← All guidesCanopy Families
Security guide7 min read

How to set up parental controls on Virgin Media Hub

Virgin Media Hub 3, 4 and 5 settings are model-specific. Virgin’s Essential Security supplies its account-level web controls. Canopy-managed NextDNS needs a verified compatible-router DNS path; Device Setup currently covers separate OS controls, not Canopy DNS installation.

By James Mackie, Canopy Families founder · How we research and review guides

Before you start
  • After changing router settings or resetting a hub, recheck the intended device and connection. A factory reset removes customised hub settings.
  • Hub 5 users in Modem Mode: your hub acts as a pass-through to a separate router. DNS settings must be applied to that router, not the Hub 5.
  • Hub 5x is a different model from Hub 5. Virgin currently excludes Hub 5x from its modem-mode instructions; do not apply the Hub 5 route to it.
  • Virgin Essential Security is linked to your Virgin Media account — secure your account credentials so it cannot be disabled by another household member.

Step 1 — Identify your Virgin Media Hub

  1. Check the model name printed on the base or rear label. It should say Hub 3, Hub 4 or Hub 5.
  2. If you use a separate Wi-Fi router, check whether the Virgin Hub is in Modem Mode; the separate router then controls Wi-Fi and DNS.
  3. Keep the settings password from the hub label available. It is different from the Wi-Fi password.
Virgin’s Connect app can also show the hub linked to the account, but the physical label is the clearest check before following model-specific instructions.

Step 2 — Log into the Virgin Media Hub admin panel

  1. Connect a device to your Virgin Media Wi-Fi.
  2. Open a browser and go to http://192.168.0.1.
  3. Enter your saved settings password, or the default on the bottom of the hub if unchanged. This is separate from the Wi-Fi password.
  4. Click Sign in.
Virgin documents 192.168.100.1 for a hub already in Modem Mode. Otherwise confirm the exact model and the default gateway in your device’s network settings if 192.168.0.1 does not load.

Step 3 — Change the default admin password

Use your saved settings password or your own hub’s unchanged default; a generic password from an older online guide is not a reliable credential.
  1. Open Virgin’s current password-change guide, select your exact hub, and choose Change Hub’s settings password.
  2. Follow the route shown for that model; do not confuse the admin settings password with the Wi-Fi passphrase.
  3. Enter a new strong password (12+ characters) and confirm it.
  4. Save changes and log back in.

Step 4 — Verify Wi-Fi encryption settings

  1. Virgin documents Advanced settings → Wireless → Security. Check that route against your exact model.
  2. Keep at least WPA2-PSK. Use WPA3 or WPA2/WPA3 only if your exact model offers it and your devices are compatible.
  3. Update your Wi-Fi passphrase if it is still the factory default.
  4. Apply and reconnect devices.

Step 5 — Create a guest Wi-Fi network

  1. Follow Virgin's guest-network instructions for your exact hub. Hub 3 and 4 use Modify your guest network; Hub 5 uses the guest-network options under Advanced settings.
  2. Enable the guest network and record the name and password shown by the hub.
  3. Review how long the guest network will remain available, then finish the setup.
  4. If moving a smart TV, console or speaker, first check whether it needs to communicate with a phone or other device on the main network. Isolation can stop casting and local controls.

Step 6 — Connect Canopy-managed NextDNS

Modem Mode disables the Virgin Hub’s normal routing and Wi-Fi functions. Have the replacement router connected and its instructions available before switching modes.
  1. Start a Canopy Families full-access subscription or 14-day trial; the managed NextDNS profile is included.
  2. Virgin’s current Hub guidance does not document a custom-DNS setting for Hub 3, 4 or 5.
  3. For separate OS controls, review Home Safety → Device Setup; it does not install Canopy DNS. For Canopy-managed filtering, use a compatible router with a confirmed DNS-server menu, or ask for help. Enter Canopy IPv4 addresses only if Home Safety displays a validated family-specific pair.
  4. Return to Home Safety and use Check profile traffic. A positive check confirms recent profile traffic, not coverage for every device.

Step 7 — Enable Virgin Essential Security

  1. Go to my.virginmedia.com and sign in with your Virgin Media account.
  2. Open Account Settings and find Essential Security or Parental Controls.
  3. Switch on the categories and website controls appropriate for your family.
  4. Use the Virgin Media Connect app if you also want to pause a device’s broadband access.
  5. After saving, check the result on a device using your Virgin broadband connection. Mobile data and other networks need separate controls.
Virgin renamed the former Web Safe service to Essential Security. Menu labels can change, so follow Virgin’s current account instructions rather than an older Web Safe screenshot.

What Virgin Media parental controls can and cannot do

  1. Essential Security can block selected website categories on the Virgin broadband connection.
  2. The Connect app can pause broadband access for a selected device, but that is not the same as filtering every type of content inside an app.
  3. Mobile data, a VPN, encrypted DNS configured on a device, and some in-app content can bypass home-network controls.
  4. Use device-level controls and clear family rules alongside network filtering; test both a blocked and an allowed site after setup.

The sources below informed this editorial review. Router menus and service features vary by model, firmware and account. A documentation check is not a hardware test or confirmation of Canopy support.

Explore Canopy Families

Full access includes a managed NextDNS profile and parent dashboard. Filtering needs an available setup method validated for your exact router; a profile traffic check does not confirm every device or mobile connection.

£9.99/month after an eligible 14-day trial. A payment card is required at checkout; the paid subscription starts after the trial unless you cancel. A limited free plan is also available: five sessions per week and one child profile, without managed NextDNS filtering.

Create an account to choose your plan