How To Enable Safe Search | Lock Down Explicit Results

SafeSearch filters explicit content from Google and Bing results, and both search engines let you lock it on at the account level or enforce it across an entire network.

A single explicit image or link landing in front of the wrong eyes is enough to spark a conversation nobody planned. SafeSearch is the layer that stops that moment before it starts — a filter both Google and Bing offer at the individual account level and, for parents and administrators, at the device and network level. The catch is that toggling it in a browser only covers that browser session; a real lock-down needs the enforcement route.

Enabling SafeSearch on Google

Google’s SafeSearch filtering is just a couple of clicks away for any signed-in account, but keeping it on for every device someone uses requires DNS or hosts-file enforcement.

To turn SafeSearch on for your own Google account:

1. Go to google.com and make sure you’re signed in.
2. Click the Settings gear icon at the bottom right of the search page, then select Search settings.
3. Under the SafeSearch filters section, check the box for Turn on SafeSearch.
4. Click Save at the bottom of the page.

Once saved, explicit content — sexual activity, graphic violence, and other adult material — is filtered out of search results for that account on any browser or device where the account is signed in. You’ll see a green lock icon in the top-right corner of the search results when it’s active.

Enforcing Google SafeSearch on a Managed Network or Device

The account-level toggle works only while someone stays signed in. For managed environments — a school, a family’s home network, or a device you control — Google’s official method is to redirect `www.google.com` (and any localized Google domains) through a special SafeSearch enforcement address.

The general approach: map `www.google.com` to `forcesafesearch.google.com` using a DNS change at the router level or a hosts-file entry on each device. The steps vary by OS:

Google’s own guidance says to ping forcesafesearch.google.com and use the IP address that comes back, rather than hard-coding an assumed IP. The example IP Google historically provides is 216.239.38.120, but resolving it fresh ensures the address hasn’t changed. Google also warns that if users access country-specific domains like www.google.co.uk or www.google.de, those need their own hosts-file mappings to forcesafesearch.google.com.

Enabling SafeSearch on Bing

Bing offers three SafeSearch levels instead of a simple on/off toggle, giving administrators and parents finer control over what gets filtered.

To set SafeSearch for your own Bing account:

1. Go to bing.com and sign in.
2. Click the menu icon (three horizontal lines) in the top-right corner.
3. Select SafeSearch from the menu.
4. Choose one of the three levels: Off, Moderate, or Strict.
5. Click Save.

The Moderate setting filters out explicit images and videos but allows some text results. Strict filters all explicit content — images, videos, and text. Microsoft’s official documentation treats Strict as the recommended setting for environments with children.

Enforcing Bing SafeSearch on a Network or Device

Bing’s network-level enforcement is different from Google’s. Instead of mapping to a special hostname via A record, Microsoft’s official method uses a CNAME record that points www.bing.com to strict.bing.com at the DNS level. Microsoft specifically recommends a CNAME over a static IP address because the IP behind strict.bing.com could change.

For an individual PC, you can achieve the same effect through the hosts file:

1. Resolve the IP for strict.bing.com by running ping strict.bing.com in a command prompt or terminal.
2. Add a line to the hosts file using the IP address returned, mapped to www.bing.com.
3. If the device uses Microsoft Edge, also add a line mapping edgeservices.bing.com to the same IP address.

Once the hosts file entry is in place, every Bing search on that PC enforces Strict SafeSearch, regardless of which browser or user account is active.

Common Setup Mistakes That Break SafeSearch

Both Google and Bing’s enforcement methods have pitfalls that can silently disable the filter. The most frequent errors:

• Changing only the browser setting. The account-level toggle works only while the user is signed into that account. A different browser, a private window, or a guest profile bypasses it completely.
• Using a static IP for Bing enforcement. Microsoft’s CNAME recommendation exists because the IP for strict.bing.com can change without notice. A hard-coded IP in a hosts file could break filtering when the address updates.
• Forgetting regional Google domains. Google’s documentation warns that users who access localized domains like www.google.co.uk can still reach unfiltered results if only www.google.com is mapped.
• Missing the Edge-specific Bing domain. On a Windows device where Microsoft Edge is used, edgeservices.bing.com also needs a hosts-file entry; otherwise, searches initiated from within Edge may bypass the strict filter.

Closing Checklist: What a Locked-Down Setup Looks Like

When SafeSearch is properly enforced at the network or device level rather than just the account level, a signed-out user or a guest on a managed device cannot reach explicit results through that search engine. The visual confirmation varies — Google shows a green lock icon on the search results page, and Bing’s search page may display a “Strict” label in the SafeSearch menu that cannot be changed without admin credentials. Running a test search for a common explicit term on a known-safe device should return no adult results. If a single bypass method remains — an unmapped Google regional domain, an unchanged edgeservices.bing.com entry, or reliance on a browser session that can be cleared — the filter is incomplete.