Filtering rules — How the rule system works

Filtering rules are the foundation of protection in LocalGuard. They define what your child can see on the internet, when, and under what conditions. Understanding how rules work and how they interact helps you configure protection that actually works and does not surprise you.

The different types of rules

LocalGuard has several types of rules you can combine:

Domain rules

Domain rules are the most direct: you block or allow a specific website.

For example:

Block tiktok.com — your child cannot access TikTok from any browser.
Allow khanacademy.org — that website is always accessible even if you accidentally have an education category blocked.

Domain rules support:

Expiry date: The rule automatically deactivates on the date you choose. Useful for temporary blocks during exams or weekend restrictions.
Comment: An internal note only you see, to remember why you added that rule.
Bulk import: You can import a list of domains from a text file (one domain per line).

Category rules

Categories group thousands of domains of the same type. Instead of adding each website manually, you enable a category and the system automatically blocks all domains in that group.

Available categories include: social media, gaming, streaming, adult content, gambling, proxies, and VPNs. The system keeps these lists updated, so you do not have to worry about new websites appearing in a category — they are added automatically.

Browser policy

Defines what the agent does when it detects a specific or unrecognized browser:

Allow: The browser can function normally.
Notify: You receive a notification when your child uses that browser.
Block: The browser process closes before it can navigate.

This rule is especially useful for browsers with built-in VPNs (like Brave or Opera) that might try to bypass the local proxy.

Schedules

Schedules define when rules are active or when the device has access. You can configure:

Access windows by day of the week and time.
The night profile that blocks all browsing during rest hours.
Study mode time windows that only allow educational websites.

Per-app time limits

If the agent reports running processes, you can set how much time the child can use a specific application each day. When they exceed that limit, the application automatically closes.

How the agent decides if a website is allowed or blocked

When your child tries to open a website, the agent evaluates all active rules in this order:

Is the device outside its access schedule? If schedules indicate so, block directly.
Is the night profile active? If we are in the night window, block.
Has the day’s screen time run out? If the daily limit reached zero, block.
Is the domain in the allowed list (whitelist)? If there is an explicit exception allowing that domain, let it through regardless of other rules.
Is the domain in the blocked list? If there is a rule explicitly blocking it, block it.
Does it belong to a blocked category? If the domain falls within an active category, block it.
If no rule applies: let it through (by default, what is not explicitly blocked is allowed).

This order is important. In particular, the whitelist always takes priority over category blocks. If you block the “Streaming” category but add youtube.com as allowed, YouTube will be accessible.

Recommended strategy for configuring rules

To start: broad rules + specific exceptions

The most effective strategy for most families:

Enable the categories you want to block broadly: social media, adult content, gambling, and proxies/VPNs at minimum.
Add as allowed domain any website from those categories that your child legitimately needs (a school social network, an educational streaming platform…).
Add as blocked domain specific websites that are not in any category but you want to block (a specific forum or gaming platform not covered by default categories).

This combination is easy to maintain: you do not have to update thousands of websites manually, and the specific exceptions are few and clear.

To refine: scope by device

If you have multiple children of different ages and needs, configure rules with device scope instead of applying them to all:

The 16-year-old’s PC can have fewer restrictions than the 10-year-old’s.
The family tablet can have different rules from the laptop the child uses in their bedroom.
You can create family groups (in the Devices section) to apply the same rules to a set of devices without repeating the configuration.

Rule conflicts — When one rule “wins” over another

The most common conflict is when a category blocks something you need to allow. We already explained that the whitelist takes priority, but there are more cases:

Category blocks but the domain should be allowed

Solution: Add that domain as “Allowed” in the Domains tab. The explicit exception always takes priority over the category block.

Example:

You have the “Social media” category blocked.
The school asks students to use Google Classroom (which may be associated with social services).
You add classroom.google.com as an allowed domain.
Result: Google Classroom accessible, the rest of social media blocked.

A rule seems active but does not apply

The most common causes are:

Wrong scope: The rule is assigned to “Device A” but you are testing on “Device B”.
Schedule outside window: If the rule has a schedule condition, it only applies during that schedule.
Exception winning: There is a whitelist rule allowing that domain with priority over the block.
Agent not synchronized: The device’s agent may be using an older version of the rules. Check the last contact in Devices.

Two contradictory rules for the same domain

If you have the same domain both blocked AND allowed (by mistake), the “Allowed” exception wins. Use the rule inspector in the Protection screen to verify what rule the system will apply for a specific domain before testing on the child’s PC.

The whitelist — When and how to use it

The whitelist (list of allowed websites) is your tool for making precise exceptions. Use it carefully, because an overly broad exception can override an entire category.

Correct use cases:

Allow khanacademy.org even though you have an education category generally blocked.
Allow google.com even though you have social media blocked (Google is not a social network, but sometimes appears in broad categories).
Allow youtube.com in study mode for specific educational videos.

Common whitelist mistakes:

Adding google.com as allowed when you just want Google Search to work — if google.com is blocked by a category, adding it to the whitelist will open all of Google, including YouTube and Gmail.
Adding *.youtube.com (all subdomains) instead of just the specific domain you need.

Tip: When you add an exception, use the rule inspector to verify exactly what effect it has on the set of active rules.

Schedules and family routines

Schedules are one of LocalGuard’s most powerful features because they automate restrictions according to your family’s routine, without you having to remember to manually enable them each day.

Common routines and how to configure them

Family situation	Recommended configuration
Homework hours (e.g., 3:00-6:00 PM)	Enable study mode: only educational websites you add are allowed
School hours (e.g., 9:00 AM-3:00 PM)	If the child uses the PC during school, block it directly with access schedule
Dinner time (e.g., 8:00-9:00 PM)	Define that slot as unavailable in access schedules
Night (e.g., 10:00 PM-7:00 AM)	Enable night profile: browsing completely blocked
Weekend	Allow more hours, but with the same blocked categories as weekdays

Night profile vs. access schedules

There are two ways to block the device at night and it is useful to understand the difference:

Night profile (in Protection → Night profile): Blocks web browsing but the device can still be used for other things.
Access schedules (in Time → Settings): Blocks access to browsing completely according to the time window you define.

You can use one, the other, or both together. If you just want the device to stop browsing at night, the night profile is sufficient and easier to configure.

Verifying rules work

After configuring any new rule, always verify:

With the rule inspector: Enter the domain and confirm the system would make the correct decision.
On the child’s PC: Open the website in a normal window and in incognito. You should see the supervision screen in both cases.
In Activity: Search for the domain in the log and confirm it appears with the expected result and reason.

If all three checks are correct, you can trust the rule is working. If any fails, check the troubleshooting section in the Protection guide.