Home / Insights / Web Filtering for Business: What Schools Get Right, and What Changes at Work

Web Filtering for Business: What Schools Get Right, and What Changes at Work

In schools and nurseries, web filtering and monitoring aren’t optional extras. They’re part of safeguarding. In business, filtering is often an afterthought: something left at the firewall’s default settings, or switched off because it once blocked a supplier’s website. Having worked in both worlds, I think web filtering for business deserves more thought, but it also needs a different approach from the one used in education.

This article looks at what education settings do well, why the goals change at work, and how to put sensible filtering in place without crossing into intrusive staff monitoring.

How filtering works in education

In England, the statutory guidance Keeping Children Safe in Education expects schools and colleges to have appropriate filtering and monitoring in place, and the Department for Education publishes filtering and monitoring standards to go with it. The UK Safer Internet Centre also publishes guidance on what “appropriate” looks like. Many early years settings follow a similar approach for any devices children or staff use.

In practice that usually means:

• Category-based filtering to block harmful and inappropriate content.
• Monitoring that flags concerning searches or activity so the right person can follow it up.
• Named responsibility, with senior leaders and the designated safeguarding lead involved, not just IT.
• Regular review and testing, so the filter is checked rather than assumed to work.

In my education roles, that meant tools such as a FortiGate firewall for filtering and Senso for monitoring, tied into safeguarding processes so alerts reached the right people.

Why the goals change in business

A business isn’t filtering to protect children. The main reasons are different:

• Security. Blocking known malicious, phishing and newly registered domains reduces the chance that one wrong click leads to an incident.
• Acceptable use. Setting clear boundaries for content that’s inappropriate in a workplace.
• Reducing risk from risky downloads and unapproved file-sharing or cloud services.

The biggest difference is privacy. Adults at work still have a reasonable expectation of privacy, and the Information Commissioner’s Office (ICO) has published guidance on monitoring workers. It stresses that monitoring must be necessary, proportionate and transparent, that staff should be told what is monitored and why, and that a data protection impact assessment is expected where monitoring is likely to be high risk. The detailed, individual-level monitoring that’s appropriate for safeguarding children would be hard to justify for most office staff.

What businesses can borrow from schools

The education approach still has lessons worth copying:

1. Write it down. Schools document what is filtered and why. A short web filtering and acceptable use policy does the same job at work and makes decisions consistent.
2. Give it an owner. In schools, safeguarding leads share responsibility. In business, someone outside IT, often HR or a director, should agree the policy, especially anything involving monitoring.
3. Test it. Check periodically that filtering is actually working, including on laptops used away from the office.
4. Review blocks and exceptions. A process for staff to request access to a wrongly blocked site stops people looking for workarounds.

Practical options for web filtering at work

• Firewall filtering. Most business firewalls include web category filtering. It’s effective on-site but doesn’t protect laptops on home or public Wi-Fi unless traffic is routed back through it.
• DNS filtering. Blocks known bad domains at the lookup stage. It’s lightweight, works wherever the device is when set up with an agent or managed settings, and is a good baseline for smaller organisations.
• Endpoint web protection. Many endpoint security products, including Microsoft Defender for Endpoint, offer web protection and content filtering on managed devices, which follows the device wherever it goes.
• Browser management. Managed browser settings and safe browsing features add another layer, particularly on shared devices.

Whichever you choose, aim for security-focused blocking first, a small number of clearly justified category blocks second, and only as much logging as you genuinely need, with retention periods set out in your policy.

Takeaway

Schools treat web filtering as part of a wider duty of care, with clear ownership, documentation and testing. Businesses can borrow that discipline while shifting the focus from content control to security, and keeping monitoring proportionate and transparent. Filtering works best alongside good phishing awareness, not instead of it. If you’re interested in how other habits carry over from education, see from safeguarding to continuity.

If you’d like help reviewing your filtering setup or writing a proportionate acceptable use policy, KPCR’s managed IT services and IT consultancy can help. Get in touch for a no-pressure chat.