← All guidesCanopy Families
Security guide7 min read

How to set up parental controls on Sky Q Hub

Sky Broadband Shield provides network-level filtering, but older Sky Q Hubs need special care: Sky ended security updates for Q Hub models on 31 December 2025. This guide starts with that support check, then covers Shield and the supported route to Canopy-managed filtering.

By James Mackie, Canopy Families founder · How we research and review guides

Before you start
  • Sky Broadband Shield is tied to your Sky account. Ensure your Sky account password and email are secure — a child who accesses your account can turn the Shield off.
  • The Sky Q Hub admin panel at http://192.168.0.1 is only accessible from within your home network.
  • Changing your Wi-Fi password will disconnect all devices. Reconnect smart TVs and consoles using the new password before your children notice.
  • Sky Q Hub models stopped receiving security updates on 31 December 2025. Ask Sky about a supported replacement before relying on an older Q Hub.

Step 1 — Log into the Sky Q Hub admin panel

  1. Connect a device to your Sky Wi-Fi (not mobile data).
  2. Open a browser and go to http://192.168.0.1.
  3. For a Sky Q Hub, enter username "admin" and your saved admin password. Sky lists "sky" as the Q Hub default if it has not been changed; the Wi-Fi key on the label is not the same credential.
  4. Click Log in.
If the page does not load, check the default gateway in your device's network settings and confirm the exact hub model. Do not guess a different address from this guide.

Step 2 — Change the default admin password

The default admin passwords on Sky hubs are predictable. Changing it is the single most important security step.
  1. Open the current Sky instructions for changing the admin password on your exact hub.
  2. Follow the password-change route shown for that model; menus on newer Sky hubs differ from the Q Hub.
  3. Enter the current password, then set a new strong password.
  4. Save the change and log back in.

Step 3 — Enable WPA2 or WPA3 Wi-Fi encryption

  1. Go to Wireless Settings.
  2. Under Security, select WPA2-PSK (AES) or WPA3-Personal if your hub supports it.
  3. Change the Wi-Fi password to a strong passphrase — 16+ characters, mixed case and numbers.
  4. Apply and reconnect all devices with the new password.

Step 4 — Replace an unsupported Sky Q Hub

  1. Check the model on the hub label and compare it with Sky’s current router-update notice.
  2. If it is a Sky Q Hub, contact Sky and request a currently supported hub.
  3. Do not assume a generic Guest Network, WPA3, or custom-DNS menu exists on every Sky model.
Sky Max Hub and Gigafast+ Hub settings are managed through current Sky instructions; their menus differ from the older Q Hub.

Step 5 — Connect Canopy-managed NextDNS

Do not hunt for similarly named fields or enter DNS values into DHCP, gateway, or IP-address fields.
  1. Start a Canopy Families full-access subscription or 14-day trial; a managed NextDNS profile is included.
  2. Open Home Safety → Router Setup and select your exact Sky model.
  3. Sky does not document a universal custom-DNS route across Q, Max, and Gigafast+ hubs. Device Setup covers separate OS controls, not Canopy DNS installation. Use a verified compatible-router path or ask for help when your hub has no supported DNS menu.
  4. Use Check profile traffic in Home Safety. A positive check confirms recent profile traffic, not coverage for every device.

Step 6 — Enable Sky Broadband Shield

  1. Go to sky.com and sign in to My Sky.
  2. Navigate to My Account → Products & Services → Broadband.
  3. Find Broadband Shield and click Manage.
  4. Switch Shield On.
  5. Choose the restriction level and categories shown in your current Broadband Shield settings, using Sky's current help rather than labels from a different service.
  6. Save, then check the filtering on a device using your Sky broadband connection. Mobile data and other networks need separate controls.
Sky Broadband Shield is separate from Canopy-managed DNS. Follow Sky’s current guidance for its coverage and verify the devices and connections you want to protect.

The sources below informed this editorial review. Router menus and service features vary by model, firmware and account. A documentation check is not a hardware test or confirmation of Canopy support.

Explore Canopy Families

Full access includes a managed NextDNS profile and parent dashboard. Filtering needs an available setup method validated for your exact router; a profile traffic check does not confirm every device or mobile connection.

£9.99/month after an eligible 14-day trial. A payment card is required at checkout; the paid subscription starts after the trial unless you cancel. A limited free plan is also available: five sessions per week and one child profile, without managed NextDNS filtering.

Create an account to choose your plan