On an iPad the reliable route without Screen Time is DNS filtering — set it on the iPad's Wi-Fi settings or on your router, and every browser and app on the device is filtered, including Safari, Chrome and in-app webviews. Apple's other built-in option, a restrictions profile, needs a Mac and Apple Configurator.
Option A — DNS filter (15 minutes, free). Install NextDNS, CleanBrowsing or Cloudflare for Families. Easiest: Settings → Wi-Fi → (i) next to your network → Configure DNS → Manual → add the filter's addresses. For a family iPad that travels, install the filter's app so it also works on cellular. You get category blocking plus a domain log.
Option B — Apple Configurator profile (strongest). On a Mac, Apple Configurator 2 → new profile → Restrictions → Web Content → "Allow only these websites" or "Limit adult websites", then install it on the iPad and set a passcode. The child cannot remove it without erasing the device.
Option C — Guided Access. Settings → Accessibility → Guided Access lets you lock the iPad into one app with a passcode, which is the simplest way to hand a young child a device for 30 minutes.
What none of these do: they do not touch YouTube's own recommendations, TikTok's feed or messages, because those are apps, not websites. Use the app's own parental settings for those.
Where our app fits. Ultimate Phone Spy runs on Android 4.0+, Windows and macOS (features) — no iPad product, so the DNS filter is what I would set up tonight.