Kerio Control Web Filter Is Not Activated Categorization Is Disabled Fixed Today

Ensure you are running the latest version of Kerio Control. Check for updates and install the latest version if necessary.

If you have performed all the steps above and the error persists, it’s time to escalate. Gather the following before contacting support:

GFI Support may provide a hotfix or a script to manually reinitialize the categorization engine.

The error "Kerio Control Web Filter is not activated. Categorization is disabled" is almost always resolvable without reinstalling the entire firewall. In most cases, the root cause is either a simple licensing expiration, a DNS failure, or a corrupted local database.

By systematically working through the fixes – from restarting the service to forcing a database update and verifying outbound connectivity – you can restore full categorization. Once fixed, your web filtering policies (blocking adult content, social media during work hours, or malicious sites) will function correctly again.

Don’t let a disabled web filter leave your network exposed. Use this guide to diagnose, repair, and prevent the problem from returning.

Related Articles:

Last updated: October 2025 – Valid for Kerio Control 9.4.x and GFI Kerio Control 10.x.

Kerio Control Web Filter Not Activated: Categorization Disabled

If you're encountering the issue where the Kerio Control web filter is not activated and categorization is disabled, there are steps you can take to resolve this.

Understanding the Issue

The Kerio Control web filter is a crucial component of the Kerio Control software, which provides comprehensive internet content filtering and security. When the web filter is not activated, and categorization is disabled, it can lead to inadequate protection against malicious websites and inappropriate content.

Causes of the Issue

Some common causes of this issue include:

Steps to Resolve the Issue

To fix the issue where the Kerio Control web filter is not activated and categorization is disabled:

Additional Troubleshooting Tips

By following these steps and ensuring that your Kerio Control software is correctly configured, you should be able to resolve the issue of the web filter not being activated and categorization being disabled.

This report outlines the causes and solutions for the error where Kerio Control Web Filter is reported to be not activated, and categorization is disabled. This issue typically stems from connectivity failures, authorization timeouts, or expired security tokens used by the Zvelo categorization engine. 1. Root Causes

The "not activated" status is usually a protective state triggered by one of the following:

Authorization Failure: Use of an expired Zvelo key token (tokens typically expire after 21 days).

Reliability Detection: Kerio Control automatically disables the filter if it fails 10 consecutive DNS check queries within one minute, deeming the connection unreliable.

License Issues: An expired license or trial period (30 days) will automatically disable the Web Filter module.

DNS Issues: Incorrect DNS forwarding settings or slow Internet link speeds can prevent communication with Kerio update and Zvelo categorization servers. 2. Resolution Steps A. Adjust DNS Forwarding (Recommended)

Poor DNS performance often causes "Invalid Authorization" errors. Configuring reliable external DNS servers for Zvelo-specific traffic is a primary fix. Navigate to DNS section in the Kerio Control Web Admin. Enable Custom DNS forwarding. Ensure you are running the latest version of Kerio Control

Add the URL *.zvelo.com and point it to a reliable DNS provider like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222). Reboot the Kerio Control appliance to apply changes. B. Disable Reliability Detection via SSH

If the filter remains disabled due to network instability, you can manually disable the "Reliability" check.

Enable SSH: Hold Shift and navigate to Status > System Health, then click Enable SSH. Connect to the console using a tool like Putty. Execute the following commands:

cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard

This forces the system to keep the Web Filter active regardless of DNS response timeouts. C. Verify License Activation Ensure the Web Filter module has a valid license. Check the License Registration status on the dashboard.

If your firewall cannot reach the internet, perform an offline registration by importing a .key file through the Configuration Assistant. 3. Verification of Fix

Warning Logs: Check for the absence of "Invalid authorization" or "Unable to categorize" entries.

WebAdmin Status: Navigate to Content Filter > Applications and Web Categories and ensure the Enable Kerio Control Web Filter checkbox is checked and active.

Do you need help enabling SSH or locating your license key to proceed with these steps?

Web Filter categorization disabled. Serial number: ko-197974

The error message "Kerio Control Web Filter is not activated, and categorization is disabled" occurs when the system can no longer reach its update/categorization servers, often due to DNS timeouts or authorization failures. Solution 1: Disable Reliability Detection (Technical Fix)

Kerio Control has a built-in safety mechanism that disables the Web Filter if it fails to reach update servers 10 times in a row within one minute. You can override this via the SSH console: Log in via SSH to the Kerio Control console. Navigate to the directory:cd /opt/kerio/winroute GFI Support may provide a hotfix or a

Run the update command to disable the reliability check:./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service:/etc/boxinit.d/60winroute restart Solution 2: Resolve "Invalid Authorization" DNS Issues

If your logs show FAILURE: Invalid authorization, your DNS servers may be failing to resolve the Zvelo categorization service.

Change DNS Forwarders: Avoid using Google DNS (8.8.8.8) as your primary forwarder for this service. Instead, set Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for the *.zvelo.com domain.

Reboot: After modifying DNS settings, a system reboot is recommended to clear cached authorization tokens that typically expire every 21 days. Solution 3: Verify License Status

The Web Filter is a separate licensed module. If your Kerio Control license has expired or was not properly activated, the module will automatically disable itself.

Go to Dashboard > License to check the status of the "Web Filter" module.

If you recently reinstalled, ensure you have completed the Activation Wizard. Quick Verification Steps

System Health: Check Status > System Health for any reported DNS timeouts or license errors.

Enable Predefined Rules: Ensure the "Kerio Control Web Filter categories and applications" rule is enabled under Content Filter > Content Rules.

Are you seeing any specific DNS timeout or authorization errors in your Warning or Error logs?

Web Filter categorization disabled. Serial number: ko-197974

If you want, I can create specific command examples and the exact categorization hostnames for your Kerio version—tell me the Kerio Control version and whether it sits behind an upstream proxy or firewall. The error "Kerio Control Web Filter is not activated

Here’s a useful, concise fix for the issue: Kerio Control web filter not activating with “categorization is disabled.”