Web filtering for library systems with many branches

What changes when you run many branches

In a system, most filtering problems come from drift. Each branch was set up at a different time, by different people, on a different router. A few years later nobody can say for sure what each branch blocks, which PIN works where, or whether the children's room in the newest branch got the same rules as the others.

• Many routers and lines. Branches may use different internet providers, and some have a second line for public Wi-Fi.
• One board, many buildings. The board adopts one internet safety policy, and every branch has to apply it the same way.
• A small central IT team. One or two people support every branch, often from another building.
• Staff turnover. PINs and desk procedures have to survive staff changes in each branch.
• Evidence from every branch. The CIPA file has to show that the filter worked in all of them, for the whole funding year.

The answer is not a stricter filter. It is one place to see and change every branch, and a short written standard for what must be the same everywhere.

One console, with each branch set up on its own

With the hosted CIPA filter, every branch is a site in one dashboard. Each branch keeps its own categories, always-allow list, always-block list and staff PIN. You enter the two filter addresses we give you on each branch's router or firewall, and every device on that network is filtered, with nothing installed on public computers.

A network inside a branch, such as a children's area, can also have lists of its own, on that network's page under Networks. A site on the always-allowed list beats every category, schedule, profile and SafeSearch. Changes apply within seconds, although some browsers keep an old answer for about a minute.

A system standard with branch exceptions

The simplest way to stop drift is to decide what is the same everywhere and what may differ, and write it on one page. This is a starting point to adapt:

Review the standard once a year with the director and branch managers, and after any change to the internet safety policy.

Adding a branch

1. Send us the branch's public address. A fixed public IP address is best. Include any second line, such as a separate line for public Wi-Fi.
2. We register it. We apply the CIPA preset and create the branch's staff PIN.
3. Test on one staff computer. Use the encrypted test link in one browser and try blocked and allowed sites, and the PIN.
4. Switch the router. Change the DNS setting on the branch router or firewall. Every device on that network is then filtered.
5. Check the sites table. Confirm the branch shows lookups and blocks next to the others.

If something looks wrong after the switch, set the router's DNS back to what it was. Filtering stops at once for that branch, and the others are not affected.

Name things so anyone can read them

Name each network by branch and area, for example Eastside public, Eastside children and Eastside staff. Keep a sheet with each branch's public address, internet provider, the person who can change its router, and who holds its PIN. It saves time the next time a line or a router changes.

Children's areas in every branch

CIPA leaves the decision on what matter is inappropriate for minors to the library or the authority responsible for it. In a system, make that decision once, so a parent gets the same answer in every branch.

The children's profile adds more categories, forces SafeSearch and turns on YouTube Restricted Mode. Most libraries reach the internet through one public address, so the filter cannot tell computers apart by address. There are three ways to give a children's area its own rules:

• A separate network or line. If the children's area has its own network with its own public address, register that address and it gets its own rules automatically.
• An encrypted link on the children's computers. Set it once by browser policy, a Windows setting or an Apple profile. Those computers get the stricter rules wherever they are.
• Your firewall. Firewalls that send each internal network to a different encrypted link give every area its own rules with no work per computer.

Branches differ, so the method can differ too. A large branch with its own children's room may use a separate network. A small branch with two children's computers may use the link. The rules stay the same in both.

The staff bypass opens a whole network for the time chosen. That is why we suggest registering each children's area as its own network with no bypass, and sending adults who need a blocked site to the adult computers.

For age bands, category choices and wording for parents, see children's area internet filtering in public libraries.

Adult unblocking: the staff PIN and patron self-unblock

CIPA lets an administrator, supervisor or other person authorized by the library's certifying authority disable the filter during use by an adult, to enable access for bona fide research or other lawful purposes. USAC's own example for libraries is a sign-in page where the adult affirms that purpose. A system should handle these requests the same way in every branch.

The staff PIN, branch by branch

Each branch has its own PIN. Staff open the staff page, enter the PIN and choose 15, 30 or 60 minutes. Adult content opens for that network, VPN and proxy sites stay blocked, and the filter switches back on by itself when the time is up. In the dashboard, the Staff bypass page has the same buttons for each network, so central IT can start or end a bypass without the staff page.

• Change a branch's PIN when someone who knows it leaves. Other branches are not affected.
• Keep the same desk wording in every branch, so staff who cover several branches say the same thing.
• The Activity page shows the time and length of each bypass, without recording what the adult read.

Patron self-unblock

With patron self-unblock, the adult unblocks the website at the computer. The block page asks them to confirm that they are 17 or older and need the site for research or another lawful purpose, and one click opens it. It is a setting for each network, with four options:

On teen computers, only the extra categories your library blocks by choice can be opened, never adult content. VPN and proxy sites, phishing and malware, newly registered domains, your own block list and AI tools you block always stay blocked. The staff PIN keeps working next to patron self-unblock.

What we suggest for systems

Use option 2 on the adult and teen computers, so an unblock never reaches the next screen and ends at log-off. Add option 3 when your IT team manages the public computers with Group Policy. Choose between a timed unblock and one website at a time, depending on your policy. Staff computers usually keep the staff PIN. Make the same choices in every branch, so desk staff meet one process wherever they work.

Every unblock, by staff or by a patron, is listed on the Activity page, in the bypass log CSV and in the monthly report, with the time, the network or computer, and the length or the website. The filter does not record who the patron is. The full setup is in the patron self-unblock guide, and the desk side in CIPA adult unblocking in libraries.

Branch reporting

In a system, reports answer two questions: is every branch filtered, and is the policy followed in each one? The dashboard keeps the same records for every branch.

A monthly routine for the system administrator

1. Open the sites table. Every branch that was open should show lookups. If one shows none, check its router's DNS setting and its internet line.
2. Compare blocks between branches. A branch far above or below the others may have a different profile than the standard, or a network registered to the wrong rules.
3. Read the bypass log. Look for bypasses on networks that should not have them, such as a children's network.
4. Review allow requests. If several branches asked for the same site, add it to every branch as part of the system standard.
5. File the records. Save the activity report and policy record for each branch with the funding year's CIPA file.

Weathervane board reports for the whole system

Weathervane turns the activity the filter already sees into a board-ready PDF with your logo. For library systems it costs $149 a month or $1,490 a year for the whole system, with every branch side by side and a report for each network. Customization and changes to the report are included.

• Branches and networks. Use, blocks and unblocks for each branch or network, so the board sees every location side by side.
• What the internet was used for. Sixteen purposes, such as learning, jobs, government services, health and library e-resources, each with the change against the month before.
• When people were online. A heat map by day of the week and hour, for staffing, opening hours and maintenance windows.
• A CIPA record. A checklist of the requirements with your evidence, the filtering policy on record and the latest staff and patron unblocks.
• Delivery. The report for the month before arrives by email on the first day of each month. Private links for board members open without a sign-in.
• Privacy. The filter sees which websites devices look up, not who uses a device. Reports show totals by service, purpose, time and network, never a person.

Systems use it for the monthly board pack, for branch hours and staffing, for deciding which databases and e-book services to renew, and for grant applications that need real figures. In the dashboard you can pick any period, for one network or all of them, and export to Excel or CSV. See what is in the Weathervane report.

E-Rate filing for library systems and consortia

A library system files E-Rate in one of two roles, and the CIPA paperwork follows from that role. The filter itself is not paid by E-Rate: the FCC has held that E-Rate discounts cannot be used to buy the technology protection measure CIPA requires, so it is paid from another source, such as the library's own budget.

A library system applying for its own branches

• In USAC's E-Rate Productivity Center, the library system is the parent entity, and its branches are child entities on the system's forms.
• Each branch uses the discount of the system's main branch or main administrative office, which comes from the public school district where it is located.
• The CIPA certification is made by the Administrative Authority. For a library, that may be the library, the library board or another authority responsible for running it.
• When the Administrative Authority is also the Billed Entity, it certifies CIPA on FCC Form 486. No Form 479 is needed.
• Form 486 is due 120 days after the service start date or 120 days after the funding commitment decision letter, whichever is later.

A consortium of libraries

• A library system cannot file as a consortium. It can lead one, with a second entity number and a second organization account in EPC for the consortium.
• Each member's Administrative Authority completes FCC Form 479 and gives it to the consortium leader. The form is not submitted to USAC, and USAC sends no receipt.
• USAC's consortia page says the leader collects Form 479 from each member every year before filing the Form 471, and the leader cannot complete the CIPA certification on Form 486 without them.
• No Form 479 is needed when the consortium requests only services to which CIPA does not apply, such as telecommunications services.
• A library cooperative may apply as a library, if it meets USAC's definition of a library consortium, or as a consortium of its members.

Records for every branch and member

For a CIPA audit, USAC lists the internet safety policy, proof of public notice and the hearing or meeting, proof that the policy was adopted, a description of the filter, reports or other records showing the filter was working during the funding year, and copies of Forms 479 and 486. Keep them for at least 10 years after the later of the last day of the funding year or the service delivery deadline.

With one console, the activity report and policy record for each branch or member come from the same place, in the same format. A consortium leader can send each member its own records for its own CIPA packet. Our guides on Form 479 for consortium members, Form 486 CIPA certification and what USAC asks for in a CIPA audit go further.

Getting a quote for several branches

One library can subscribe online. For a system, the quote form is quicker: tick the options you want, or Not sure yet, and we send a written quote within one business day, with each option priced separately.

List prices to plan with

What to send with the request

• The number of branches and their names.
• For each branch: its public IP address and whether it is fixed, the internet provider, and any second line.
• The areas you want kept apart: public, children's, teen, staff and guest Wi-Fi.
• How the public computers are managed, for example with Group Policy.
• How many laptops, tablets or hotspots you lend, if you want devices away from the network.
• Your current allow and block lists, so we can import them.
• Whether you want Weathervane for the whole system. Mention it in the message box.
• Your E-Rate role, as a system applicant or a consortium member, and when your funding year starts.

Start with one or two branches

Start with one or two branches on the monthly plan to see the filter on your own network before you add the rest. We set them up within one business day, and a monthly plan can be cancelled anytime. Staff test first, so the public is never the first to notice a change.

Pick the first branches

Choose one busy branch with a children's area and one small branch. Between them you will meet most of what the rest of the system will meet.

1. Short call or email. Tell us how many branches, public computers and staff you have, and how each branch connects to the internet.
2. We set up your account. We register the first branches' addresses, apply the CIPA preset and create a staff PIN for each.
3. Test on one machine. One staff computer uses the encrypted link first. Try blocked and allowed sites and the PIN unblock.
4. Switch the network. Change the DNS setting on the branch router. Every device on that network is then filtered.
5. Review together. We look at the activity, blocked sites and staff feedback with you, and adjust lists and categories.
6. Decide. Continue with more branches, change the setup, or stop. Changing the DNS setting back ends filtering at once.

What to watch in the first weeks

• Unblock requests at the desk, and the reasons patrons give.
• Sites staff asked to allow, and whether they belong in the system standard.
• Reports of sites that would not open, and how quickly they were fixed.
• Whether the children's area got the right rules on every children's computer.
• The time staff spent on filter tasks each week.

Roll out in waves

After the first weeks, move the remaining branches in groups. For each one: send the address, test one staff computer, switch the router and check the sites table. Keep a note of each branch's old settings until it has run a normal week on the new filter.

Related pages

• Web filtering for libraries
• Patron self-unblock: four ways to set it up
• Children's area internet filtering
• Library staff guide to filter requests
• FCC Form 479 for consortium members
• E-Rate for public libraries
• Library hotspot lending after the 2025 E-Rate change
• How to set up the hosted CIPA filter
• Weathervane board reports
• AI Controls for each network
• Switching library web filters
• How much does library web filtering cost?
• Presenting internet filtering to the library board

Sources for the legal and E-Rate statements

• 47 U.S.C. 254(h)(6)(D) and 254(l)(2), adult disabling and local determination of what is inappropriate for minors: govinfo.gov
• USAC, CIPA: requirements, the library sign-in example, Administrative Authority, Forms 479 and 486, and audit documentation: usac.org/e-rate/applicant-process/starting-services/cipa/
• USAC, Consortia: consortium roles, Form 479 collection and the rule that a library system cannot file as a consortium: usac.org/e-rate/applicant-process/before-you-begin/consortia/
• USAC, FCC Form 479 Filing: usac.org
• USAC, Library Consortia: usac.org
• USAC, Entity Numbers: library systems as parent entities and branches as child entities: usac.org
• USAC, Calculating Discounts: library system and branch discounts: usac.org
• USAC, FCC Form 486 Filing: the 120-day deadline: usac.org
• FCC, Report and Order FCC 24-76, paragraph 101, on E-Rate and the cost of technology protection measures: docs.fcc.gov/public/attachments/FCC-24-76A1.pdf

General information for library staff, not legal advice. Confirm current forms and deadlines with USAC and your E-Rate adviser.