Ofsted Online Safety Inspection: What Inspectors Look For and What to Show
Ofsted's renewed approach to school inspection brought report cards, a new toolkit and a safeguarding judgement of met or not met. Online safety, including how a school's systems protect pupils from online harm, sits inside that safeguarding judgement and touches several other areas.
This guide is for headteachers, DSLs, governors and IT leads in state-funded schools in England. It sets out where online safety appears in the toolkit and the everyday evidence that answers it.
Talk to us about your schoolShow pupils protected from online harm, school by school
Safeguarding is judged met or not met, so leaders need to explain their filtering plainly when asked. The hosted CIPA filter keeps each school's settings, lookups and blocks on one screen you can talk through.
- The console lists every school with its own category choices
- Lookups and blocks are counted, so you can say what the filter really did
- Staff overrides are logged and switch back by themselves
The evaluation areas, and where online safety fits in each
The state-funded school toolkit covers up to nine evaluation areas. Early years and post-16 apply only where a school has them. Online safety is most direct in safeguarding, but it appears elsewhere too.
Safeguarding
Protection from harm inside or outside the home or online, and information systems that protect pupils from online harm.
Direct linkPersonal development and wellbeing
Pupils learn to recognise online and offline risks, including the impact of viewing harmful content.
Direct linkAttendance and behaviour
Clear expectations on mobile phones, and policies reviewed for bullying and phone use.
RelatedLeadership and governance
Effective use of resources, including digital technologies, and governors who know their statutory duties.
RelatedInclusion
Support for pupils with SEND and others facing barriers, including how they are kept safe.
RelatedCurriculum and teaching
Online resources used in lessons need to be reachable; over-blocking can get in the way.
IndirectAchievement
Outcomes in tests and qualifications. Little direct link to filtering.
IndirectEarly years
Inspectors adapt how they talk about online safety for young children.
RelatedPost-16 provision
Older students with wider access, and the same safeguarding duties.
RelatedHow grading works, and why safeguarding is different
Most evaluation areas are graded on a five-point scale. Safeguarding is not. It is either met or not met, which means a weakness in online safety does not lower a grade; it can decide the safeguarding outcome.
Safeguarding met: the online safety angle
- An open culture where safeguarding is everyone's job, with strategic oversight of all of it
- Pupils are kept safe, feel safe, and know who to go to for support
- Teaching about staying safe is embedded across the curriculum
- Staff spot signs of concern and follow the school's systems confidently
- Leaders learn from incidents and act on what they find
Safeguarding not met: patterns to avoid
- Serious or widespread failures that leave pupils, or groups of pupils, unsafe
- Weaknesses found after an incident that leaders have not fixed
- Leaders who are not open to challenge or do not learn from issues
- Pupils who have little confidence that concerns will be dealt with
- Leaders unclear where pupils are when they are not on site
These points paraphrase the toolkit's met and not met descriptions, which were developed from KCSIE and Working Together to Safeguard Children. Read the current toolkit for the exact wording before relying on it.
Where online safety appears in the inspection toolkit
The toolkit rarely uses the word "filtering". It talks about outcomes: pupils protected from online harm, taught to stay safe and heard when something goes wrong. KCSIE and the DfE standards describe how filtering and monitoring deliver those outcomes.
| Toolkit point (paraphrased) | Evaluation area | How filtering and online safety evidence connects |
|---|---|---|
| Information systems safeguard pupils effectively from online harm | Safeguarding | Filtering and monitoring in place, reviewed yearly, with roles named as the DfE standards set out |
| Pupils are taught to stay safe and keep others safe, including online | Safeguarding | Online safety in the curriculum, matched to pupils' ages and needs |
| Protecting pupils from harm within or outside the home, or online, with an "it could happen here" attitude | Safeguarding | Staff training that includes online risk and how to report concerns |
| Staff understand sexual violence and harassment beyond school and online | Safeguarding | Policies on child-on-child abuse that include image sharing and online harassment |
| Awareness of increased risk for pupils with SEND and pupils who do not communicate verbally | Safeguarding | Filtering profiles and teaching adapted for pupils with SEND |
| Pupils recognise online and offline risks, including viewing harmful content | Personal development and wellbeing | A planned programme on online risks, with filtering seen as one protective layer |
| Clear expectations on mobile phones, communicated to pupils and parents | Attendance and behaviour | A phone policy that fits with what filtering can and cannot reach |
| The DSL carries out statutory duties, including the Prevent duty | Safeguarding | The DSL understands the filtering and monitoring in place, as KCSIE expects |
For what KCSIE asks, see KCSIE filtering and monitoring. For Prevent, see Prevent duty web filtering. For curriculum, see online safety in UK schools.
Questions inspectors may explore with different people
Inspectors gather evidence mainly through professional conversations and by seeing the school's day-to-day work. These are the kinds of topics that tend to come up. They are illustrations, not a script Ofsted publishes.
DSL
- What filtering and monitoring is in place, and how you know it works
- How alerts reach you and what you did with recent ones
- Which pupils are most at risk online and how you support them
Headteacher and senior leader
- Who is responsible for filtering and monitoring
- What the last annual review found and what changed
- How you balance protection with access for teaching
Governors
- How you are assured that systems meet the standards
- Which governor oversees filtering and monitoring
- How you challenge leaders on online safety
Teachers and support staff
- What to do if a pupil sees something harmful online
- How to report a site that is blocked or not blocked
- What training covered filtering and monitoring
Pupils
- Whether they feel safe, including online
- Who they would tell if something online worried them
- What they have learned about staying safe online
IT lead or business manager
- How devices off site are protected
- How changes to settings are recorded
- How concerns spotted in logs reach the DSL
Online safety evidence you already have, and should be able to find
The toolkit is clear that Ofsted does not need documents produced specifically for inspection. Inspectors look at what the school keeps for its statutory duties and normal business. For online safety, that usually means the items below.
The filtering and monitoring annual review checklist produces most of this evidence as a by-product. The DfE filtering and monitoring standards page explains each standard.
Reports and a policy record that already exist
Ofsted does not want papers made for the visit, so the filter's own activity reports, policy record and log export are the kind of everyday evidence that fits. They show what the system did, while the DSL's response stays with your own staff.
How inspectors adapt online safety questions by phase and need
The toolkit asks inspectors to consider how each area applies to different ages, phases and groups. For online safety that has practical effects on what a school should be ready to explain.
| Group | What the toolkit says | What a school might show |
|---|---|---|
| Early years and key stage 1 | Inspectors adapt their language about safeguarding and online safety to suit pupils' ages | Simple rules children can repeat, and tight filtering on shared devices |
| Pupils with SEND | Inspectors seek to understand specific vulnerabilities and how online safety teaching fits pupils' needs | Profiles by need, adapted teaching, and staff who know each pupil's risks |
| Pupils with SEND, personal development | Pupils may face risks linked to their age rather than developmental stage | Age-appropriate safety content delivered in accessible ways |
| Pupils not on site | Leaders should know where pupils are and show steps to keep them safe | Filtering on devices used in alternative provision or at home |
| Sixth form | Same safeguarding duties, with older students | A wider profile for study, with harmful and bypass categories still blocked |
For pupils with additional needs, read SEND pupils and web filtering.
Mobile phones, filtering and the behaviour evaluation area
The toolkit expects leaders to set clear expectations on mobile phones and communicate them to pupils and parents. That matters for online safety, because a phone on mobile data sits outside school filtering.
What school filtering can reach
- School-owned devices on the school network
- School devices off site, where filtering follows the device
- Personal devices on school wifi, if the policy allows them to join
- Guest and staff networks, if they are filtered too
What it cannot reach
- Personal phones using mobile data
- Home broadband on family devices
- Apps that use their own encrypted connections, unless the device is managed
- Content already downloaded to a pupil's phone
A phone policy and a filtering policy should tell the same story. If pupils may use phones on school wifi, see BYOD filtering in schools for how to cover them.
Apps pupils bring in, and how our data sorts them
A phone on mobile data sits outside the school filter, but the same apps are often opened on school devices too. These are the labels we hold for the names inspectors hear most.
| App site | Our categories |
|---|---|
| snapchat.com | Social Networking |
| tiktok.com | Social Networking, Streaming Media |
| discord.com | Email and Messaging, Social Networking, Gaming |
| roblox.com | Gaming |
| whatsapp.com | Email and Messaging, Social Networking |
A calm termly routine that keeps online safety inspection-ready
Since Ofsted does not want documents made for the visit, the best preparation is a routine that keeps real evidence current. Six habits cover most of it.
Each half term
The DSL reads a sample of filtering and monitoring reports with IT and notes any patterns or actions.
Each term
IT runs filtering checks on each device type and network, and records the results in the check log.
Each term
The online safety lead checks that teaching for each year group has happened as planned.
Each year
The senior leader runs the annual review with the DSL and IT, and reports to governors.
Each September
All staff training covers filtering and monitoring roles, and how to report concerns or wrong blocks.
After any incident
Leaders review what happened, update settings or teaching, and record the learning.
Online safety weak spots that inspection can expose
These are common patterns where a school has filtering in place on paper but the people inspectors speak to cannot explain it, or the evidence does not match.
The DSL cannot describe the filter
IT runs it, but the DSL does not know what is blocked or how reports work. KCSIE expects the DSL to understand it.
Review overdue
The last review was more than an academic year ago, or no one can find the record.
Staff unsure how to report
Teachers do not know what to do when a pupil sees something harmful or when a site is wrongly blocked.
Devices off site forgotten
Filtering works in school, but laptops and tablets used at home or in alternative provision are not covered.
Over-blocking hurts teaching
Teachers cannot reach resources for health, history or online safety lessons, and nobody has noticed.
Pupils unclear who to tell
Pupils can recite rules but cannot name a trusted adult for online worries.
To test your setup against common gaps before anyone else does, see the school web filter test.
Independent schools, academy trusts and the other UK nations
This page describes the toolkit for state-funded schools in England. Other settings follow related but different arrangements.
Independent schools
- Ofsted uses a separate independent schools toolkit for schools outside the associations
- Association schools are inspected by ISI
- See filtering in independent schools
Academy trusts
- Ofsted inspects each academy, not the trust
- Trust-level inspection has been announced, with reports suggesting it would not start before 2027 to 2028
- See filtering for multi-academy trusts
Wales, Scotland, Northern Ireland
- Ofsted inspects in England only
- Each nation has its own inspectorate and safeguarding guidance
- Check the current guidance where you are
How category data supports the filtering layer inspectors ask about
We supply website category data and a hosted DNS filter. Website category filtering is one layer of protection from online harm. Teaching, supervision, monitoring and the DSL's response to concerns are the others, and they stay with your school.
120 million domains
All of the 20 million most visited domains are categorised, covering 99.99% of web traffic and usage.
58 readable categories
Plain names such as Gambling or Violence make settings easy to explain to governors and inspectors.
Daily new domains
About 300,000 newly registered domains categorised every day, rechecked after a week and a month.
We do not supply the IWF or police-assessed terrorism lists; those come through filtering providers. Schools can use the hosted DNS filter, providers can license the category database, and anyone can check a site in the domain category checker.
Explaining your filtering to an inspector, with and without a hosted service
Each row is a question a leader might be asked in a professional conversation.
| The question | If you piece it together | With the hosted CIPA filter |
|---|---|---|
| What does the filter block for each age group? | Rules spread across several tools | Separate settings per school or branch in one console |
| How do you handle a wrong block? | An informal chat with IT | Always-allow and always-block lists, changed by you |
| Who can unlock adult material? | Whoever knows the admin login | Staff PIN for 15, 30 or 60 minutes, logged, then it switches back |
| What about laptops at home? | Depends on the device setup | A private encrypted link keeps the same rules off the network |
| Can pupils get round it? | Hope the proxy list is current | VPN / Proxy / Anonymizers blocked as a category, and public encrypted DNS blocked by default |
| Where is the proof? | Screenshots from last term | Activity reports, a policy record and a log export |
Ofsted online safety inspection: frequently asked questions
Does Ofsted check web filtering?
The toolkit asks inspectors to evaluate whether the school's information systems safeguard pupils effectively from online harm. Filtering and monitoring are central to that, and KCSIE and the DfE standards describe what appropriate looks like.
How is safeguarding graded under the new Ofsted report cards?
Safeguarding is judged as met or not met. Other areas use exceptional, strong standard, expected standard, needs attention and urgent improvement.
Which Ofsted toolkit is in use now?
For state-funded schools, version 2.0 updated in June 2026 is for use from 7 September 2026. Ofsted usually updates it each year, so check the current version.
Do we need to prepare an online safety file for Ofsted?
No. Ofsted does not need documents produced specifically for inspection. A current policy, annual review record and check log are usually what matters.
Will inspectors talk to pupils about online safety?
Inspectors gather evidence through conversations, and the toolkit asks whether pupils are taught to stay safe online and feel safe. With younger children, inspectors adapt their language.
Can a school share its own safeguarding audit with inspectors?
Ofsted's summary of changes for September 2026 says schools may share a safeguarding audit with inspectors but are not required to. If your annual filtering and monitoring review is part of that audit, it can help show how online safety is managed.
Will a weak filter on its own make safeguarding not met?
The toolkit links not met to serious or widespread failures, unresolved weaknesses after an incident, and leaders who do not learn from issues. A single gap is judged in context, but a gap that leaves pupils unsafe, or that leaders ignore, is a real risk to the outcome.
Do you provide monitoring that Ofsted expects?
No. We supply category data and a hosted DNS filter, not monitoring of messages or behaviour. Responses to concerns sit with the DSL and your safeguarding process. Our UK filtering and monitoring hub links to the wider guidance.
Related guides
A quote depends on how many schools and devices you run, and it reaches you within one business day. If you are preparing for a visit, a pilot on a single school can show the blocks and reports first.
Talk to us about your school
Preparing for inspection or tightening your filtering after a review? Tell us how your school filters today. We will explain where category data or the hosted filter fits, and where it does not.