and Wi-Fi sign-in | Anything that talks to the filter or depends on its sign-in page. |
Take screenshots of each settings page as well. A screenshot settles arguments about what the old filter did long after you can no longer sign in to it.
Export your allow and block lists
Your lists hold years of local knowledge: the county job portal that was blocked once, the database that needs a second domain to sign in. Export them early, while you still have full access.
Get them out
- Export each list as a file. Plain text with one entry per line, CSV or a hosts file are the easiest to move.
- If there is no export, copy the lists from the console and ask the old vendor for a file.
- Export per profile and per branch if the old filter kept separate lists.
Clean them up before you import
- Remove duplicates and dead entries. Sites that no longer exist only make the list harder to read.
- Reduce entries to the site name. A DNS filter decides by website, not by single page or video. An entry with a path, such as one page of a site, becomes the whole site. Decide whether that is what you want.
- Check wildcards and patterns. Some filters use special characters or patterns. Convert them to plain site names, or check how the new filter handles them.
- Question old blocks. Entries added after one incident years ago may now block a useful site. Ask why each block is there.
- Split system and local entries. In a library system, separate entries every branch needs, such as your catalog and e-resources, from local ones, such as the local school district.
Bring them into our hosted filter
You can upload your lists as a plain list, a hosts file or a CSV file, check the preview and then save. Or send them to us and we load them for you. Help with the router setting, list import and adjusting the rules during the first weeks is part of the plan.
Map your policy to the new filter
Category names differ between filters, and so do their edges. Map by intent, not by name: write what each old rule was meant to do, then find the setting that does it in the new filter.
| What the old rule was for | How it maps in our hosted filter |
|---|---|
| CIPA images: obscene, child pornography, harmful to minors | The CIPA preset with the Adult category on. |
| Stopping people from hiding traffic from the filter | VPN, Proxy and Anonymizers, on in the CIPA preset. Public encrypted DNS services and browser settings that skip the filter are blocked by default. |
| Revealing but not explicit images | Lingerie, Swimsuits and Intimate Apparel, optional and off by default. |
| Board choices such as gambling or weapons | Optional categories you switch on per profile. |
| Stricter children's rules | A children's profile that adds categories, forces SafeSearch and turns on YouTube Restricted Mode. |
| Rules that changed by time | Time schedules in your own time zone. |
| Rules by user login | A DNS filter does not see who signed in. Use rules per network, or an encrypted link set on chosen computers. |
| Adult override codes | A staff PIN per branch for 15, 30 or 60 minutes, a per-PC bypass on request, or patron self-unblock on adult computers. |
| Rules for single pages or keywords | Not possible in a DNS filter. Decide whether the whole site should be allowed or blocked. |
| Your own lists | The always-allow list, which beats any category, and the always-block list. |
When a category does not map cleanly, test real sites. Our website check shows how a site is categorized, so you can see before switch day whether a site your patrons use will be blocked.
Do not use the switch to change the policy
Move the rules you have first. If the board wants to block more or less, make that a separate change after the new filter has settled. Two changes at once make it impossible to tell whether a complaint comes from the new filter or the new policy.
Test on one branch or one network first
Never let the public be the first to notice a change. Test in three rings: one staff computer, one network or branch, then the rest.
- One staff computer. Point a single staff computer at the new filter and run the test list. With our hosted filter, this is an encrypted test link in one browser, so nothing on the network changes.
- One network or branch. In a single library, move one network first, such as the staff network or the adult public PCs. In a system, choose one busy branch with a children's area and one small branch. Start it on the normal monthly plan.
- Normal opening hours. Run the test network through busy days, an after-school rush and a weekend, with the old filter still in place everywhere else.
- Review and adjust. Look at blocked sites, desk requests and staff feedback. Fix the lists, then repeat the test list.
- Decide. Move the rest, adjust the setup, or stop and set the router back.
The full test list for library networks is in our buyer's guide to choosing a library web filter. At a minimum, test a CIPA category, a VPN or proxy site, your catalog and e-resources, job and government sites, a children's computer, the adult disable and a phone on patron Wi-Fi.
The cutover for a DNS-based filter
A DNS filter works by answering the website lookups of your network. The cutover is the moment your network starts sending its lookups to the new filter. On a typical branch it is one setting. The care goes into the order of the steps.
Before you start
- Know the branch's public IP address and whether it is fixed. Your internet provider can tell you. A fixed address is best.
- Have the person who can change the router or firewall on hand, with the admin password.
- Write down the current DNS settings and take a screenshot. These are your rollback values.
- Choose a time before opening or a quiet hour, and tell the desk.
The steps
- Register the address first. Our filter answers only the network addresses registered for your sites, so register the branch address before you change the router. In the dashboard this is one button on the Networks page, or we register it for you.
- Set the DNS servers. Enter the two filter addresses as the only DNS servers, main first and backup second. On many routers the setting is under Internet, WAN, LAN or DHCP. When it sits in the DHCP settings, the router hands the filter to every device that joins.
- Remove every other DNS server. Delete the internet provider's servers and any third entry. A device that can still reach another DNS server can go around the filter.
- If you run your own DNS server. Keep your computers pointed at it and set its forwarders to the two filter addresses. Remove other forwarders, and switch off any fallback to root servers.
- Close the side doors. If your network hands out DNS servers over IPv6 too, make sure those point to the filter or are switched off. If your firewall can, allow outgoing DNS only to the filter addresses.
- Let devices pick it up. Devices use the new DNS servers when they reconnect or renew their address lease. Restart the router or reconnect the public PCs, and ask staff to reconnect their laptops.
- Run the test list. On a public PC, a staff PC and a phone on the Wi-Fi. Check a computer that may have a fixed DNS address left on its network adapter.
- Confirm the traffic arrives. Check that the branch shows lookups and blocks in the dashboard, and tell us you switched. We confirm on our side.
Retire the old filter in the right order
Turn the old filter off only after the new one is confirmed. If the old filter is an appliance in the traffic path, leave it in place until the new filter has run a normal week. Then remove what it left on computers: agents, proxy settings, browser extensions and its certificates. Lent devices need the new filter's setting before the old software comes off. With our hosted filter each lent device gets a private encrypted link, locked with device management so borrowers cannot remove it.
The rollback plan
A rollback plan is written before switch day, not during it. It answers three questions: what makes us go back, who decides, and what exactly do we change.
| Question | Write down |
|---|---|
| What triggers a rollback? | For example: the catalog or e-resources do not load, many allowed sites fail, or a part of the network is not filtered at all. |
| What does not trigger one? | A single wrongly blocked site. Add it to the always-allow list instead. |
| Who decides? | One named person, such as the IT lead or the director, with a deputy. |
| What do we change? | The DNS values you wrote down before the switch, on the router, DHCP or DNS server. |
| Where does it leave us? | Filtered by the old filter, which is still running. Never roll back to an unfiltered network. |
| Who do we tell? | The desk, the new vendor with the time and the sites that failed, and the director. |
With our hosted filter, setting the DNS back ends filtering by it at once. That is why the old filter stays in place until the new one has run a normal week on each branch. Keep each branch's old settings on file until then.
Tell staff and patrons
Patrons notice little when the desk knows what to say. Expect most questions in the first week.
Desk staff
- The switch date and who to call that day.
- What a blocked site looks like now. On encrypted sites the browser shows a warning instead of the site.
- The new adult disable steps, the branch PIN and how it ends.
- How to ask for a site to be allowed, and how fast it happens.
IT and branch managers
- The rollback plan and the decision maker.
- The test list and where to record results.
- Who has admin access to the new dashboard.
- When the old filter and its software come off.
Patrons
- A short line on the sign by the public computers and on the Wi-Fi page.
- Where to ask if a site they need is blocked.
- Nothing to install, nothing to change on their own devices.
The board
- The date, the reason for the change and the cost.
- Any change to the policy text, for approval.
- The first month's report, after 30 days.
Desk lines you can use
When a patron sees a warning: "That warning means our filter blocked the site. If you need it for your work or research, tell us the name and we will help."
When an adult asks for access: "I can open that for you now. It stays open for the time I choose and then switches back on by itself."
When a site should not be blocked: "Thank you. I will ask for it to be allowed. It usually takes a few minutes."
Our library staff guide to filter requests has more scripts and a one-page desk card.
Update the internet safety policy and your CIPA file
Does the policy need to change?
Often it does not. A policy that describes what is filtered and how adults ask for access can stay as it is. It needs an update if it names the old product, describes steps that no longer exist, such as a specific login or override code, or promises reports the new filter produces differently.
For CIPA, USAC says additional public meetings are not necessary, even if the policy is amended, unless state or local rules or the policy itself require them. Check both before you skip a meeting, and record the board's approval of the amended text in the minutes. Our guide to the public library internet filtering policy has sample wording.
Keep the CIPA file complete
In a CIPA audit, USAC asks for the internet safety policy, proof of public notice and the hearing or meeting, proof of adoption, a description of the filter, a report or other documentation on the use of the filter, and copies of Forms 479 or 486. The documentation should show that the filter was installed and working during the funding year. After a switch:
- Add a dated note to the file: the switch date, the old filter, the new filter and the branches involved.
- Keep the old filter's reports up to the switch date. Export them before you lose access.
- Start the new filter's monthly reports and policy record from the first day.
- Replace the description of the filter with one for the new filter, and keep the old one for the earlier part of the year.
- Keep these records for at least 10 years after the later of the last day of the funding year or the service delivery deadline, as USAC requires.
Our guide to what USAC asks for in a CIPA audit lists each record.
The first 30 days
Check most often in the first week, when problems are easiest to fix. Often the fix is an entry on the always-allow list. A short routine finds them early.
| When | What to do |
|---|---|
| Day 1 | Run the test list at opening and at midday. Check the dashboard shows lookups from every switched network. Ask the desk at closing what patrons said. |
| Days 2 to 7 | Read the most blocked sites each morning and look for library staples, job, government and health sites. Add what belongs to the always-allow list. Check the adult disable log. |
| Week 2 | Check the children's computers still get the children's rules. Review every desk request and how long it took. Remove the old filter's software from computers once the new filter has run a normal week. |
| Weeks 3 and 4 | Run the full test list again. Compare blocks between branches in a system. A branch far from the others may have the wrong profile. |
| Day 30 | File the first monthly report and the policy record in the CIPA folder. Give the board a one-page summary. Confirm the old contract has ended and ask the old vendor to confirm deletion of your records. |
After the first month, a monthly check is enough: every open branch shows lookups, the bypass log looks normal, and allow requests that came from several branches go on the system list. Our Weathervane add-on turns the month into a board report, at $79 a month per library or $149 a month for a whole system.
Switching a library system
Move branches in waves after the test branches. For each one: register the address, test one staff computer, switch the router and check the branch appears with lookups next to the others. Keep each branch's old settings until it has run a normal week. Our page on web filtering for library systems covers branch standards and what to send for a quote.
Questions about switching filters
When is the best time to switch library web filters?
When your old contract allows it and you can overlap the two filters for a few weeks. A switch in spring lets the new filter settle before the E-Rate funding year starts on July 1, so the next year's records come from one filter. Avoid your busiest weeks and never leave a gap without a filter.
Do we have to tell USAC that we changed filters?
The USAC pages we checked do not describe a separate notice for a change of filter. In a CIPA audit USAC asks for a description of the filter and a report or other documentation showing it was installed and working during the funding year. If you switch mid-year, keep the records of both filters. Ask your E-Rate adviser if you are unsure.
Do we need a new public hearing to update the internet safety policy?
For CIPA, USAC says additional meetings are not necessary, even if the policy is amended, unless state or local rules or the policy itself require them. Check your state rules and your own policy, and record the board's approval of the change.
Will patrons notice the switch?
Allowed sites load as before. The look of the block page changes, and on encrypted sites a DNS filter shows a browser warning instead of the site. Tell desk staff in advance and put a short line on the sign by the public computers.
Can we bring our old allow and block lists?
Yes. With our hosted filter you can upload them as a plain list, a hosts file or a CSV file and check a preview before you save, or send them to us and we load them for you.
What if something goes wrong on switch day?
Set the DNS on the router back to the old values. With our hosted filter, filtering by it stops at once. Keep the old filter running until the new one has run a normal week, so going back returns the branch to a filtered state.
How long does the cutover take?
The router change is one setting. Devices pick up the new DNS servers when they reconnect or renew their network lease. Plan an hour at the branch for the change, a restart and the test list, outside opening hours or in a quiet hour.
What happens to lent laptops on the old filter?
If they carry the old filter's software, they need the new filter's setting before the old one is removed. With our hosted filter each device gets a private encrypted link, set by browser policy, a Windows setting or an Apple profile, at $0.10 per device a month or $1 a year, minimum 25 devices.
Sources
- USAC, E-Rate Get Started: the funding year starts on July 1 and ends the following June: usac.org/e-rate/get-started/
- USAC, Starting Services: CIPA compliance before services start, no discounts for periods of non-compliance, early filing of Form 486: usac.org/e-rate/applicant-process/starting-services/
- USAC, FCC Form 486 Filing: the 120-day deadline: usac.org/e-rate/applicant-process/starting-services/fcc-form-486-filing/
- USAC, CIPA: Form 479 and Form 486, amendments to the policy, audit documentation and record retention: usac.org/e-rate/applicant-process/starting-services/cipa/
- USAC, E-Rate announcements: the FY2026 Form 486 deadline of October 29, 2026 and the FY2027 Form 471 window in early 2027: usac.org/e-rate/resources/announcements/
- FCC, Report and Order and Order on Reconsideration, FCC 26-30, adopted April 30, 2026, released May 1, 2026, paragraphs 57 to 62 on eliminating Form 486 from funding year 2028: docs.fcc.gov/public/attachments/FCC-26-30A1.pdf
Checked on 2 November 2026. Dates and forms change, so confirm with USAC or your E-Rate adviser before you file.
Plan your switch with us
We register your network, import your old lists and adjust the rules with you in the first weeks. One library from $99 a month per site. A library system: a written quote within one business day.