Safe Search Settings for Search Providers
Focus
Focus

Safe Search Settings for Search Providers

Table of Contents
End-of-Life (EoL)

Safe Search Settings for Search Providers

Review the safe search settings for Google, Yahoo, and Bing and our recommendations for enforcing safe search on the providers.
Safe search settings differ for each search provider—review the following settings to learn more.
Search Provider
Safe Search Setting Description
Google/YouTube
Offers safe search on individual computers or network-wide through Google’s safe search virtual IP address:
Safe Search Enforcement for Google Searches on Individual Computers
In the Google Search Settings, the
Filter explicit results
setting enables safe search functionality. When enabled, the setting is stored in a browser cookie as
FF=
and passed to the server each time the user performs a Google search.
Appending
safe=active
to a Google search query URL also enables the strictest safe search settings.
Safe Search Enforcement for Google and YouTube Searches using a Virtual IP Address
Google provides servers thatLock SafeSearch (forcesafesearch.google.com) settings in every Google and YouTube search. By adding a DNS entry for
www.google.com
and
www.youtube.com
(and other relevant Google and YouTube country subdomains) that includes a CNAME record pointing to
forcesafesearch.google.com
to your DNS server configuration, you can ensure that all users on your network are using strict safe search settings every time they perform a Google or YouTube search. Keep in mind, however, that this solution is not compatible with Safe Search Enforcement on the firewall. Therefore, if you are using this option to force safe search on Google, the best practice is to block access to other search engines on the firewall by creating custom URL categories and adding them to the block list in the URL filtering profile.
  • PAN-OS supports safe search enforcement for YouTube through HTTP header insertion. HTTP header insertion is not currently supported for HTTP/2. To enforce safe search for YouTube, App-ID and HTTP/2 Inspection downgrade HTTP/2 connections to HTTP/1.1 using the
    Strip ALPN
    feature in the appropriate decryption profile.
  • If you plan to use the Google Lock SafeSearch solution, consider configuring DNS Proxy (
    Network
    DNS Proxy
    ) and setting the inheritance source as the Layer 3 interface on which the firewall receives DNS settings from service provider via DHCP. You would configure the DNS proxy with
    Static Entries
    for www.google.com and www.youtube.com, using the local IP address for the forcesafesearch.google.com server.
Yahoo
Offers safe search on individual computers only. The Yahoo Search Preferences includes three SafeSearch settings:
Strict
,
Moderate
, or
Off
. When enabled, the setting is stored in a browser cookie as
vm=
and passed to the server each time the user performs a Yahoo search.
Appending
vm=r
to a Yahoo search query URL also enables the strictest safe search settings.
When performing a search on Yahoo Japan (
yahoo.co.jp
) while logged into a Yahoo account, end users must also enable the
SafeSearch
Lock
option.
Bing
Offers safe search on individual computers or through their Bing in the Classroom program. The Bing Settings include three SafeSearch settings:
Strict
,
Moderate
, or
Off
. When enabled, the setting is stored in a browser cookie as
adtl=
and passed to the server each time the user performs a Bing search.
Appending
adlt=strict
to a Bing search query URL also enables the strictest safe search settings.
The Bing SSL search engine does not enforce the safe search URL parameters and you should therefore consider blocking Bing over SSL for full safe search enforcement.

Recommended For You