← All guidesCanopy Families
Security guide7 min read

How to set up parental controls on Sky Q Hub

Sky Broadband is in millions of UK homes, but the Sky Q Hub ships with no content filtering and a weak default admin password. This guide covers every step — from locking down the admin panel to enabling Sky Broadband Shield, Sky's free network-level filter that blocks adult content for every device on your connection without installing anything.

Before you start
  • Sky Broadband Shield is tied to your Sky account. Ensure your Sky account password and email are secure — a child who accesses your account can turn the Shield off.
  • The Sky Q Hub admin panel at http://192.168.0.1 is only accessible from within your home network.
  • Changing your Wi-Fi password will disconnect all devices. Reconnect smart TVs and consoles using the new password before your children notice.

Step 1 — Log into the Sky Q Hub admin panel

  1. Connect a device to your Sky Wi-Fi (not mobile data).
  2. Open a browser and go to http://192.168.0.1.
  3. Enter the admin password. The default is on the label on the back of the hub — look for "Wireless Key" or "Admin Password".
  4. Click Log in.
If the page does not load, try http://192.168.0.254. Some Sky Q Hub models use a different default gateway. Check your router's IP in your device's network settings.

Step 2 — Change the default admin password

The default admin passwords on Sky hubs are predictable. Changing it is the single most important security step.
  1. Once logged in, find Settings or Admin Settings.
  2. Select Change Admin Password.
  3. Enter the current password, then set a new strong password.
  4. Save the change and log back in.

Step 3 — Enable WPA2 or WPA3 Wi-Fi encryption

  1. Go to Wireless Settings.
  2. Under Security, select WPA2-PSK (AES) or WPA3-Personal if your hub supports it.
  3. Change the Wi-Fi password to a strong passphrase — 16+ characters, mixed case and numbers.
  4. Apply and reconnect all devices with the new password.

Step 4 — Set up a guest network for smart home devices

  1. In the hub admin, go to Advanced → Guest Network.
  2. Enable the guest Wi-Fi.
  3. Set a separate passphrase for the guest network.
  4. Apply.
  5. Reconnect smart TVs, speakers, and consoles to the guest network.
A separate IoT network prevents a compromised smart device from exposing your main devices. It also means you can share Wi-Fi with visitors without giving them access to your home network.

Step 5 — Configure DNS filtering with NextDNS

Some Sky Q Hub firmware versions label DNS settings differently. Look for "DNS Server", "Custom DNS", or "Primary/Secondary DNS" under Advanced or LAN settings.
  1. Create a free NextDNS account at nextdns.io.
  2. In the Sky Q Hub admin, go to Advanced → DNS.
  3. Set Primary DNS to 45.90.28.159 and Secondary DNS to 45.90.30.159. Note: if you're a Canopy Pro member, use your personalised DNS addresses from your Safety dashboard instead.
  4. Save settings.
  5. In your NextDNS dashboard, enable blocking categories: Adult Content, Gambling, AI Chatbots.

Step 6 — Enable Sky Broadband Shield

  1. Go to sky.com and sign in to My Sky.
  2. Navigate to My Account → Products & Services → Broadband.
  3. Find Broadband Shield and click Manage.
  4. Switch Shield On.
  5. Select the filtering level: "Child Safe" (under 13) or "Adult Content" (13+).
  6. Save. The change takes effect within a few minutes for all devices on your connection.
Sky Broadband Shield works at the Sky network level, upstream of your router. It applies even if a device changes its DNS settings — making it the most robust layer for ISP-level filtering.
🌳

Want Canopy to manage this for you?

Canopy Families guides parents through every security step — DNS setup, device controls, and content filtering — and keeps your protection up to date as your children grow.

Start free — takes 5 minutes