In short
A school web filter test checks that your filter blocks illegal and inappropriate content on every device, profile and connection. Start with SWGfL's free Test Filtering tool at testfiltering.com, then test each user profile, site, guest Wi-Fi, off-site devices and bypass routes, and record when, who, what was tested and the actions taken.
Get a quote for a school filtering review
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why schools need to test their web filter
The DfE's filtering and monitoring standards treat checking as part of the job, not an optional extra. Checks to your filtering provision need to be completed and recorded as part of your annual filtering and monitoring review, and how often they happen should depend on your school's context and the risks your review identifies. The DfE says checks should confirm that the set-up has not changed or been deactivated, and should cover:
- school- or college-owned devices and services, including laptops, tablets and audio-visual equipment, even when they are taken home
- every location, if you have buildings or schools on different premises
- user group accounts, to confirm students, staff and guests each get the right filtering
The UK Safer Internet Centre adds that checks should happen at least annually, when significant changes take place (technology, policy or legislation) and in response to incidents. Both expect a written record. A test you cannot show an inspector or governor is a test that did not happen, as far as your review is concerned.
For the standards themselves, see our sister site's guide to the DfE filtering and monitoring standards. This page is about the practical testing.
SWGfL Test Filtering: what it is and what it checks
The tool most schools start with is Test Filtering at testfiltering.com. It was developed by the charity SWGfL, a partner in the UK Safer Internet Centre, and both the DfE standards and the UK Safer Internet Centre point schools to it. The DfE suggests using a testing tool such as SWGfL's to check that, as a minimum, your filter blocks illegal child abuse material, unlawful terrorist content and adult content.
The clever part is that nobody has to visit harmful material. SWGfL works with partners to place harmless test pages on the block lists filters use, and the tool tries to load them from your device in the background. If a page loads, that category is probably not being blocked.
| Test | What it checks |
|---|---|
| Child abuse content | Whether the Internet Watch Foundation (IWF) URL list is active on your connection, using a test page placed on that list |
| Terrorist content | Whether the UK terrorist content (CTIRU) list is active, using a test page on that list |
| Adult content | Whether pornographic websites are reachable, using a test page hosted on an adult website |
| Offensive language | Whether your filter blocks a page that contains profanities |
| Decryption and real-time content | Test pages SWGfL lists for checking whether your filter can inspect encrypted pages and judge content as it loads |
| Encrypted Client Hello (ECH) and HTTP/3 | Pages SWGfL describes that report whether the connection used ECH, which hides the site name from network filters, and HTTP/3, which runs over UDP rather than TCP |
SWGfL is candid about the limits: the results are an indication, not a full assessment. The tool checks whether its own test pages are reachable, which suggests whether filtering is in place for each category, but it does not measure how effective your filter is across all content.
A note for DNS filters. A DNS filter makes its decision on the domain name, so it cannot read a page's words or decrypt it. SWGfL says its decryption test needs a root certificate or managed browser extension on the device. If your school relies on DNS filtering, expect the page-level tests to tell you about the layer you have, and discuss the result with your provider rather than assuming a fault. Our guide to DNS filtering vs URL filtering explains the difference. The IWF and CTIRU results are different: the DfE says those blocklists must be in place, so treat a failure there as urgent.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How to run a school web filter test, step by step
One test from the IT office proves very little. A useful school web filter test covers each way pupils, staff and guests get online:
- List what you need to test. Every site, each user profile (students by key stage or year group if you have them, staff, guests), each device type (Windows, Mac, iPad, Chromebook) and each connection, including backup lines and portable Wi-Fi devices.
- Run Test Filtering signed in as a student, on a school device, on the main school network. Repeat for each student profile.
- Repeat as a member of staff. Staff profiles are usually more open, but the IWF and CTIRU lists should still be blocked.
- Test guest Wi-Fi and BYOD, where the DfE expects filtering to apply and devices the school does not manage to sit on a separate virtual network.
- Take a school laptop or Chromebook home and test on a home connection. If it is not filtered there, the roaming or Chromebook client is missing or broken; see DNS roaming clients.
- Check apps, not just browsers, on tablets and phones the school owns. The UK Safer Internet Centre asks schools to test across installed apps and in different physical locations.
- Check safe search by searching in Google, Bing and YouTube on a student account and confirming the safe results are enforced and cannot be switched off.
- Check the logs. Find the test attempts in your filter's reports and confirm they show the device or user and the time, as the DfE expects.
If anything fails, the SWGfL FAQ suggests repeating the test on another device on the same connection to confirm the result, then raising it with your filtering or IT provider.
Test the bypass routes too
A filter that passes the SWGfL tests can still be easy to get round. The DfE asks schools to check with their provider that the filter blocks technologies and techniques that let users get around it, such as VPNs, proxy services and end-to-end encryption methods, and the UK Safer Internet Centre lists DNS over HTTPS and Encrypted Client Hello among the circumvention methods schools should handle. With your IT support, check:
- Other DNS servers. From a student device, can a lookup reach a public DNS resolver directly? It should be blocked at the firewall.
- Browser secure DNS. Is DNS over HTTPS turned off, or locked to your filter, in managed browsers? See secure DNS and should you block DNS over HTTPS?
- VPN and proxy services. Are the VPN, proxy and filter-avoidance categories blocked, and can pupils install VPN apps?
- Other browsers and extensions. Can a pupil install a browser or extension that ignores your settings?
- The roaming client. Can a pupil switch off or uninstall the filter client on a school laptop?
- Encrypted Client Hello and HTTP/3. Check the ECH and HTTP/3 results from Test Filtering with your provider. SWGfL notes that a school in control of the DNS resolver can strip ECH records from responses, and that HTTP/3 over UDP port 443 can be disabled to keep filtering consistent.
Our general DNS security test guide has more detail on checking which resolver a device is really using.
Is a school filtering review the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Record the results for your annual review
The DfE says you should keep a log of your checks and record when the check took place, who did it, what they tested or checked, and the resulting actions. The UK Safer Internet Centre also suggests recording the location, device and user alongside the result. A simple table works:
| Date | Who | Site and connection | Device and profile | Test | Result | Action and owner |
|---|---|---|---|---|---|---|
| (date) | (name and role) | Main site, school Wi-Fi | Chromebook, Year 8 student | Test Filtering, all categories | (pass or fail per category) | (what was done, by whom) |
| (date) | (name and role) | Home broadband | Staff laptop, staff profile | Test Filtering and DoH check | (result) | (action) |
Test Filtering lets you download a certificate for your records if you add your organisation's details. SWGfL also sells TestFiltering+, a paid service that runs the tests automatically through a Chrome browser extension on Windows, macOS and Chromebooks, emails you when a device fails, groups results by network and exports reports for auditing. SWGfL says it does not yet support Firefox, Safari or Chrome on Android. It can be deployed through Microsoft Intune or the Google Admin console, and a multi-academy trust can monitor several sites from one account.
When a test fails, and how we can help
A failed test is useful information. Work through it in order:
- Confirm it. Repeat on a second device on the same connection, and check the device was on the filtered network or had its roaming client running.
- Find the layer. Was it the DNS filter, a missing client, a backup connection that bypasses the filter, or a page-level test a DNS filter is not designed to pass?
- Raise it with your provider in writing, especially for IWF or CTIRU failures, and ask how and when it will be fixed.
- Tell the DSL so they can assess any safeguarding implications, and record the action in your log.
- Retest once fixed, and record that too.
Forever Systems can help IT leads and DSLs plan and run a filtering check, interpret the results, and fix the DNS side: resolver rules, roaming and Chromebook clients, encrypted DNS controls and staff and student policies. If your current filter cannot do what your review needs, we can set out the options in our web filtering for schools guide with you. Contact us to arrange a filtering review.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
How do I test my school's web filter?
Run SWGfL's free Test Filtering tool at testfiltering.com on a school device signed in as a student, then repeat it for each profile, site, device type and connection, including guest Wi-Fi and devices taken home. Check bypass routes such as other DNS servers, browser DNS over HTTPS and VPNs, and record every result.
What is SWGfL Test Filtering?
Test Filtering (testfiltering.com) is a free tool developed by the charity SWGfL, a UK Safer Internet Centre partner. It checks whether your connection blocks test pages placed on the IWF and CTIRU lists, an adult test page and an offensive language page, without anyone visiting harmful content. SWGfL says the results are an indication.
How often should a school test its web filter?
The DfE says how often depends on your school's context and risks, with checks recorded as part of a review at least once every academic year. The UK Safer Internet Centre suggests checking at least annually, after significant changes and in response to incidents.
What should a school do if its filter test fails?
Repeat the test on another device on the same connection to confirm it, work out which layer failed, raise it with your filtering or IT provider in writing, tell the DSL, record the action and retest once it is fixed. Treat IWF or CTIRU failures as urgent.
Why does my DNS filter fail some Test Filtering checks?
Some test pages check page content, such as offensive language, or whether your filter can decrypt traffic, which needs a root certificate or managed browser extension. A DNS filter decides on the domain name only, so discuss those results with your provider and check whether you need page-level filtering as well.
Still have a question about a school filtering review?
Ask us and a member of our team will reply by email.