Kerio Control Web Filter Is Not Activated Categorization Is Disabled Hot !new!

The message "Web Filter categorization is disabled" usually occurs when Kerio Control loses its connection to the

rating servers or detects a reliability issue with the DNS response support.keriocontrol.gfi.com Immediate Fixes Restart the Engine

: Often, simply restarting the Kerio Control engine or the entire appliance restores internet access and re-activates the filter. Check DNS Forwarders

: If you use Google DNS (8.8.8.8), the filter might fail due to "Invalid Authorization" tokens. It is recommended to use Cloudflare (1.1.1.1) (208.67.222.222) for better compatibility with Zvelo. Verify Licensing

: The Web Filter requires a specific license. If your license has expired or you are past the 30-day trial, the categorization features will be automatically disabled. support.keriocontrol.gfi.com Advanced Troubleshooting (via SSH)

If the filter remains disabled, it may be due to "Reliability Detection" shutting it down after too many failed DNS queries. You can disable this check manually: Log in to the console Navigate to the installation directory cd /opt/kerio/winroute Disable Reliability Detection and reset the timers by running: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service /etc/boxinit.d/60winroute restart support.keriocontrol.gfi.com Essential Settings to Check Enable the Filter : Ensure the box is actually checked under Content Filter > Applications and Web Categories Content Rules

: Verify that you have at least one rule that utilizes "Applications and Web Categories." The filter often only activates when a rule specifically asks for a category classification.

: Ensure your system time is accurate and synchronized with an NTP server, as mismatched times can cause license and certificate errors. GFI Support exact SSH commands

for a specific version of Kerio Control, or do you need help verifying your license status The message "Web Filter categorization is disabled" usually

Web Filter categorization disabled. Serial number: ko-197974

“Kerio Control Web Filter is not activated. Categorization is disabled.”

Conclusion

The error "Kerio Control Web Filter is not activated. Categorization is disabled" is almost always solvable by methodically checking license status, outbound connectivity, DNS, system time, and cache integrity. In 90% of cases, either a expired license, a local DNS misconfiguration, or a corrupted cache is to blame.

Start with Step 1 (check license) and Step 5 (DNS) – these resolve the majority of "hot" support tickets. For persistent issues, enable debug logs and contact GFI support with the output.

By following this guide, you should restore full URL categorization within 30 minutes and prevent future recurrences through proactive monitoring.

Need further help?
Visit the GFI Support Portal or search the Kerio Control Knowledge Base. For real-time troubleshooting, check the #kerio-control channel on unofficial networking Discord servers.

Last updated: October 2025 – Compatible with Kerio Control 9.4.x and 10.x. Conclusion The error "Kerio Control Web Filter is

The error "Web Filter categorization is disabled" usually occurs when Kerio Control determines the categorization service (provided by ) is unreliable due to failed DNS checks

. By default, if Kerio Control fails to reach update servers 10 times in 1 minute, it disables categorization. support.keriocontrol.gfi.com Immediate Hotfix (via SSH)

To force the Web Filter back into an active state and prevent it from disabling itself due to "unreliability," you can disable the reliability check using the GFI Support recommended commands: Log in to the Kerio Control console via SSH (e.g., using Navigate to the configuration directory: cd /opt/kerio/winroute Disable the reliability detection and reset the status: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the Kerio Control engine: /etc/boxinit.d/60winroute restart support.keriocontrol.gfi.com Permanent Fixes & Troubleshooting

If the hotfix above does not resolve the issue permanently, check these configurations: Custom DNS Forwarding

: Using certain DNS servers (like Google's) for all traffic can sometimes interfere with Zvelo's authorization tokens. in the admin interface. Custom DNS Forwarding *.zvelo.com Cloudflare (1.1.1.1) or (208.67.222.222). the Kerio Control appliance after making this change. Check Winroute Config : Ensure the DiaServerUrl is correctly set. /opt/kerio/winroute/winroute.cfg , verify that the value is v4.url.zvelo.com Activation Verification Navigate to Content Filter Applications and Web Categories Enable Kerio Control Web Filter is checked. Test a URL in the field to see if it provides a category. License Issues

: If the filter shows "Invalid Authorization," your Zvelo token may have expired. This typically happens if the firewall cannot reach internal Kerio servers to refresh the 21-day token. GFI Support if the SSH command fails?

Web Filter categorization disabled. Serial number: ko-197974

The error message "Kerio Control Web Filter is not activated, categorization is disabled" typically occurs because the firewall has failed to reach the external categorization servers (zvelo.com) multiple times, causing it to mark the service as unreliable and disable it. Immediate Fixes Need further help

Wait 1 Hour: Kerio Control is designed to automatically attempt to revert to normal operation after one hour of the error occurring.

DNS Verification: Ensure your firewall can resolve external domains. It is recommended to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for *.zvelo.com URLs to avoid authorization failures.

Check License Status: If your Kerio Control or Web Filter subscription has expired, the web filter will be automatically disabled. You can check this in the Dashboard or License section of the GFI administration interface. Technical Workaround (SSH)

If the web filter remains disabled after an hour and DNS settings are correct, you can manually reset the reliability detection via SSH: Connect via SSH to your Kerio Control console.

Execute the following commands to disable the reliability check and restart the service:

cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard

Note: This forces the filter to stay active even if it has trouble reaching the update servers. Configuration Check

Navigate to Content Filter > Applications and Web Categories. Ensure Enable Kerio Control Web Filter is checked.

Verify that you have at least one Content Rule active that requires categorization; the filter often only "activates" when a rule is processing traffic. Using Kerio Control Web Filter - KerioControl - GFI

Preventive steps

What is Kerio Control Web Filter?

Kerio Control includes a cloud-based or locally cached URL categorization database. Unlike simple domain blacklists, the Web Filter evaluates the content category of a requested URL (e.g., facebook.com → "Social Networking"). Firewall rules can then allow or deny traffic based on these categories.