Every filtering decision a school makes comes down to categories: named groups of websites your policy allows or blocks in one stroke. This page is a working tour of that taxonomy — the major category groups, what belongs in each, which ones K-12 schools typically block or allow, and how one domain can carry several labels at once. Bookmark it; it doubles as a reference for policy meetings.
A taxonomy sounds like an academic concern until you sit in the meeting where a district decides what ten thousand students can see. Nobody in that room can rule on websites one by one. What the room actually decides is category policy.
Good categories separate things schools treat differently — a sports-news site and a sports-betting site must not share a label. The taxonomy is precise enough that "block Gambling" never catches ESPN.
Categories cover the whole web — more than 120 million domains — rather than a known-bad list. A brand-new domain still lands somewhere, so there are no gaps a student can find before the list-maintainer does.
Sites change what they serve and attackers rotate domains weekly. Daily reclassification means yesterday's blog that became today's casino affiliate is caught — and hundreds of thousands of new registrations are screened each day.
"We block Adult, Weapons, Gambling and Self-Harm everywhere; we allow Streaming Media in high school only; we'll revisit AI Tools each semester." That sentence — the kind every district writes — is only possible because categories give it a vocabulary. Below, we walk the taxonomy in the order most policy discussions follow: always-blocked, security, judgment-call, and allowed-by-default.
A sample of the groups covered in the full 57+ category taxonomy. Color coding here follows K-12 convention: what is almost always blocked, what depends on grade and policy, and what typically stays open.
These map directly to what CIPA calls obscene material and content harmful to minors, plus the closely related harms no district debates. They are blocked for every grade, every building, every device.
Pornography, explicit nudity and obscene or tasteless material. This is the core of the CIPA technology-protection-measure requirement, and the category where classification accuracy matters most — a single miss is the call from a parent nobody wants.
Graphic violence, gore sites, and sites dedicated to weapons sales or glorification. Distinct from history or news coverage of conflict, which remains in allowed categories — the taxonomy separates depiction-as-content from reporting.
Sites promoting or selling illegal drugs, drug paraphernalia and substance misuse. Health-education material about drugs lives in health categories instead, so a class researching addiction science is not caught in the net.
Casinos, sports betting, lotteries and poker sites — increasingly relevant as betting brands market aggressively to young audiences. Fantasy-sports and games-of-chance edge cases get their own labels so policy can be precise.
Content that promotes or instructs self-harm, suicide or eating disorders. Most districts pair blocking with monitoring alerts on attempted access, turning a blocked request into a chance for a counselor to reach out.
Sites promoting hatred or violence toward groups based on race, religion, gender, orientation or nationality. Kept separate from news and opinion categories so current-events research stays possible while recruitment content stays out.
A second cluster of categories is blocked not because of what students would see but because of what the sites would do. Malware hosts, phishing pages and scam sites target school networks constantly, and students are the easiest way in.
Proxies and anonymizers deserve special mention. These are services whose whole purpose is to smuggle traffic past a filter, and they are the first thing a determined teenager searches for. Because new proxy domains appear daily, this category depends on daily updates and automatic classification of newly registered domains more than any other — a static list is obsolete within a week.
Category names are easy; keeping 120 million+ domains correctly labeled is the hard part. See the full breakdown on our database coverage page.
This is where district philosophy shows. None of these categories is required blocking under CIPA — the law does not mandate blocking social media, for instance — so each is a local decision, usually opening progressively from elementary to high school.
Commonly blocked through middle school and opened selectively in high school, where journalism, civics and media-literacy classes may need it. Some districts allow it for staff only.
The classic bandwidth-versus-learning tradeoff. Many schools allow video platforms with SafeSearch and restricted modes enforced, or open them only during certain hours.
Usually blocked on student devices during the school day, with exceptions for approved educational-game domains. Time-based rules handle after-school flexibility.
The newest branch: 16,000+ AI-tool domains in 18 categories, from essay writers to deepfake and companion-chat apps. Granular enough to allow approved tools and block the rest — see our AI tools blocklist for schools.
Blocked for younger grades; often allowed in high school where district-approved collaboration platforms are in daily instructional use.
Harmless in itself, distracting in a lab. Many districts leave it open for staff and high schoolers and close it for younger students rather than fielding endless exceptions.
A mixed bag by nature — homework help lives next to unmoderated discussion. Multi-category labeling and per-site exceptions do the fine slicing here.
Blocked for students in effectively every district; the category exists separately from adult content so the policy is explicit rather than incidental.
The largest share of the taxonomy is categories schools want open: education, reference, news, science, health, government, arts, sports. A filter that treats the web as guilty until proven innocent breaks instruction; the default posture for these groups is allow, with the blocked categories carved out on top.
This only works because domains carry multiple labels. Real websites are not one thing — a video platform is entertainment and instruction; a sports site may also take bets. Under multi-category classification, a domain is blocked if any of its labels is restricted for that user, and allowed only when its whole profile is clean for that grade band. That single design choice eliminates most of the over-blocking and under-blocking that gave school filters a bad name.
It also keeps exceptions rare. When a teacher requests an unblock, admins can see the full label set and understand instantly why the site was stopped — and whether an exception is safe.
A starting-point matrix drawn from common K-12 practice. Every district tunes its own policy — this is the baseline most begin from.
| Category group | Elementary | Middle school | High school |
|---|---|---|---|
| Adult, obscene, nudity | Blocked | Blocked | Blocked |
| Violence, weapons, drugs, gambling | Blocked | Blocked | Blocked |
| Self-harm, hate | Blocked | Blocked | Blocked + alerts |
| Malware, phishing, proxies | Blocked | Blocked | Blocked |
| Social media | Blocked | Blocked | Selective / class use |
| Streaming & video | Approved sites only | Restricted mode | Restricted mode |
| Games | Learning games only | Blocked in school hours | Often time-based |
| AI tools | Blocked | Approved tools only | Approved categories |
| Shopping | Blocked | Usually allowed | Allowed |
| Education, reference, news, health, gov | Allowed | Allowed | Allowed |
A taxonomy is only as good as its upkeep. Here is the lifecycle behind every label your policy relies on.
Roughly 300,000 domains are registered every day. Each is examined and classified as it appears, so tomorrow's proxy site or AI essay mill is labeled before students find it.
Sites change hands and change content — an expired blog becomes a casino affiliate overnight. Continuous re-classification catches drift so old labels don't become quiet holes in policy.
When a domain fits several groups, it keeps every applicable label. Your policy engine then applies the strictest relevant rule for each user, which is what makes grade-band nuance workable.
The refreshed category data flows to cloud and on-premise deployments alike each day, and category-level reports document exactly what was enforced — the evidence trail an E-Rate audit asks for.
Category lists can feel abstract. Here is the practical sequence districts follow to turn them into enforceable rules.
Adult and obscene groups, plus anything harmful to minors, blocked for everyone — that is the certification floor for E-Rate. Add the security cluster next; no one has ever regretted blocking phishing. This is the floor nobody debates.
Over-blocking has a real cost: it erodes teacher trust, buries IT in exception requests, and teaches students the filter is an obstacle. The taxonomy's granularity exists so you can be strict where it matters and generous where it doesn't.
Put a review date on the decisions. The AI-tools branch alone changes weekly. Districts that review category policy each semester make small adjustments; districts that don't make painful ones.
These categories drive our web filtering software for schools directly, whether deployed in the cloud or on-premise, and the same labels power SafeSearch handling, reporting and the AI-tools controls. See how deep the classification goes on database coverage, or check a plan on pricing.
The same labels that drive enforcement drive reporting — and category-level reports answer questions raw URL logs never could.
Show an E-Rate reviewer that adult, obscene and harmful-to-minors categories were blocked district-wide all year — one report instead of a forensic dig through logs.
See which categories dominate student traffic by building and grade band, spot a surge in attempted proxy use, and catch a new AI tool trending before it becomes a problem.
Named categories turn disputes into discussions: a parent hears "blocked as Gambling," a board hears "streaming is up 40% in middle school," and decisions follow evidence.
Far fewer than 57. Most districts actively decide on perhaps 15–20 category groups: the always-blocked set is enabled once and rarely touched, allowed categories need no action at all, and ongoing attention concentrates on the judgment calls — social media, streaming, games, AI tools. The breadth of the taxonomy exists so those decisions are precise, not so you have more switches to flip.
It keeps both labels, and policy applies the strictest one relevant to each user. A sports site that also offers betting carries Sports and Gambling; because Gambling is blocked for students, the site is blocked, while a purely sports site stays open. Multi-category classification is what prevents both the "block half the internet" and the "gambling site slipped through as sports" failure modes.
No. CIPA requires blocking obscene material, child sexual abuse material and content harmful to minors, alongside an internet safety policy, monitoring, and education on appropriate online behavior. Social media, games, streaming and AI tools are local policy choices. Many districts do restrict them, but that is an educational decision, not a federal mandate.
New registrations — around 300,000 per day — are screened and classified automatically as they appear, using the site's content and signals rather than waiting for user reports. That matters most in fast-churning categories like proxies, phishing and new AI tools, where a domain may only live for days. Labels then continue to be refreshed daily as sites evolve.
Yes. Local allow and block lists sit on top of the category data, so an exception takes effect immediately for your users while the underlying classification is corrected. Because every block names its category, teachers can report a miss precisely ("this museum site is labeled Games") instead of just "the internet is broken."
They do now. Generic categories can't distinguish an approved writing assistant from an essay mill, a deepfake generator or a companion chatbot — and those differences are exactly what school policy needs to act on. Our AI branch tracks 16,000+ tool domains in 18 categories and 165+ subcategories, updated daily, so AI access can be a policy rather than a coin flip.
Yes — policy attaches to grade bands, buildings and user groups, all drawing on the same taxonomy. An elementary campus, a high school and staff devices can each have their own profile, and reporting still rolls up district-wide so compliance evidence lives in one place.
We'll show you how the 57+ categories map onto the sites your students visit most — what gets blocked, what stays open, and where your current filter has gaps.