← All guidesCanopy Families
Security guide6 min read

How to set up parental controls on TP-Link Deco

TP-Link Deco mesh systems are managed through the Deco app. Parental-control features and subscriptions vary between HomeShield and older HomeCare models, while custom IPv4 DNS is configured in the network’s advanced settings.

By James Mackie, Canopy Families founder · How we research and review guides

Before you start
  • Deco systems use the Deco app, not the TP-Link Tether app used by many Archer routers. Keep the TP-Link ID secure and enable two-factor authentication where offered.
  • Menu names and HomeShield features vary by Deco model and firmware. Check the model number in the app before changing settings.
  • In Access Point mode, gateway features such as custom IPv4 settings and parental controls may be unavailable. Check current model and firmware support; the main router controls DNS in that setup. Do not change operating mode just to reveal a menu without checking the network design.

Step 1 — Access settings in the Deco app

  1. Download the TP-Link Deco app on your phone.
  2. Log in with your TP-Link ID.
  3. Select your Deco network.
  4. Confirm the model number shown in the app before following model-specific options.

Step 2 — Update firmware

  1. In the Deco app, tap More → System → Update Deco.
  2. Install all available firmware updates.
  3. Wait for the Decos to restart.

Step 3 — Secure the TP-Link account

  1. Open the TP-Link ID account-security settings from the Deco app.
  2. Enable Two-factor Authentication (2FA) where offered for your account and app version.
  3. Ensure you are using a unique, strong password for your TP-Link ID.

Step 4 — Connect Canopy-managed NextDNS

  1. Start a Canopy Families full-access subscription or 14-day trial; the managed NextDNS profile is included.
  2. If Home Safety displays a validated pair of family-specific IPv4 DNS addresses, check the custom DNS-server route in the current support instructions for your exact Deco model and firmware.
  3. Enter only the assigned addresses into a confirmed DNS-server field. If the pair or supported menu is absent, review separate OS controls in Device Setup and ask for a verified Canopy DNS method. Device Setup does not install Canopy DNS.
  4. Save, reconnect one device, then use Check profile traffic in Home Safety. A positive result verifies recent profile traffic, not every device.
TP-Link’s official Deco custom-DNS path does not establish universal DNS-over-HTTPS support. Treat encrypted DNS as model-specific unless the manual for your exact Deco says otherwise.

Step 5 — Check the parental controls and costs for your Deco model

  1. For a HomeShield model, open the Parental Controls tab in the Deco app and create a profile. For HomeCare models, follow the separate instructions for that model.
  2. Add your children's devices to a profile for each child.
  3. Set Content Filter to filter age-inappropriate websites.
  4. Check whether Time Limits and the bedtime options you want require the separate HomeShield Advanced Parental Controls subscription before enabling them.
  5. Test the selected schedule on the intended device. These router controls do not apply when a phone switches to mobile data.
HomeCare and HomeShield are different offerings. TP-Link's current HomeShield guide places time limits, off-time scheduling and some advanced controls behind Advanced Parental Controls. Those vendor charges are separate from Canopy; check the app's current model-specific features and price.

The sources below informed this editorial review. Router menus and service features vary by model, firmware and account. A documentation check is not a hardware test or confirmation of Canopy support.

Explore Canopy Families

Full access includes a managed NextDNS profile and parent dashboard. Filtering needs an available setup method validated for your exact router; a profile traffic check does not confirm every device or mobile connection.

£9.99/month after an eligible 14-day trial. A payment card is required at checkout; the paid subscription starts after the trial unless you cancel. A limited free plan is also available: five sessions per week and one child profile, without managed NextDNS filtering.

Create an account to choose your plan