This error typically indicates that your Kerio Control Web Filter has lost its connection to the Zvelo categorization servers or its license authorization has failed. This often happens due to DNS resolution timeouts or expired authorization tokens. Direct Solutions
DNS Stability (Most Common):Kerio Control disables the Web Filter if it fails 10 consecutive DNS checks within one minute.
Set your custom DNS forwarding servers for *.zvelo.com to Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222). Avoid using only Google DNS (8.8.8.8) as it can sometimes cause these authorization failures.
SSH "Hot-fix" to Restore Service:If the filter is stuck in a "disabled" state, you can manually reset it and disable the "Reliability Detection" that triggers the shutdown via SSH: Access the Kerio Control console via SSH. Run the following commands:
cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard
Check License & Maintenance:The Web Filter requires a separate module license.
Verify your Software Maintenance has not expired; if it has, the filter will stop receiving updates and eventually deactivate.
Ensure the DiaServerUrl in /opt/kerio/winroute/winroute.cfg is correctly set to v4.url.zvelo.com. Verification Steps Go to Content Filter > Applications and Web Categories. Ensure Enable Kerio Control Web Filter is checked.
Use the Test URL tool to see if categorization is live again. If you'd like, I can help you:
Walk through SSH access if you're unfamiliar with the console. Check your License status within the Kerio interface. This error typically indicates that your Kerio Control
Configure specific DNS forwarding rules to prevent this from happening again. Let me know which step you'd like to try first.
Web Filter categorization disabled. Serial number: ko-197974
The error "Web Filter categorization is disabled" usually occurs when Kerio Control determines the categorization service (provided by ) is unreliable due to failed DNS checks
. By default, if Kerio Control fails to reach update servers 10 times in 1 minute, it disables categorization. support.keriocontrol.gfi.com Immediate Hotfix (via SSH)
To force the Web Filter back into an active state and prevent it from disabling itself due to "unreliability," you can disable the reliability check using the GFI Support recommended commands: Log in to the Kerio Control console via SSH (e.g., using Navigate to the configuration directory: cd /opt/kerio/winroute Disable the reliability detection and reset the status: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the Kerio Control engine: /etc/boxinit.d/60winroute restart support.keriocontrol.gfi.com Permanent Fixes & Troubleshooting
If the hotfix above does not resolve the issue permanently, check these configurations: Custom DNS Forwarding
: Using certain DNS servers (like Google's) for all traffic can sometimes interfere with Zvelo's authorization tokens. in the admin interface. Custom DNS Forwarding *.zvelo.com Cloudflare (1.1.1.1) or (208.67.222.222). the Kerio Control appliance after making this change. Check Winroute Config : Ensure the DiaServerUrl is correctly set. /opt/kerio/winroute/winroute.cfg , verify that the value is v4.url.zvelo.com Activation Verification Navigate to Content Filter Applications and Web Categories Enable Kerio Control Web Filter is checked. Test a URL in the field to see if it provides a category. License Issues
: If the filter shows "Invalid Authorization," your Zvelo token may have expired. This typically happens if the firewall cannot reach internal Kerio servers to refresh the 21-day token. GFI Support if the SSH command fails?
Web Filter categorization disabled. Serial number: ko-197974 Verify license/subscription
“Kerio Control Web Filter is not activated. Categorization is disabled.”
Verify license/subscription
Confirm connectivity to update servers
Check system time
Examine logs for errors
Check disk space / resources
Restart Web Filter services
Force category database update
Verify policies and binding
Test from client
Check for known bugs / version issues
Contact vendor support
After resolution, confirm:
The keyword "hot" likely refers to the urgency of this issue. Because disabling categorization directly impacts security and compliance (e.g., allowing access to malware or explicit content), administrators need a hot fix immediately.
Before fixing the problem, you must understand the architecture. Kerio Control uses a cloud-based URL Database (formerly McAfee, now partially proprietary and third-party) to categorize websites (e.g., “Social Networking,” “Streaming Media,” “Phishing”).
When you see "Web Filter is not activated, categorization is disabled," the firewall has lost communication with that database or the licensing server. The "hot" tag usually refers to a transient, high-priority failure state—often indicating a timeout or a license reset that requires immediate re-activation.
If categorization is still disabled and users need immediate protection: Confirm connectivity to update servers