Lock Google SafeSearch & Disable Blur Off

Step 1: DNS-Based SafeSearch Enforcement

The simplest way to enforce SafeSearch across your entire network is through CleanBrowsing DNS. When you use CleanBrowsing's Family Filter, SafeSearch is automatically enforced on Google, Bing, and YouTube.

Configure your router or device with the following DNS addresses:

Protocol	Primary	Secondary
IPv4	185.228.168.168	185.228.169.168
IPv6	2a0d:2a00:1::	2a0d:2a00:2::

For paid accounts, SafeSearch enforcement is enabled automatically when the Adult / Pornography filter category is active in your CleanBrowsing dashboard.

Step 2: How Google SafeSearch Works via DNS

CleanBrowsing enforces SafeSearch by resolving Google search domains to Google's SafeSearch VIP (Virtual IP). This forces all Google searches through SafeSearch regardless of user preferences.

When SafeSearch is locked via DNS:

• The SafeSearch toggle on google.com is locked to On
• The "Blur Off" option for explicit results becomes ineffective — even if the interface element is still visible, clicking it will not disable blurring
• Users cannot override these settings from their Google account preferences

This approach works across all browsers without requiring per-browser configuration.

Step 3: Enforce SafeSearch via Chrome Policy (Windows)

For additional protection on managed Windows devices, you can enforce SafeSearch through the Windows Registry:

Google Chrome:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
"ForceGoogleSafeSearch"=dword:00000001
"ForceYouTubeRestrict"=dword:00000002

Microsoft Edge:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
"ForceGoogleSafeSearch"=dword:00000001
"ForceYouTubeRestrict"=dword:00000002

Save the above as a .reg file and double-click to import, or deploy via Group Policy.

Google Admin Console (for managed Chromebooks):

1. Sign in to admin.google.com
2. Navigate to Devices → Chrome → Settings
3. Under Content, set SafeSearch and Restricted Mode to Always use SafeSearch

Step 4: Lock Bing SafeSearch

CleanBrowsing's Family Filter also enforces Bing SafeSearch at the DNS level by resolving Bing to its restricted endpoint. No additional configuration is needed if you are already using CleanBrowsing DNS.

For additional device-level enforcement on Windows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge]
"ForceBingSafeSearch"=dword:00000001

On managed networks, you can also add the following entry to your hosts file or DNS server to force Bing into strict mode:

# Force Bing SafeSearch
strict.bing.com  www.bing.com

Step 5: Enable YouTube Restricted Mode

CleanBrowsing's Family Filter enforces YouTube Restricted Mode at the DNS level. This prevents access to age-restricted content and hides comments on most videos.

For additional enforcement via browser policy:

• Chrome Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome → "ForceYouTubeRestrict"=dword:00000002 (value 2 = Strict, value 1 = Moderate)
• Edge Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge → "ForceYouTubeRestrict"=dword:00000002

You can also enforce YouTube Restricted Mode via DNS by adding a CNAME record for www.youtube.com pointing to restrict.youtube.com (Moderate) or restrictmoderate.youtube.com (Strict) in your local DNS server.

Step 6: Harden with Firewall Rules

To prevent users from bypassing DNS-based SafeSearch enforcement, block the following at your firewall:

• Alternative DNS servers: Block outbound UDP/TCP port 53 to all IPs except CleanBrowsing (185.228.168.168 and 185.228.169.168)
• DNS-over-HTTPS (DoH): Block connections to known DoH providers such as dns.google (8.8.8.8), cloudflare-dns.com (1.1.1.1), and mozilla.cloudflare-dns.com
• DNS-over-TLS (DoT): Block outbound TCP port 853 to all IPs except CleanBrowsing
• VPN and proxy services: Block known VPN endpoints and proxy services that could tunnel DNS queries

For detailed browser-level hardening, see our guides on hardening Chrome and hardening Edge.

Step 7: Verify & Test

After configuring SafeSearch enforcement, verify it is working correctly:

1. Google SafeSearch: Visit google.com/safesearch — it should show SafeSearch is locked
2. Bing SafeSearch: Go to bing.com/settings and verify SafeSearch is set to Strict and cannot be changed
3. YouTube: Open YouTube and check that Restricted Mode is active at the bottom of the page
4. DNS verification: Run nslookup -type=txt debug.cleanbrowsing.org to confirm you are using CleanBrowsing DNS

If SafeSearch is not enforced, clear your DNS cache and restart the browser.