Direct answer
For the TP-Link Archer BE900 Wi-Fi 7 router, target identity, randomized MAC, time zone, DNS/VPN bypass and overlapping profiles should be separated. First, test a known restriction during and outside the schedule.
What this covers
- TP-Link Archer BE900 Wi-Fi 7 router (Archer BE900)
- TP-Link router/Deco; EasyMesh/Deco controller, Wi-Fi generation, HomeShield and Ethernet ports vary.
- The specific fault this record addresses: parental controls or schedules are not working
What it does not cover
- ×The same symptom on a different TP-Link product line, which has its own record and its own cited source
- ×An on-screen error code whose meaning has not been checked against this exact model's manual
- ×Live electrical, gas, sealed-system, internal battery-cell or structural repair — a technician boundary, not a self-service step
Differential
What actually causes this, and how to tell them apart
These are ordered by how often each one is the answer, not by how easy it is to try. The point of the middle column is that two causes producing the same headline symptom rarely produce the same detail — that detail is what tells you which one you have before you change anything.
- 1
The device is on the wrong profile or not assigned at all
What separates it A child's new or second device is unfiltered, or an adult device is being filtered.
How to confirm Confirm every device you intend to control is assigned to the correct profile — a device the router does not recognise falls outside the rules.
- 2
The device is bypassing the filter with encrypted DNS or a VPN
What separates it Filtering works on some devices but a particular phone or browser reaches blocked sites anyway.
How to confirm Check for a VPN app or a browser's secure/encrypted DNS (DoH) setting, which routes lookups around the router's filter; disable those on the managed device or use a control method that handles them.
- 3
The schedule or time limit is set wrong
What separates it Access is blocked or allowed at the wrong times, or a pause does not take effect.
How to confirm Check the schedule's days, times and time zone; an off-by-one time zone or a schedule on the wrong profile is a common cause.
- 4
The category or site list does not cover the target
What separates it A specific site is not blocked despite category filtering being on.
How to confirm Add the specific site to the block list; category filters do not catch every site, and new sites lag the categories.
Before you touch a setting
Record this first — changing settings destroys the evidence
Every item below stops existing the moment a reset, re-pair or settings change is made. Written down first, they are what separates the causes above; recovered afterwards, they are guesswork.
- Which profile the device is assigned to, and whether every device is assigned.
- Whether a VPN or encrypted/secure DNS is active on the device bypassing the filter.
- The schedule's exact days, times and time zone.
Confirm every managed device is on the correct profile
ReversibleAn unassigned or misassigned device falls outside the rules entirely.
Check the device for a VPN or encrypted DNS that bypasses filtering
ReversibleThis is the most common reason a block appears not to work.
Verify the schedule's days, times and time zone
ReversibleA wrong time zone or profile makes limits fire at the wrong time.
Add specific sites the categories miss, and confirm on the device
ReversibleTest the actual blocked behaviour on the managed device.
Model-specific
What is true of this model and not of its siblings
Generic advice for the product line fails here. Each item below is a property of this specific model family that changes which of the steps above apply to you.
- Model scope
- Archer BE900. TP-Link router/Deco; EasyMesh/Deco controller, Wi-Fi generation, HomeShield and Ethernet ports vary.
- Wi-Fi 7 quad-band router (single unit)
- TP-Link's flagship Wi-Fi 7 (BE) router with 2.4/5/6 GHz (quad-band on this model). Wi-Fi 7/6 GHz benefits need Wi-Fi 7/6E clients; older devices use 5/2.4 GHz normally.
- 6 GHz short-range + WPA3
- 6 GHz is fastest but short-range and needs WPA3; devices drop to 5 GHz at distance, which is normal. For whole-home coverage, add OneMesh/Deco or place centrally.
- Managed by Tether app or web
- Set up via the TP-Link Tether app or the web admin page.
- Symptom boundary
- This record covers TP-Link Archer BE900 Wi-Fi 7 router when it parental controls or schedules are not working. A different symptom on the same hardware, or this symptom on a different TP-Link product line, has its own record with its own causes and its own cited source.
Stop boundary
When this stops being a self-service repair
Continuing past any one of these costs more than the repair saves — in safety, in warranty, or in evidence a technician needs.
- !Parental controls are a helpful layer, not a guarantee — do not rely on them alone for a determined user, and pair them with conversation and device-level settings.
Evidence ledger
Sources behind this answer
Visible sources support the visible claims. Home Product Support records the publisher, the fact used and the review date; community reports can suggest an issue but do not become a published fact on their own.
Where the manufacturer's article stops. TP-Link publishes this as "How to configure Parental Control on TP-Link Wi-Fi Router". TP-Link's parental controls and schedule configuration. Probed 2026-08-21: title-verified. What that article does not carry is the model boundary — it is written for a product line, and Archer BE900 is the scope applied here. Where a control label, terminal, indicator pattern or reset sequence differs on your unit, the manual for that exact model is the authority, not this page and not the article.
Exact questions
Common follow-ups
My devices connect but only at Wi-Fi 5/6 speeds on my Archer BE900.+
A device connects at its OWN highest Wi-Fi generation, not the router's — so a Wi-Fi 5 or Wi-Fi 6 phone or laptop will connect at Wi-Fi 5/6 even on a Wi-Fi 7 router, which is normal, not a fault. Only Wi-Fi 7 devices reach Wi-Fi 7 speeds, and only 6E/7 devices use the 6 GHz band. To benefit fully you need Wi-Fi 7 client hardware; the router is backward-compatible with everything else.
My parental controls aren't blocking anything on my kid's phone.+
The most common reason is that the phone is routing around the router's filter — either through a VPN app or through a browser's secure/encrypted DNS (DoH) setting, both of which hide the lookups from the router. Check the managed device for those and turn them off, and confirm the phone is actually assigned to the child's profile in the router; a new or unrecognised device that is not assigned falls outside every rule.
Does this answer apply to every TP-Link model?+
No. It is scoped to Archer BE900. TP-Link router/Deco; EasyMesh/Deco controller, Wi-Fi generation, HomeShield and Ethernet ports vary.
What should I record before troubleshooting parental controls or schedule?+
Record the complete model identifier, exact message or indicator, software/firmware where visible, the operating stage and what still works.
Why is a factory reset not the first step?+
A reset can erase accounts, networks, maps, schedules or preferences without distinguishing parental controls, schedule. The ordered checks preserve that evidence.
When should I stop and use qualified service?+
Do not rely on consumer filtering as the sole supervision or safety measure.
Answer for the exact device and software version shown above.