Configure the strictest safe search settings for users when they access various search
Where can I use
What do I need?
Advanced URL Filtering license (or a legacy URL filtering
Legacy URL filtering licenses are discontinued, but
active legacy licenses are still supported.
Prisma Access licenses usually include Advanced URL
Transparent SafeSearch requires a
license running a minimum version of 4.1.
Many search engines offer a safe search setting that enables
you to filter out adult content from search results. Filter settings
. You can use the moderate setting
to filter out only adult images and videos or the strict setting,
which additionally filters out explicit text. Educational institutions,
workplaces, children, and adults all benefit from this safe search
functionality. However, allowing users in your network to configure
the safe search settings does not always provide the protection
To protect your network from adult-oriented content, you can
enforce the strictest safe search setting for all end users regardless
of their current individual settings. The strictest safe search
setting provides the safest browsing experience. First, select the
option in a URL Filtering profile.
Then, apply the profile to any Security policy rules that allow
traffic from clients in the trust zone to the internet.
Neither search engine providers nor Palo Alto Networks
can guarantee complete filtering accuracy. Search engines classify
websites as safe or unsafe. As a result, a website classified as
safe may contain explicit content. Palo Alto Networks enforces filtering
based only on search engine providers filtering mechanisms.
If users search using Bing, Yahoo, Yandex, or YouTube search
engines and they did not set their safe search setting to the strictest
setting, then your firewall responds in one of two ways.
prevents end users from seeing search results until they set their
safe search setting to the strictest available option. In this scenario,
the browser displays the URL filtering safe search
block page. This response page lets end users know why their search
results were blocked and includes a link to the search settings
of the search engine used for the search.
Palo Alto Networks no longer can detect whether Google SafeSearch is enabled due to changes in
the Google safe search implementation. As a result, the block method does
not work for Google searches. Instead, you can configure Google SafeSearch
using the methods described in Safe Search Settings for Search Providers.
firewall automatically and transparently enforces the strictest
safe search settings. Specifically, the firewall redirects search
queries to URLs that return strictly filtered search results and
changes the safe search preference for the search engine used. To
enable this functionality, replace the URL filtering safe search
block page text with the text specified in the procedure. The replacement
the strict safe search parameter for the search engine used for
The browser does not display the URL filtering
safe search block page when you use this method.
)—In cases where traffic cannot be decrypted (for
example, at a store that provides guest internet access) and you want to prevent
users with unmanaged devices, including display devices, from searching for
restricted, inappropriate, or offensive material, you can use transparent
SafeSearch in Prisma Access, which resolves mobile users' search engine queries
to the engine's SafeSearch portal by performing an FQDN-to-IP mapping.
Get started with safe search enforcement by reviewing the safe search settings of each supported
search engine. Then decide which enforcement method is best for your context.