← All guidesCanopy Families
Security guide6 min read

How to set up parental controls on TP-Link Deco

TP-Link Deco mesh systems are popular in UK homes for their ease of setup and whole-home Wi-Fi. The Deco app includes a HomeCare parental controls feature with content filtering, website blocking, and time scheduling. Combined with NextDNS DNS-over-HTTPS, it's one of the strongest out-of-the-box parental control setups available without specialist hardware.

Before you start
  • Most Deco management is done through the Tether app — ensure your Tether account password is secure and two-factor authentication is enabled.
  • DoH support requires firmware 1.3.0 or later on most Deco models. Update via the Tether app before configuring DNS settings.

Step 1 — Access Deco settings via the Tether app

  1. Download the TP-Link Tether app on your phone (search "TP-Link Tether" in the App Store or Google Play).
  2. Log in with your TP-Link ID.
  3. Select your Deco network.
  4. You can also access the web admin panel at http://tplinkwifi.net or http://192.168.0.1 from a browser on your network.

Step 2 — Update firmware

  1. In the Tether app, tap your Deco network → More → Update.
  2. Install all available firmware updates.
  3. Wait for the Decos to restart.

Step 3 — Secure the Tether account

  1. In the Tether app, tap your profile icon → Account Security.
  2. Enable Two-factor Authentication (2FA).
  3. Ensure you are using a unique, strong password for your TP-Link ID.

Step 4 — Configure DNS-over-HTTPS with NextDNS

  1. Create a free NextDNS account at nextdns.io and note your Profile ID.
  2. In the Tether app, go to Internet → DNS Settings or Advanced → DNS Settings.
  3. Enable DNS-over-HTTPS.
  4. Enter your NextDNS DoH URL: https://dns.nextdns.io/[YOUR_PROFILE_ID].
  5. Alternatively use plain DNS: Primary 45.90.28.159, Secondary 45.90.30.159. Note: if you're a Canopy Pro member, use your personalised DNS addresses from your Safety dashboard instead.
  6. Save.
With DoH enabled, DNS queries are encrypted at the router level. Devices cannot bypass NextDNS filtering by changing their own DNS settings.

Step 5 — Enable HomeCare parental controls

  1. In the Tether app, tap Homeshield (or HomeCare on older models).
  2. Enable Parental Controls.
  3. Add your children's devices to a profile for each child.
  4. Set Content Filter to filter age-inappropriate websites.
  5. Enable Time Limits to restrict daily screen time.
  6. Enable Bedtime to block internet access during night hours.
HomeCare basic features are free. Advanced reporting and some filter categories require a Homeshield Pro subscription.
🌳

Want Canopy to manage this for you?

Canopy Families guides parents through every security step — DNS setup, device controls, and content filtering — and keeps your protection up to date as your children grow.

Start free — takes 5 minutes