AssadPc

Kerio Control Web Filter Is Not Activated Categorization Is Disabled Fixed May 2026

The “Web filter not activated, categorization disabled” error in Kerio Control is almost always fixable. Most users resolve it by renewing their license or restarting the categorization service. For persistent cases, clearing the local database or re-synchronizing the system time works wonders. By following this guide, you’ll restore full URL filtering capabilities and keep your network safe from undesirable content.

Final thought: Regularly review your Kerio Control license portal and automate updates – a healthy web filter is a silent guardian that never needs emergency resuscitation.

When your Kerio Control Web Filter shows as "not activated" and categorization is disabled, it is typically caused by license issues, DNS resolution failures, or an expired Zvelo authorization token. 🛠️ Step-by-Step Fixes 1. Fix DNS Forwarding for Zvelo

The Web Filter uses Zvelo for categorization. If your DNS cannot resolve *.zvelo.com, the filter disables itself for reliability.

Recommendation: Avoid using Google DNS (8.8.8.8) for Zvelo queries, as it can cause "Invalid Authorization" errors.

Action: Go to DNS settings and configure Custom DNS forwarding for *.zvelo.com to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222).

Reboot: You must restart Kerio Control after changing these DNS settings to clear the cached status. 2. Disable "Reliability Detection" (SSH)

If your internet link is slow or unstable, Kerio may proactively disable the filter. You can force it to stay active via the SSH console: SSH into your Kerio appliance.

Navigate to the configuration directory: cd /opt/kerio/winroute. Run this command to disable reliability checks: ./tinydbclient "update SiteFilter set DetectReliability=0" Use code with caution. Copied to clipboard Restart the service: /etc/boxinit.d/60winroute restart. 3. Verify License & Module Activation

The Web Filter is a separate licensed module. If the license is missing or expired, the options will be greyed out.

Check Status: Look at the Dashboard license tile to ensure it's not in "Trial" or "Unregistered" mode.

Renewal: If you recently renewed, you might need to manually download the license file from the GFI Accounts portal and import it via the Registration Wizard. 4. Check Zvelo Token Expiry

The categorization token expires every 21 days. If Kerio cannot reach internal update servers to refresh it, authorization fails.

Ensure your firewall allows outgoing traffic on Port 443 (HTTPS) and Port 80 (HTTP) to Kerio's update servers.

💡 Quick Pro-Tip: If the filter is active but specific sites are still failing, try enabling HTTPS Decryption in the Content Filter settings; otherwise, the filter cannot see the full URL to categorize it.

If you're still having trouble, I can help you look at your logs. Could you tell me:

What specific error message appears in your Warning or Error logs?

Is your License currently showing as active or expired on the Dashboard? Which version of Kerio Control are you currently running?

Web Filter categorization disabled. Serial number: ko-197974

Mark paced the server room, the hum of the cooling fans doing little to soothe his nerves. The CEO was expecting a productivity report by noon, but the Kerio Control dashboard was mocking him with a persistent, red-lettered warning: “Web Filter is not activated; categorization is disabled.”

Without categorization, the firewall was blind. Employees could wander into the darkest corners of the internet, and Mark’s beautifully crafted security policies were nothing more than suggestions. The Investigation

Mark started with the basics. He knew the Web Filter relied on a live connection to Kerio’s cloud servers to identify if a site was "Social Media" or "Malware." Kerio Control includes web filtering only in paid

License Check: He verified the subscription was active. It was.

Connectivity: He pinged the Kerio update servers. The packets returned instantly.

DNS: He swapped the internal DNS for Google’s 8.8.8.8 to ensure the appliance wasn't lost in translation. Still, the status remained "Not Activated." The Breakthrough

He dove into the logs. Deep in the debug messages, he saw a recurring error: “Unable to verify SSL certificate for update server.”

The realization hit him—the system clock. Because of a recent power flick, the Kerio appliance had lost sync with the NTP server. It thought the year was 2010. The modern security certificates being sent by the Kerio cloud were "from the future" and therefore rejected as invalid. Mark didn't hesitate. He took three quick steps:

Manual Sync: He corrected the system time to the current second. NTP Refresh: He forced a synchronization with pool.ntp.org. Service Restart: He toggled the Web Filter off and back on.

💡 The Result: The red warning vanished. The "Categorization" status flipped to a steady, comforting green.

Mark sat back as the "Top Sites Visited" chart began to populate in real-time. The filter was back on guard, and the noon report was going to be perfect.

If you're dealing with this in real life, I can help you troubleshoot. Let me know: Is your license subscription currently valid? What version of Kerio Control are you running?

Do you see any "Certificate" or "Time Sync" errors in your logs?

Kerio Control includes web filtering only in paid licenses (Standard, Enterprise, or UTM). The free trial or a basic "Firewall only" license does not include categorization.

Steps:

  • If it shows Trial expired, Not licensed, or Invalid, you need to:

    • Important: Some legacy licenses (e.g., Kerio Control 7.x perpetual) do not include the categorization service. You may need to upgrade to a “Content Filtering” add-on.

    The error "Kerio Control Web Filter is reported to be not activated, and categorization is disabled" usually stems from invalid authorization (expired tokens) or DNS reliability issues. Fix 1: Resolve Invalid Authorization (Expired Zvelo Tokens)

    This error typically means an expired Zvelo key token (which expires every 21 days) is being used.

    Check DNS Forwarders: Do not use Google's DNS (8.8.8.8) as the primary forwarder for *.zvelo.com.

    Use Alternative DNS: Set Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for zvelo URLs.

    Verify Configuration: Access the SSH console and ensure the correct DiaServerUrl (v4.url.zvelo.com) is in /opt/kerio/winroute/winroute.cfg.

    Reboot: Restart the Kerio Control appliance after making DNS changes. Fix 2: Disable Reliability Detection via SSH

    If the Web Filter disables itself because of DNS timeouts, you can force it to stay active by disabling the reliability check. Log in to the Kerio Control console via SSH. Navigate to the winroute directory:cd /opt/kerio/winroute

    Execute the following command to disable detection:./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service:/etc/boxinit.d/60winroute restart. Fix 3: Basic License & Manual Re-activation If it shows Trial expired , Not licensed

    Verify License: Ensure your Kerio Control Web Filter license hasn't expired, as it will automatically disable after 30 days of trial or upon expiration.

    Toggle Settings: In the admin interface, go to Content Filter > Applications and Web Categories. Uncheck and then re-check Enable Kerio Control Web Filter, then click Apply.

    Web Filter categorization disabled. Serial number: ko-197974

    In the world of network management, few things are as frustrating as seeing a "Not Activated" status on a tool you rely on. Here is the story of how the Kerio Control Web Filter's categorization issue—a common headache for admins—is typically diagnosed and fixed. The Situation Everything seems fine until the administrator logs into the Kerio Control Webadmin and sees a warning:

    "Kerio Control Web Filter is not activated. Categorization is disabled."

    Suddenly, the dynamic database that rates and blocks content is offline, leaving the network vulnerable or causing intermittent connectivity for users. The Investigation The admin digs into the Error logs and finds a recurring message:

    "DNS response timeout, Kerio Control Web Filter categorization disabled"

    The system reveals its logic: Kerio Control sends automatic DNS queries to reach update servers. If these fail 10 times in a row within a single minute, the filter decides it can't be trusted and shuts down its categorization engine. This is often caused by: DNS Reliability

    : The default ISP DNS servers might be throttling requests from the filter, which makes frequent calls to services like for page ratings. License Hiccups

    : The Web Filter requires a specific license. If it's a new install, the 30-day trial may have expired, or a subscription renewal might be overdue. The administrator follows a documented GFI Support solution to bring the system back to life: Switching DNS Providers

    : To prevent future timeouts, they move away from ISP DNS and configure Custom DNS forwarding using reliable servers like Cloudflare (1.1.1.1) Disabling Reliability Detection

    : If the filter stays "disabled" even after the network is fixed, the admin logs into the Kerio console via

    and runs a command to reset the timers and disable the sensitive reliability check: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Manual Re-activation : Once the backend is stable, they return to the Applications and Web Categories tab and re-check Enable Kerio Control Web Filter

    With the reliability check silenced and the DNS queries flying through, the status indicator finally turns green. The filter is active, categorization is restored, and the network is back under control. Are you seeing a specific message or a DNS timeout error in your Kerio Control console? AI responses may include mistakes. Learn more Using Kerio Control Web Filter

    How to Fix "Kerio Control Web Filter is Not Activated, Categorization is Disabled"

    If you are seeing the error "Kerio Control Web Filter is not activated; categorization is disabled" in your Kerio Control administration interface, your network's content filtering has essentially been paralyzed. This error prevents the firewall from identifying website categories (like social media, gambling, or malware sites), meaning your custom URL rules won’t work.

    Here is a comprehensive guide to troubleshooting and fixing this issue. 1. Verify License Status and Maintenance

    The Kerio Control Web Filter is a premium add-on service powered by Cyren (or GFI, depending on your version). It requires a valid, active subscription. Check the Dashboard: Go to Status > License Details.

    Verify Expiration: Ensure that both the "Kerio Control" license and the "Web Filter" module are not expired. If your Software Maintenance Agreement (SMA) has lapsed, the categorization servers will refuse the connection from your appliance.

    Refresh License: Click Update License Info to force the appliance to check in with the GFI servers. 2. Check DNS Resolution on the Firewall

    The Kerio Control appliance must be able to resolve the addresses of the backend categorization servers. If the firewall itself cannot resolve DNS, the Web Filter will fail to activate. Troubleshooting update failures:

    Test DNS: Go to Status > System Health and use the Debug or Ping tool (or SSH into the box). Try to ping google.com or ://kerio.com.

    Fix DNS: Ensure your Kerio Control is using reliable DNS servers (like 8.8.8.8 or 1.1.1.1) under Configuration > DNS. 3. Clear the Web Filter Cache

    Sometimes the local database or cache becomes corrupted, leading the system to believe the service is inactive. Navigate to Configuration > Content Filter > Web Filter. Uncheck Enable Kerio Control Web Filter. Click Apply. Wait 30 seconds, re-check the box, and click Apply again.

    If this fails, you may need to clear the cache via the console by deleting the contents of the /var/winroute/webfilter/ directory (advanced users only). 4. Firewall Rules and Port Access

    If your Kerio Control is behind another router or ISP firewall, it must be allowed to communicate with the activation servers.

    Ports: Ensure HTTPS (Port 443) and HTTP (Port 80) are open for the firewall’s own outbound traffic.

    Protocols: Ensure that SSL inspection on a parent device isn't interfering with the Kerio appliance's encrypted handshake with GFI/Kerio servers. 5. Correct System Time and Date

    The Web Filter uses SSL/TLS certificates to communicate with categorization servers. If your Kerio Control system time is incorrect, the certificate validation will fail. Go to Configuration > Advanced Options > System Time.

    Ensure Use NTP server is checked and the time zone is correct. Even a five-minute discrepancy can cause the Web Filter to show as "not activated." 6. Update to the Latest Version

    GFI/Kerio frequently updates the URLs used for categorization and licensing. If you are running a very old version of Kerio Control, it may be trying to contact a retired server. Go to Advanced Options > Software Update.

    Check for updates and ensure you are running the most recent build compatible with your license. Summary Checklist Potential Cause Expired License Renew SMA or Web Filter subscription. Time Sync Issue Enable NTP and verify the correct Time Zone. DNS Failure Set Kerio to use 8.8.8.8 for system resolution. Server Timeout

    Toggle the Web Filter "Enable" checkbox to reset the connection.

    By following these steps, you should see the status change to "Activated" and your categorization rules will resume functioning immediately.

    Are you seeing any specific error codes in the Kerio Control Error Log when you try to enable the filter?

  • Go to Diagnostics → Ping / Traceroute to verify connectivity.

    • 💡 Without a valid license, categorization stays disabled.

    If you have performed all the steps above and the error persists, it’s time to escalate. Gather the following before contacting support:

    GFI Support may provide a hotfix or a script to manually reinitialize the categorization engine.

    After applying the relevant solutions, verify success:

    | Item | Expected Status | |------|----------------| | License → Web Filter | Licensed | | Web Filter → Categorization | Enabled (green) | | Last update | Within 24 hours | | Test a known category | e.g., facebook.com → Shows Social Networking |

    If the error persists even after all eight fixes, contact GFI Support and attach the categorization.log file from /var/log/kerio/control/ or categorization folder. Provide them with:

    Kerio downloads a local copy of the categorization database. If that database is outdated or corrupt, forcing a fresh download helps.

    Troubleshooting update failures: