How to stop bypassing a filter

Most “the filter stopped working” stories are not a filter failure. They are a bypass: another browser, a VPN, a DNS change, or removing the profile.

Other browsers and in-app browsers

A Safari-only filter leaves Chrome, Firefox and in-app browsers open. Either block other browsers or use a filter that covers the whole device, not just Safari.

VPNs and Private Relay

A user-installed VPN can route around DNS. Private Relay can hide destinations from the network. Restrict VPN creation and Private Relay, and force DNS on the device.

DNS changes

If the user can change Wi-Fi DNS or install a DNS profile, the block is gone. Force encrypted DNS through the managed profile and lock the setting.

Profile removal

A hand-installed profile can be removed with its PIN. A supervised, managed profile with removal protection is harder. No device is immune to physical access; the goal is to close ordinary routes.

App Store reinstall

Deleting an app is not blocking it. Lock the App Store or use an approved list so the app cannot come back.

Images and screenshots

A text-only filter does not cover pictures. Add an image layer and consider screenshot restrictions where appropriate.

The principle

Layer the protection: managed profile, forced DNS, app control, Safari filter, image filter and a request process. No single setting does everything.

Frequently asked questions

Can any filter be bypassed?

With physical access, eventually. The practical goal is to close ordinary bypasses and make removal difficult.

Does Screen Time stop VPNs?

Screen Time can restrict some settings, but a managed profile is stronger for DNS and VPN enforcement.

What is the most common bypass?

Another browser or reinstalling an app because the App Store was left open.

Related reading: Kosher filter · iPhone filter · All guides