When a child asks to use a new website, game or app, a parent is really asking two questions. Is it what it says it is, or a scam, a fake login page or a malware download? And if it's genuine, is it right for this child: what they'll see, who can reach them, what it collects and what it costs?
The first question is about the site, the second about the service, and plenty of genuine services fail the second. Below are the checks for each, the controls built into phones, computers and home broadband that catch what you miss, and where to report it when something goes wrong.
Is it what it says it is?
The padlock is not a safety rating
The padlock, and the https:// in front of the address, mean the connection is encrypted so nobody in between can read it. They say nothing about who runs the site. Google's research in 2021 found that only 11% of the people it studied understood that, and it points out that nearly all phishing sites use HTTPS.
The certificate behind the padlock can still tell you something. One issued last week to a site claiming to be a long-established game studio is worth noticing, and an expired one means nobody is looking after the site. To see who issued a site's certificate and when it runs out, paste the address into a free SSL certificate checker; Otterwatch's SSL guide shows how to read the same dates from the padlock menu in your browser. If the browser shows a full-page certificate warning, close the tab rather than clicking through.
Read the address and the offer
CISA's advice is to check every address for slight misspellings or the wrong ending, such as cisa.com in place of cisa.gov. The lookalikes children meet usually borrow a game's name and offer free in-game currency. The NSPCC warns that offers of free V-Bucks or Robux are often scams designed to get a player's username and password.
Teach one rule that covers most of them: a game account password only ever goes into the game's own app or website, reached by typing the address or opening the app. Any other page asking for it is phishing, however familiar it looks. The same goes for games, mods and cheats: download them from the official store, not a site found through a video description.
Check its age and record
Dangerous sites tend to be new. In verified.fyi's own reports, 64% of the sites rated dangerous were less than a month old, and 93% of those new dangerous sites showed a valid padlock. ICANN's free registration lookup shows when any domain was registered, so a "trusted kids' platform" whose domain is three weeks old is easy to catch.
Google's Safe Browsing site status shows whether Google has flagged a site for malware or phishing. A clean result helps, but a site too new to have been reported will also come back clean. For the full set of checks, see how to tell if a website is legit.
Is it right for your child?
Check the age rating and the minimum age
Most social media apps set a minimum age of 13. That comes from the US Children's Online Privacy Protection Act (COPPA): services must get verifiable parental consent before collecting personal information from children under 13, and many bar under-13s rather than do that. The minimum is rarely enforced. Ofcom's tracking of what UK children actually visit found that 27% of 10-year-olds visited Snapchat in a month, rising to 64% of 12-year-olds.
Store ratings are the quickest guide to content. Apple's App Store moved to 4+, 9+, 13+, 16+ and 18+ ratings in 2025. Games sold in the UK and Europe carry a PEGI rating of 3, 7, 12, 16 or 18, with descriptors underneath. Look for "In-game purchases": since June 2026, games submitted to PEGI that sell paid random items such as loot boxes or card packs are rated 16 or 18, and chat that can't be blocked, muted or moderated earns an 18.
Find out who can contact your child
The biggest difference between a safe app and a risky one is often who can message the child. In 2022 the FTC said Fortnite's voice and text chat were on by default, matching children and teens with strangers. Epic Games agreed to pay a $275 million penalty for breaking COPPA, which the FTC called the largest it had ever obtained for a breach of one of its rules.
Before your child signs up, open the settings and look for:
- whether strangers can send messages, friend requests or group chat invitations, or only approved friends;
- whether voice chat can be turned off;
- whether the profile is private and location sharing is off by default;
- a block and report option on every message and profile.
UK rules now expect most of this. The ICO's children's code requires services children are likely to use to make settings high privacy by default and switch geolocation off. Since 25 July 2025, Ofcom's children's codes have required the riskiest services to use highly effective age checks, keep harmful content out of children's feeds and let children decline group chat invitations. If an app doesn't offer these controls, take that as an answer.
Give children the NSPCC's rule for games: chat should be about the game, and anyone who asks personal questions or suggests talking on another app is someone to tell you about. The FBI lists that move, a gaming contact suggesting a different app, as a warning sign of financially motivated sextortion. In these schemes, offenders who are often abroad pressure children, most often boys of 14 to 17, into sending images and then demand money.
Read what it collects and what it costs
Privacy policies are long, but a few searches inside one are quick. Search for "children" or "13" to see whether the service asks for parental consent, "advertis" to see whether children get targeted ads, and "share" or "sell" to see where the data goes.
Spending is often designed in. The FTC's second case against Epic produced $245 million in refunds over "dark patterns", button layouts that led players into purchases they didn't intend. Two controls stop most surprises. Apple's Ask to Buy makes a child request every download and purchase, including in-app ones, and in some countries it is on by default for under-18s and can't be switched off. Google Play's purchase approvals do the same for anything bought through Google Play's billing.
Apply the same checks to AI chatbots
Children now use chatbots for homework and company, and these are the least tested services on this list. In September 2025 the FTC ordered seven companies, among them Meta, OpenAI, Snap and Character.AI's maker, to explain how they test companion chatbots for harm to children and teens. Common Sense Media rates social AI companions an unacceptable risk and says nobody under 18 should use them.
For a homework helper or general assistant, ask the questions that apply to all AI-marketed services and data privacy: whether chats are stored and for how long, whether they are used to train the model, and whether your child can delete them.
Controls that back up your checks
Each control blocks at a different point and has its own blind spot, so use more than one.
Search
Google turns SafeSearch's Filter setting on by default when its systems think a user is under 18, and for children with Family Link accounts it is on and locked so only a parent can change it. It only filters Google Search results, though. It doesn't block a site someone types in or a link a friend sends, and Google says it can't be enforced when the child is signed out or uses another search app.
Each device
- iPhone, iPad and Mac: Screen Time's Content & Privacy Restrictions offer Limit Adult Websites, or Ask to Browse, which allows only sites you approve. Set a Screen Time passcode your child doesn't know.
- Android and Chromebook: Family Link's Chrome settings offer "Try to block explicit sites" or "Only allow approved sites". Google says no filter is perfect, and on a computer a child can sign out of Chrome or open another browser to get round it.
- Windows and Xbox: Microsoft Family Safety's web filter works only in Edge and blocks other browsers so it can't be bypassed. Leave that blocking on.
On a shared computer, give each child a standard account rather than an administrator one, so they can't change these settings.
The home network
A family DNS filter set on the router covers every device on your Wi-Fi, including consoles and smart TVs. Cloudflare's free 1.1.1.1 for Families blocks malware and adult content if you enter 1.1.1.3 and 1.0.0.3 as the router's DNS servers, or malware alone with 1.1.1.2 and 1.0.0.2. In the UK, the big broadband providers include a filter with the service, such as BT's parental controls and Sky Broadband Shield, and Internet Matters has setup guides for each.
A network filter stops at your front door. A phone on mobile data or a friend's Wi-Fi never touches it, and a VPN app or the browser's own secure DNS setting can route around it. That's why the device controls matter more on phones.
Test it
Spend ten minutes with the child's device. Try a site that should be blocked and a school site that shouldn't be, then a second browser, then mobile data with Wi-Fi off, then signed out. Each failure tells you which layer is missing. For the habits that protect the whole household, see our safe browsing habits checklist.
Talk, and know where to report
Filters reduce accidents. They don't replace a child who tells you when something goes wrong, and a child who expects to lose their phone for telling you has a reason not to. Say in advance that they won't be in trouble for reporting something, and check new apps together so they see what you look for.
If someone pressures your child for images or money:
- Don't pay, and keep the evidence. The FBI advises against deleting the offender's profile or messages, since they help police identify them. Block the account once you've noted the username.
- Report it. In the UK, use CEOP, the National Crime Agency's child protection command, or call 999 if a child is in immediate danger. In the US, report to the FBI at tips.fbi.gov or to NCMEC's CyberTipline.
- Get images taken down. Under-18s in the UK can use Report Remove, run by Childline and the Internet Watch Foundation. NCMEC's Take It Down works for anyone whose image was taken before they were 18: it gives participating platforms a fingerprint of the image to match against, so the file itself never leaves the device.
If what went wrong was a scam rather than a person, our guide to online scams covers what to do and where to report it.
Where verified.fyi fits
When a link turns up in a group chat, a game's chat or an ad, paste it into verified.fyi. It collects 200+ facts about the site from public sources and weighs them into a score. For parents, the useful ones are:
- whether Google Web Risk, VirusTotal or the malware-blocking resolvers run by Cloudflare and Quad9 already flag it;
- how old the domain is, and whether the address imitates a well-known site;
- whether the homepage asks for a password, card details or a crypto wallet;
- whether visitors arriving from a search are shown gambling, adult or loan spam that direct visitors aren't;
- whether apps the site links to are on the App Store or Google Play under the same developer.
It tells you whether a site can be trusted, not whether its content suits a nine-year-old; the checks above cover that. The methodology explains how each fact is scored, recent checks show what others have looked up, and the most trusted gaming sites we've checked are a place to start for games.