Safe Search Settings for Search Providers
Focus
Focus
Advanced URL Filtering

Safe Search Settings for Search Providers

Table of Contents

Safe Search Settings for Search Providers

This table provides an overview of Google, Yahoo, and Bing’s safe search settings and our recommendations for enforcing safe search with each provider.
Where can I use this?What do I need?
  • Prisma Access (Managed by Strata Cloud Manager)
  • Prisma Access (Managed by Panorama)
  • NGFW (Managed by Strata Cloud Manager)
  • NGFW (Managed by PAN-OS or Panorama)
Notes:
  • Legacy URL filtering licenses are discontinued, but active legacy licenses are still supported.
  • Prisma Access licenses include Advanced URL Filtering capabilities.
Safe search settings differ for each search provider—review the following settings to learn more.
Search Provider
Safe Search Setting Description
Google/YouTube
Offers safe search on individual computers or network-wide through Google’s safe search virtual IP address:
Safe Search Enforcement for Google Searches on Individual Computers
In the Google Search Settings, the Filter explicit results setting enables safe search functionality. When enabled, the setting is stored in a browser cookie as FF= and passed to the server each time the user performs a Google search.
Appending safe=active to a Google search query URL also enables the strictest safe search settings.
Safe Search Enforcement for Google and YouTube Searches using a Virtual IP Address
Google provides servers that Lock SafeSearch (forcesafesearch.google.com) settings in every Google and YouTube search. By adding a DNS entry for www.google.com and www.youtube.com (and other relevant Google and YouTube country subdomains) that includes a CNAME record pointing to forcesafesearch.google.com to your DNS server configuration, you can ensure that all users on your network are using strict safe search settings every time they perform a Google or YouTube search. Keep in mind, however, that this solution is not compatible with Safe Search Enforcement on the firewall. Therefore, if you are using this option to force safe search on Google, the best practice is to block access to other search engines on the firewall by creating custom URL categories and adding them to the block list in the URL Filtering profile.
  • PAN-OS supports safe search enforcement for YouTube through HTTP header insertion. HTTP header insertion is not currently supported for HTTP/2. To enforce safe search for YouTube, App-ID and HTTP/2 Inspection downgrade HTTP/2 connections to HTTP/1.1 using the Strip ALPN feature in the appropriate decryption profile.
  • If you plan to use the Google Lock SafeSearch solution, consider configuring DNS Proxy (NetworkDNS Proxy) and setting the inheritance source as the Layer 3 interface on which the firewall receives DNS settings from service provider via DHCP. You would configure the DNS proxy with Static Entries for www.google.com and www.youtube.com, using the local IP address for the forcesafesearch.google.com server.
Yahoo
Offers safe search on individual computers only. The Yahoo Search Preferences includes three SafeSearch settings: Strict, Moderate, or Off. When enabled, the setting is stored in a browser cookie as vm= and passed to the server each time the user performs a Yahoo search.
Appending vm=r to a Yahoo search query URL also enables the strictest safe search settings.
When performing a search on Yahoo Japan (yahoo.co.jp) while logged into a Yahoo account, end users must also enable the SafeSearch Lock option.
Bing
Offers safe search on individual computers. The Bing Settings include three SafeSearch settings: Strict, Moderate, or Off. When enabled, the setting is stored in a browser cookie as adtl= and passed to the server each time the user performs a Bing search.
Appending adlt=strict to a Bing search query URL also enables the strictest safe search settings.
The Bing SSL search engine does not enforce the safe search URL parameters and you should therefore consider blocking Bing over SSL for full safe search enforcement.