url-class / HomeShield still running after disabling features - Factory Reset fix?
Issue:
Even after disabling all HomeShield features (Malicious Site Blocker, Intrusion Prevention, IoT Protection) and rebooting, my router logs show the url-class security engine is still actively intercepting and classifying traffic. This appears to be causing noticeable latency/sluggishness when initiating new web connections.
Relevant Log Entries (repeating every few seconds, continuously):
daemon.err url-class[10785]: after send to auc
daemon.err url-class[10785]: security:element type is not option:2 p_uci_str is security, p_value is
The after send to auc entry indicates the router is still sending URLs to the Avira URL Classification (AUC) cloud service. The security:element type is not option:2 error suggests a misconfiguration in the security module — yet the process continues running regardless.
What I have already tried:
- Disabled all HomeShield toggles in the Deco app (Security tab)
- Disabled Fast Roaming / Mesh Technology
- Disabled QoS
- Set DHCP DNS to Google (
8.8.8.8/8.8.4.4) - Multiple reboots after each change
- Checked for a "Secure DNS" or "DNS over TLS" setting — not available on my model
None of the above stopped the url-class process from running.
My Questions:
- Is this a known firmware bug where the HomeShield subsystem remains "hooked" into traffic even when all toggles are disabled?
- Would a Factory Reset, followed by setup as a new network without ever activating HomeShield, prevent this process from running?
- Is there any other way to fully disable the
url-class/ AUC process short of a factory reset?
Any insight from TP-Link staff or community members who have experienced this would be greatly appreciated. Thank you.
