Online safety for parents: what to do first, and what to ignore

This is the largest and most crowded corner of the subject, and most of what is written about it is either alarming or unusable. The list below is short on purpose and ordered by what actually returns something.

Parents arrive at this subject in one of two states: something has happened, or nothing has and the worry has become unmanageable. The advice for those two is different, and almost everything published treats them as the same reader. This page separates them.

What to do first, in order

One: configure the device your child spends most of their time on, from the guide for that exact platform. Not the device that worries you most: the one with the hours in it. Fifteen minutes, once, and it removes the accidental exposure and the unlimited spending in a single sitting.

Two: agree three house rules out loud, and make one of them the promise that telling you never makes the consequence worse. That single sentence is what keeps everything else recoverable, because it is what determines whether you hear about the next problem early or late.

Three: take the phone out of the bedroom overnight, including your own. It is the boundary with the clearest evidence behind it and the one that survives adolescence, when hour-counting has stopped working.

Everything after those three is refinement. If you do nothing else, those are the three, and they can be finished in an evening with the controls wizard and the ten rules open side by side.

Age by age, roughly

Under eight, the useful settings are the blunt ones and the useful rule is about place: screens in shared rooms, no store access, contact limited to people you can name. Abstractions do not land at that age and physical rules do.

From nine to twelve, content ratings start doing real work and money becomes the live issue, usually through a game, not a shop. This is the band where per-app limits earn their place and where the conversation about strangers should shift from warnings to the one rule about secrecy.

Thirteen to fifteen is where heavy configuration begins to backfire: the more locked the device, the more attractive an unmanaged one becomes. Loosen deliberately, say that you are doing it, and hold the overnight rule. Past fifteen, the settings still worth keeping are money and privacy; the rest has become a negotiation, and that trajectory is the correct one, not a failure.

When something has already gone wrong

Keep the evidence first. Screenshot the message, the username and the timestamp before anything is blocked or deleted, because accounts disappear and take their contents with them. Then block, then report inside the platform, then talk.

Do not remove the device as a response to your child being targeted. It is the most common instinct and it teaches precisely the wrong lesson. Handle the incident, keep the rule, and if a threat, blackmail or any request for images is involved, that is a police matter rather than a school one.

The relevant topic page has an ordered list written for exactly that moment: cyberbullying, grooming, scam sites. In each case the first step is the same one.

What you can safely ignore

Most of the alarming vocabulary. Very little that happens to a family arrives through anything exotic. It arrives through a message, a login given away, a purchase nobody approved, or a conversation that moved somewhere private. Reading about the dramatic version crowds out the ordinary one.

Also: paid monitoring suites promising to watch everything, and any product whose pitch is that you will not have to talk to your child. Both sell the idea that this can be delegated to software, and it cannot: the technical layer removes accidents and has nothing to say about intent.

The two halves of the job, and why neither works alone

Settings decide what a device permits. Rules decide what happens on a friend’s phone, at a sleepover, on a school bus — the places no configuration reaches. Households that do only the first are surprised when something happens somewhere else; households that do only the second are surprised by a card statement.

Which is the whole argument of this site, and the reason every setup guide ends by pointing at the rules and every rule points back at a setting. If you would rather look up a specific worry than work through a plan, the threat library is organised that way, and the toolkit holds the six things that can be done in a sitting. One evening on each is a proportionate response to a subject that generates far more anxiety than it does work.