Router-level controls protect devices you don't own — friends' phones at sleepovers, smart TVs, old iPads — where you can't install software. Think of this as the last safety net.
Usually by typing 192.168.1.1 or 192.168.0.1 into a browser, or via your router's app (Eero, Google, Asus, etc.). Password is often on a sticker on the router itself.
If you've never done this, do it first. Default passwords are public knowledge.
Router → WAN/Internet → DNS. Set to OpenDNS FamilyShield (208.67.222.123 / 208.67.220.123) or Cloudflare Family (1.1.1.3 / 1.0.0.3). This filters adult content and malware at the network level.
Most modern routers group devices into profiles. This lets you set bedtime and content filters per kid, not per device.
Kid profile → Schedule. Common pattern: weeknights 9pm–7am, weekends 10:30pm–8am. Devices on that profile simply lose internet during those hours.
Most routers offer categories: adult, gambling, social, chat. Start conservative; loosen as your kid ages up.
Guest network. Cameras, doorbells, TVs, smart speakers go on guest; phones/laptops on main. If an IoT device is compromised, it can't reach your main devices.
WPA3 if your router supports it; WPA2 if not. Never WEP; never open.
Once a month, look at every device on your network. Label them. Unknown devices get kicked; they're often a neighbor or a forgotten old gadget.