Kerio Control Web Filter Is Not Activated Categorization Is Disabled Fixed May 2026

If SSL inspection is off, HTTPS sites may appear uncategorized.

On Windows-based Kerio Control installations, the web filter module may fail to register with the OS.

Repair installation:

Perform these quick checks to save time:

Enable verbose logging for web filter:

Common errors:

Even if your license appears active, re-entering it can re-trigger the activation of the web filter module.

The “Web filter not activated, categorization disabled” error in Kerio Control is almost always fixable. Most users resolve it by renewing their license or restarting the categorization service. For persistent cases, clearing the local database or re-synchronizing the system time works wonders. By following this guide, you’ll restore full URL filtering capabilities and keep your network safe from undesirable content.

Final thought: Regularly review your Kerio Control license portal and automate updates – a healthy web filter is a silent guardian that never needs emergency resuscitation.

When the Kerio Control Web Filter shows as "not activated" or "categorization is disabled," it is

typically due to a loss of reliability in the DNS checks to Kerio's update servers or an authorization token expiration support.keriocontrol.gfi.com Immediate Fixes Disable Reliability Detection (SSH Method):

If Kerio Control fails 10 consecutive DNS check queries within one minute, it marks the Web Filter as "not reliable" and disables it. Use these commands via SSH to disable this check and restart the service: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Update DNS Forwarders:

"Invalid Authorization" errors often stem from expired Zvelo key tokens. It is recommended to use reliable DNS servers like Cloudflare (1.1.1.1) (208.67.222.222)

instead of Google's DNS to ensure correct token transfer from internal servers. Renew/Update License:

Ensure your license includes the Web Filter module, as it reverts to a trial and disables automatically after 30 days without a valid key. Use the Configuration Assistant Update license info to refresh your status. support.keriocontrol.gfi.com Checklist for Persistent Issues Check Time & Connectivity:

Large time drifts can cause certificate and token failures. Ensure the system time is synchronized. Verify Admin Settings: Navigate to Content Filter Applications and Web Categories

and verify that "Enable Kerio Control Web Filter" is checked. Free Disk Space:

If Kerio Control cannot save the license file due to a full disk, the filter may fail to activate. Clear cache files in the Firebase DB folder if necessary. Manual Restart:

If the service is stuck, a physical reboot or a software restart through the administration interface can sometimes restore operation after 1 hour of downtime. support.keriocontrol.gfi.com

For further assistance with specific error codes, you can visit the GFI Support Portal Using Kerio Control Web Filter If SSL inspection is off, HTTPS sites may

When your Kerio Control Web Filter shows as "not activated" and categorization is disabled, it is typically caused by license issues, DNS resolution failures, or an expired Zvelo authorization token. 🛠️ Step-by-Step Fixes 1. Fix DNS Forwarding for Zvelo

The Web Filter uses Zvelo for categorization. If your DNS cannot resolve *.zvelo.com, the filter disables itself for reliability.

Recommendation: Avoid using Google DNS (8.8.8.8) for Zvelo queries, as it can cause "Invalid Authorization" errors.

Action: Go to DNS settings and configure Custom DNS forwarding for *.zvelo.com to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222).

Reboot: You must restart Kerio Control after changing these DNS settings to clear the cached status. 2. Disable "Reliability Detection" (SSH)

If your internet link is slow or unstable, Kerio may proactively disable the filter. You can force it to stay active via the SSH console: SSH into your Kerio appliance.

Navigate to the configuration directory: cd /opt/kerio/winroute. Run this command to disable reliability checks: ./tinydbclient "update SiteFilter set DetectReliability=0" Use code with caution. Copied to clipboard Restart the service: /etc/boxinit.d/60winroute restart. 3. Verify License & Module Activation

The Web Filter is a separate licensed module. If the license is missing or expired, the options will be greyed out.

Check Status: Look at the Dashboard license tile to ensure it's not in "Trial" or "Unregistered" mode.

Renewal: If you recently renewed, you might need to manually download the license file from the GFI Accounts portal and import it via the Registration Wizard. 4. Check Zvelo Token Expiry

The categorization token expires every 21 days. If Kerio cannot reach internal update servers to refresh it, authorization fails.

Ensure your firewall allows outgoing traffic on Port 443 (HTTPS) and Port 80 (HTTP) to Kerio's update servers.

💡 Quick Pro-Tip: If the filter is active but specific sites are still failing, try enabling HTTPS Decryption in the Content Filter settings; otherwise, the filter cannot see the full URL to categorize it.

If you're still having trouble, I can help you look at your logs. Could you tell me:

What specific error message appears in your Warning or Error logs?

Is your License currently showing as active or expired on the Dashboard? Which version of Kerio Control are you currently running?

Web Filter categorization disabled. Serial number: ko-197974

The error message "Kerio Control Web Filter is not activated, categorization is disabled"

typically occurs when the firewall detects a loss of reliability in reaching the categorization servers or if there is an authorization failure with the third-party service ( Common Causes DNS Reliability Check Failure On Windows-based Kerio Control installations, the web filter

: Kerio Control sends automatic DNS queries to update servers. If it fails to receive a response 10 times within 1 minute, it marks the Web Filter as "unreliable" and disables categorization. Invalid Authorization : This often stems from an expired

key token (which typically expires after 21 days) or incorrect DNS forwarding settings. License Issues

: The Web Filter requires a specific license. If the license is expired or not properly registered, options in the "Applications and Web Categories" tab will be unavailable. support.keriocontrol.gfi.com Steps to Fix Disable Reliability Detection (SSH)

If the issue is caused by intermittent DNS timeouts, you can disable the reliability check via the SSH console Connect to the console (e.g., using Putty). Navigate to the directory: cd /opt/kerio/winroute Run the command: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart Adjust DNS Forwarding

"Invalid Authorization" errors can occur when using Google's DNS. It is recommended to use Cloudflare (1.1.1.1) OpenDNS (208.67.222.222) as custom DNS forwarding servers for *.zvelo.com Manual Re-activation Content Filter Applications and Web Categories Enable Kerio Control Web Filter is checked. to force a refresh. Verify License Status

section to ensure your license is valid and that the "Web Filter" module is included. If you have recently renewed, you may need to download the license file and register it again. support.keriocontrol.gfi.com Do you need the specific SSH commands

for a different version of Kerio Control, or should I help you troubleshoot your DNS forwarding

Web Filter categorization disabled. Serial number: ko-197974

The error message "Kerio Control Web Filter is not activated, and categorization is disabled" occurs when the system can no longer reach its update/categorization servers, often due to DNS timeouts or authorization failures. Solution 1: Disable Reliability Detection (Technical Fix)

Kerio Control has a built-in safety mechanism that disables the Web Filter if it fails to reach update servers 10 times in a row within one minute. You can override this via the SSH console: Log in via SSH to the Kerio Control console. Navigate to the directory:cd /opt/kerio/winroute

Run the update command to disable the reliability check:./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service:/etc/boxinit.d/60winroute restart Solution 2: Resolve "Invalid Authorization" DNS Issues

If your logs show FAILURE: Invalid authorization, your DNS servers may be failing to resolve the Zvelo categorization service.

Change DNS Forwarders: Avoid using Google DNS (8.8.8.8) as your primary forwarder for this service. Instead, set Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for the *.zvelo.com domain.

Reboot: After modifying DNS settings, a system reboot is recommended to clear cached authorization tokens that typically expire every 21 days. Solution 3: Verify License Status

The Web Filter is a separate licensed module. If your Kerio Control license has expired or was not properly activated, the module will automatically disable itself.

Go to Dashboard > License to check the status of the "Web Filter" module.

If you recently reinstalled, ensure you have completed the Activation Wizard. Quick Verification Steps

System Health: Check Status > System Health for any reported DNS timeouts or license errors.

Enable Predefined Rules: Ensure the "Kerio Control Web Filter categories and applications" rule is enabled under Content Filter > Content Rules. Perform these quick checks to save time:

Are you seeing any specific DNS timeout or authorization errors in your Warning or Error logs?

Web Filter categorization disabled. Serial number: ko-197974

In the world of network management, few things are as frustrating as seeing a "Not Activated" status on a tool you rely on. Here is the story of how the Kerio Control Web Filter's categorization issue—a common headache for admins—is typically diagnosed and fixed. The Situation Everything seems fine until the administrator logs into the Kerio Control Webadmin and sees a warning:

"Kerio Control Web Filter is not activated. Categorization is disabled."

Suddenly, the dynamic database that rates and blocks content is offline, leaving the network vulnerable or causing intermittent connectivity for users. The Investigation The admin digs into the Error logs and finds a recurring message:

"DNS response timeout, Kerio Control Web Filter categorization disabled"

The system reveals its logic: Kerio Control sends automatic DNS queries to reach update servers. If these fail 10 times in a row within a single minute, the filter decides it can't be trusted and shuts down its categorization engine. This is often caused by: DNS Reliability

: The default ISP DNS servers might be throttling requests from the filter, which makes frequent calls to services like for page ratings. License Hiccups

: The Web Filter requires a specific license. If it's a new install, the 30-day trial may have expired, or a subscription renewal might be overdue. The administrator follows a documented GFI Support solution to bring the system back to life: Switching DNS Providers

: To prevent future timeouts, they move away from ISP DNS and configure Custom DNS forwarding using reliable servers like Cloudflare (1.1.1.1) Disabling Reliability Detection

: If the filter stays "disabled" even after the network is fixed, the admin logs into the Kerio console via

and runs a command to reset the timers and disable the sensitive reliability check: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Manual Re-activation : Once the backend is stable, they return to the Applications and Web Categories tab and re-check Enable Kerio Control Web Filter

With the reliability check silenced and the DNS queries flying through, the status indicator finally turns green. The filter is active, categorization is restored, and the network is back under control. Are you seeing a specific message or a DNS timeout error in your Kerio Control console? AI responses may include mistakes. Learn more Using Kerio Control Web Filter

After applying the relevant solutions, verify success:

| Item | Expected Status | |------|----------------| | License → Web Filter | Licensed | | Web Filter → Categorization | Enabled (green) | | Last update | Within 24 hours | | Test a known category | e.g., facebook.com → Shows Social Networking |

If the error persists even after all eight fixes, contact GFI Support and attach the categorization.log file from /var/log/kerio/control/ or categorization folder. Provide them with:

If you manage a network using Kerio Control (now part of GFI Software), you rely on its web filtering capabilities to enforce acceptable use policies, block malware domains, and regulate bandwidth. So, it’s more than a little alarming when you log into the administration interface and see the dreaded red or orange alert:

"Web Filter is not activated. Categorization is disabled."

This error means that Kerio Control cannot connect to the cloud-based URL categorization service, or that the local database is corrupted/present. As a result, your firewall falls back to basic filtering or no filtering at all, rendering your security policies useless.

In this guide, we will explore why this error occurs and provide a step-by-step troubleshooting sequence to restore full web filtering functionality.