Router or app? The answer is usually both.
Router manufacturers increasingly build parental controls into the box, which sounds like it removes the need for anything else. It covers one half of the problem completely and the other half not at all.
What a parental control router gives you
Most modern mesh systems and mid-range routers include some version of:
- Per-device or per-profile content filtering
- Internet pause and scheduled access
- Time limits per profile
- Basic activity reporting
- Sometimes a subscription tier for better filtering
Real strengths: every device is covered including consoles and TVs, there's nothing to install, and a child can't uninstall it.
Where it stops
- Cellular data. For a teenager, this is most of their usage.
- Every network that isn't yours.
- Hotspots. One phone with a data plan creates an unfiltered network inside your home.
- DNS changes on the device — a Wi-Fi setting, not a hack.
- DNS-over-HTTPS in modern browsers, which encrypts lookups to the browser's own resolver.
- Profile assignment. Router filtering identifies devices by MAC address, and modern phones randomise MAC addresses per network by default — which can quietly detach a device from its profile.
That last one catches people out. A phone that changes its MAC address may stop matching the profile you assigned, silently.
The layer that leaves the house
Defenras filters on the device across every network — the half a router can never reach.
Get Defenras free →What a device app gives you
- Filtering on every network — Wi-Fi, cellular, hotspot, anywhere
- Per-child rules independent of which device is on which network
- App blocking, which no router can do
- Resistance to DNS changes and DNS-over-HTTPS
- Tamper notifications
And its limits: one install per device, it can't cover a console or a TV, and your child knows it's there.
Comparison
| Router | Device app | |
|---|---|---|
| Covers consoles / TVs | Yes | No |
| Covers cellular | No | Yes |
| Covers other networks | No | Yes |
| Survives hotspot | No | Yes |
| Survives manual DNS change | No | Yes |
| App-level blocking | No | Yes (Android) |
| Per-child rules | Limited | Yes |
| Setup effort | Once | Per device |
| Child can remove it | No | Not without PIN |
The combination that works
- Router filtering as the floor. Covers the console, the TV, the old tablet, and any device a visitor brings. Set it once.
- Device filtering on every phone and tablet your child carries. This is the layer that does the real work for anyone over about 11.
- Change the router admin password. A large proportion are still the default on the sticker, and a teenager who can read a sticker can turn off your filtering.
- Test it. Turn off Wi-Fi on your child's phone and try a blocked site over cellular. The result tells you which layers you actually have.
Several router makers charge monthly for the parental control tier. Before paying, check what it adds over free filtering DNS set manually on the same router — which is often most of the content filtering for nothing. The paid tier usually buys per-profile rules and reporting rather than better blocking. Worth comparing rather than assuming.
Frequently asked questions
Is a router-level filter enough for a teenager?
No. It covers your home Wi-Fi and nothing else, and most teenage screen time happens on cellular or on other networks.
Can I use free filtering DNS on my existing router?
Yes, on most routers — change the DNS server in WAN or Internet settings. That gets you the bulk of the content filtering without a subscription.
Why did my router's parental controls stop applying to my child's phone?
Probably MAC address randomisation. Modern phones randomise their hardware address per network, which can detach the device from its assigned profile. Set the phone to use its real MAC for your home network, or filter on the device instead.
Do I need both?
If you have consoles or smart TVs, yes. If it's only phones and tablets, device filtering alone covers more than the router does.
Defenras blocks all of this — without collecting your child's data.
One app, every device, every browser. Adult content, gambling, vaping, scams, malware, social media — all blocked. PIN-locked. Free version available, no credit card.