Block Live and Restricted YouTube Content

This article applies to organisations with a 'Hybrid' setup (both On-Premise Appliance and Cloud), as well as On-Premise only and Cloud only setups.

 

You can use Restricted Mode to let users access YouTube videos while blocking other YouTube content. You can:

Restricted Mode works best for organisations that allow YouTube access but want to block mature or distracting content. A YouTube Content Modification may be a better solution if your organisation only allows users access to specific videos or you want to block advertisements or turn off auto-play.

Before you begin

You need to decide which Restricted Mode setup method is best for your organisation. This decision will determine which method and steps you need to follow.

Question 1: Are you using the Cloud Extension or On-Premise Appliance to apply your policies?

  • On-Premise Appliance: Go to question 2.
  • Cloud Extension: Go to question 3.

Question 2: Do you have a Decrypt and Inspect policy for the YouTube category?

Question 3: Are you using the Cloud Extension on Chromebooks?

  • Yes: Go to question 4.
  • No: Use Method 1 and YouTube SafetyMode Cookie.

Question 4: Are you using Google Workspace for Education?

  • Yes: Use Method 2 to use Restricted Mode via Google Admin Console alongside YouTube SafetyMode Cookie.
  • No: Use Method 1 and YouTube SafetyMode Cookie.

Method 1: Use Content Modification to enforce Restricted Mode

Step 1: Set up HTTPS Inspection

  • If you use YouTube - Restricted Mode via CONNECT Header or the Cloud Extension to apply your Content Modification policies rather than the On-Premise Appliance, skip to Step 2.
  • If not, ensure you have a HTTPS Inspection Policy to Decrypt and Inspect the Everything category, or if this is not possible, the YouTube category.

Step 2: Check nothing prevents content modification

Remove any policies that would bypass your Content Modification, including:

Step 3: Create the Content Modification policy

Create a content modification policy with one of these Content Modifications:

  • YouTube - SafetyMode cookie
  • YouTube - Restricted Mode
    • (Moderate) via CONNECT Header
    • (Moderate) via HTTP Header
    • (Strict) via CONNECT Header
    • (Strict) via HTTP Header

Method 2: Use Google Admin Console and YouTube SafetyMode Cookie

Restricted Mode via Google Admin Console only blocks YouTube content for users signed into their Google Workspace account in Chrome. To block YouTube content in other browsers, you must also set up a YouTube SafetyMode Cookie Content Modification policy.

  1. In your Google Admin Console, check the box for Signed in users in your organisation can only watch restricted and approved videos.
  2. Create a content modification policy for the YouTube category and Apply YouTube SafetyMode cookie as the Action.

Table of Restricted Mode features

This table outlines some features of each Restricted Mode option.

 

Method How does it work? Requires Google Workspace for Education Requires HTTPS Inspection Can allow specific videos Restricted access when not signed in Works with the Cloud Extension
YouTube SafetyMode Cookie Inserts a cookie that enforces Restricted YouTube. No Yes No Yes Yes
YouTube: Restricted Mode via CONNECT Header Rewrites the CONNECT header for YouTube domains to 'restrictmoderate.youtube.com' or 'restrict.youtube.com'. Has a Strict or Moderate version defined by Google. No No No Yes No
YouTube: Restricted Mode via HTTP Header Rewrites the HTTPS  header for YouTube domains to 'restrictmoderate.youtube.com' or 'restrict.youtube.com'. Has a Strict or Moderate version defined by Google. No Yes Yes Yes No
Restricted Mode via Google Admin Console The Google Admin console settings enforce Restricted Mode for users logged into your domain, instead of Smoothwall On-Premise Appliance Content Modification. Yes No Users must be signed in to their Google Workspace account. No Yes