Setup guide

1. Open Settings and go to Network & internet.
2. Tap Private DNS (it may be under Advanced or Connection & sharing).
3. Choose Private DNS provider hostname.
4. Paste the address from your dashboard and tap Save.

This protects the phone on Wi-Fi and mobile data. Test it by opening a site you blocked on your dashboard.

1. On the child's phone, download the Kafayah app and open the file. It is not in the Play Store yet, so Android asks once whether your browser may install apps: allow it, install, then switch that permission off again.
2. On your dashboard, open the child's profile and press Make a setup code. You get a short code like K7QM-4TZP.
3. Open the app on the phone, type the code, choose a parent PIN and tap Turn on protection. Android asks once whether Kafayah may set up a VPN (that is how it filters on the phone): tap OK.
4. If you switch short videos off on the dashboard: the app explains the one Android setting that closing YouTube Shorts and Instagram Reels needs, and opens it for you.
5. Optional, for extra safety: in the phone's Settings, search for VPN, open Kafayah and switch on Always-on VPN.

The phone then appears under Devices on your dashboard, and you get an alert if protection is switched off, another VPN app takes over, or the app stops checking in.

See each child at a glance, pause the internet, block apps in one tap, allow a site, make setup codes and get alerts, in English or Urdu. On your Android phone, download Kafayah Parent, install it the same way, and sign in with this website's email and password. The iPhone version is coming; until then this website works on any phone.

These browsers can use a custom secure-DNS address. Use the DNS-over-HTTPS link from your dashboard (it looks like https://dns.kafayah.com/dns-query/abc123defg).

• Chrome / Edge: Settings, then Privacy and security, then Security, then turn on Use secure DNS, choose Custom and paste the link.
• Firefox: Settings, then Privacy & Security, scroll to DNS over HTTPS, choose Max Protection, then Custom and paste the link.

Limit: this protects that browser only. Other browsers and apps on the computer are not covered, and private/incognito windows follow the same setting.

1. On a phone or computer connected to your home Wi-Fi (not mobile data, not a VPN), open your dashboard and press Link this network in the Home Wi-Fi section.
2. Open your router's page in a browser, usually 192.168.1.1 or 192.168.0.1. The login is often printed on the router's sticker.
3. Find the WAN, Internet or DHCP settings, then DNS. Change it from automatic to manual and enter the address shown in the Home Wi-Fi section of your dashboard as the primary DNS. Leave the secondary empty, so devices cannot fall back to an unfiltered server.
4. Save and restart the router, then reconnect your devices (or turn flight mode on and off).

If your internet address changes, protection stops until you press Link this network again. The dashboard can give you a private update link for routers that support a custom DDNS/update URL.

Limits: it does not work if your internet provider shares one address between many customers (common with mobile and wireless providers); pressing the button tells you. Devices that use their own DNS setting or a VPN bypass it, so also protect phones with the Android app.

1. On the iPhone or iPad, open Safari, sign in to your dashboard and tap iPhone, iPad or Mac profile. Tap Allow.
2. Open Settings. Tap Profile Downloaded near the top, then Install, and enter the device passcode.
3. Apple shows Not Signed because the profile is not signed by a paid Apple certificate. That is expected; tap Install anyway.

It protects that device on Wi-Fi and mobile data. To check, go to Settings, General, VPN & Device Management. To remove it, open the profile there and tap Remove Profile.

Limit: anyone who knows the device passcode can remove a profile. Apple only allows locking profiles in place on supervised devices (for example a school's managed iPads).

Kafayah iPhone app: an app that uses Apple's Screen Time system to block apps, set schedules and stop a child deleting it is built, but not yet released: it needs Apple's approval first.

Pictures on iPhone: Apple has a feature that blurs nudity on the device itself: open Settings, Screen Time, choose the child, then Communication Safety (and Sensitive Content Warning under Privacy & Security). It blurs nudity in Messages, AirDrop and some other apps, checked on the device.

1. In your dashboard, click iPhone, iPad or Mac profile to download it (macOS 11 or newer).
2. Open System Settings, then Privacy & Security, then Profiles. Double-click the Kafayah profile and click Install.

Browsers can have their own "secure DNS" setting that overrides the Mac's; turn it off in Chrome, Edge and Firefox (or use the browser setup above).

1. Filtering. On the child's computer:

1. In your dashboard, click Windows: double-click setup to download Kafayah-Setup.cmd.
2. Open the downloaded file. Windows asks whether to allow it to make changes: choose Yes.
3. A window says when protection is on. Press Enter to close it, then close and reopen the browsers.

It sets Chrome, Edge, Brave and Firefox to your family's filter and locks that setting, so a child cannot switch a browser to another DNS service. On Windows 11 every other app is filtered too. On Windows 10 only the browsers are: link your home Wi-Fi on the dashboard to cover the rest. To turn it off, download and open Windows: turn-off file the same way.

2. Short videos. Download Kafayah for Windows and open it while signed in to the child's Windows account. Choose a parent PIN and press Install and start. It covers YouTube Shorts, Instagram Reels and TikTok in the browser and goes back. It reads only the address of the page being watched; nothing is sent. It starts by itself at every sign-in; open it again to change settings or remove it (with the PIN).

Windows may say "Windows protected your PC" the first time, because the program is new: click More info, then Run anyway.

Limits: a person with administrator rights can undo either. Give the child a standard Windows account, with the parent as the only administrator.

1. In your dashboard, open the child's profile, then Devices, open Other ways to connect, and copy the Browser (DNS-over-HTTPS) link.
2. On the Chromebook: Settings, Security and privacy, Use secure DNS: on, With: Custom, and paste the address.

On a Chromebook the child manages through Google Family Link, only the parent can change this setting. On other Chromebooks, the child could switch it off: linking your home Wi-Fi covers the Chromebook at home either way.

In Firefox: Settings, Privacy & Security, DNS over HTTPS, Max Protection, Custom, and paste the profile's Browser (DNS-over-HTTPS) linkfrom the dashboard. In Chrome: Settings, Privacy and security, Security, Use secure DNS, Custom. Linking your home Wi-Fi covers everything else on the computer.

Yes. Kafayah's rules follow the phone, the computer and your home Wi-Fi, not any email or account. Signing in with a new Gmail, Instagram, TikTok or YouTube account changes nothing: the same sites stay blocked and SafeSearch stays on.

The usual way around a filter is to point the browser or phone at a different "secure DNS" service. Kafayah blocks the public ones for everyone, tells Firefox and iPhones (iCloud Private Relay) to stay on the filter, and can block VPN apps with the VPN and proxy apps category. If another VPN takes over a phone running the Kafayah app, you get an alert.

Switch on Short-video apps for a profile. TikTok, Snack Video, Likee, Moj, Josh and similar apps are then blocked on every connected device.

YouTube Shorts and Reels use the same internet addresses as the rest of YouTube, Instagram and Facebook, so no internet filter can block them alone. They are blocked on the device instead: the Kafayah Android app (with its screen setting on) closes YouTube Shorts and Instagram Reels as they open, in the apps and in the browser, and Kafayah for Windows covers a browser showing Shorts, Reels or TikTok and goes back. Normal YouTube videos keep working. Reels inside the Facebook app are not caught yet.

• Open a site you blocked on the dashboard. It should fail to load.
• Search on Google. The results should be in SafeSearch mode.
• Open the dashboard's Recent activity after browsing. Your device's lookups appear there.

Changes on the dashboard can take about 10 seconds to reach your devices.