Safe Search Enforcement

Advanced URL Filtering

Safe Search Enforcement

Table of Contents
End-of-Life (EoL)

Safe Search Enforcement

Configure the strictest safe search settings for users when they access various search engines.
Where can I use this?
What do I need?
  • Prisma Access
  • PAN-OS
  • Advanced URL Filtering license (or a legacy URL filtering license)
  • Legacy URL filtering licenses are discontinued, but active legacy licenses are still supported.
  • Prisma Access licenses usually include Advanced URL Filtering capabilities.
  • Transparent SafeSearch requires a
    Prisma Access
    license running a minimum version of 4.1.
Many search engines offer a safe search setting that enables you to filter out adult content from search results. Filter settings typically include
, and
. You can use the moderate setting to filter out only adult images and videos or the strict setting, which additionally filters out explicit text. Educational institutions, workplaces, children, and adults all benefit from this safe search functionality. However, allowing users in your network to configure the safe search settings does not always provide the protection you need.
To protect your network from adult-oriented content, you can enforce the strictest safe search setting for all end users regardless of their current individual settings. The strictest safe search setting provides the safest browsing experience. First, select the
Safe Search Enforcement
option in a URL Filtering profile. Then, apply the profile to any Security policy rules that allow traffic from clients in the trust zone to the internet.
Neither search engine providers nor Palo Alto Networks can guarantee complete filtering accuracy. Search engines classify websites as safe or unsafe. As a result, a website classified as safe may contain explicit content. Palo Alto Networks enforces filtering based only on search engine providers filtering mechanisms.
If users search using Bing, Yahoo, Yandex, or YouTube search engines and they did not set their safe search setting to the strictest setting, then your firewall responds in one of two ways.
  • Blocks Search Results When Strict Safe Search Is Off (
    )—The firewall prevents end users from seeing search results until they set their safe search setting to the strictest available option. In this scenario, the browser displays the URL filtering safe search block page. This response page lets end users know why their search results were blocked and includes a link to the search settings of the search engine used for the search.
    Palo Alto Networks no longer can detect whether Google SafeSearch is enabled due to changes in the Google safe search implementation. As a result, the block method does not work for Google searches. Instead, you can configure Google SafeSearch using the methods described in Safe Search Settings for Search Providers.
  • Forces Strict Safe Search (
    Supported for Yahoo and Bing search engines only
    )—The firewall automatically and transparently enforces the strictest safe search settings. Specifically, the firewall redirects search queries to URLs that return strictly filtered search results and changes the safe search preference for the search engine used. To enable this functionality, replace the URL filtering safe search block page text with the text specified in the procedure. The replacement text includes JavaScript code that rewrites search query URLs with the strict safe search parameter for the search engine used for the search.
    The browser does not display the URL filtering safe search block page when you use this method.
  • Transparent SafeSearch (
    Prisma Access Deployments Only
    )—In cases where traffic cannot be decrypted (for example, at a store that provides guest internet access) and you want to prevent users with unmanaged devices, including display devices, from searching for restricted, inappropriate, or offensive material, you can use transparent SafeSearch in Prisma Access, which resolves mobile users' search engine queries to the engine's SafeSearch portal by performing an FQDN-to-IP mapping.
Get started with safe search enforcement by reviewing the safe search settings of each supported search engine. Then decide which enforcement method is best for your context.

Recommended For You