URL Reputation is a risk classification – Trustworthy, Low Risk, Moderate Risk, Suspicious, or High Risk – that Versa Operating System (VOS) devices assign to a URL or IP address based on threat intelligence. Alongside URL category, it determines which security policy action – allow, block, alert, or redirect to a captive portal – a session receives.
Key takeaways
- URL reputation ranks a URL’s risk from Trustworthy to High Risk.
- VOS combines reputation with URL category and enforces the stricter rule.
- Predefined reputations come from Versa’s cloud database of 2 billion URLs.
- Administrators can define custom reputations and override predefined values.
- IP filtering can defer to URL reputation to avoid blocking safe sites.
On this page: Why it mattersHow it worksTypesURL Reputation & VersaFAQ
Why is URL Reputation important?
Categories alone are a blunt instrument. A website can sit in a legitimate category – Business, Technology, News – and still be compromised, newly registered for a phishing campaign, or hosting malware, long before anyone gets around to reclassifying it. URL reputation closes that gap: it scores the URL’s actual risk, independent of what it claims to be about, and lets a security policy react to threat intelligence rather than a static label.
That distinction matters most for the URLs a category-based policy would otherwise wave through. A compromised business site or a freshly registered lookalike domain used for credential phishing may carry a perfectly innocuous category, but its reputation flags it as Suspicious or High Risk. Evaluating category and reputation together – and enforcing whichever rule is more severe – is what lets a URL-filtering profile catch threats that categorization by subject matter alone would miss, without blocking entire legitimate categories outright.
What is URL Reputation?
On a VOS device, every requested URL can carry a reputation value alongside its category: Trustworthy, Low Risk, Moderate Risk, Suspicious, or High Risk, with Undefined as a fallback when no data exists. VOS looks this value up in a local database of up to 20 million URLs, or, when cloud lookup is enabled, in Versa’s cloud-based database of more than 2 billion categorized URLs – updated daily or in real time through security-package (SPack) updates.
Reputation and category are evaluated together, not independently. When a URL-filtering profile has separate rules for category and for reputation, and the two disagree – say, an Allow for the category but a Block for the reputation – VOS enforces whichever action is more severe. If neither predefined nor custom data is available for a URL, VOS falls back to a default reputation of Suspicious rather than treating the URL as safe by default.
Types of URL Reputation
VOS recognizes five graded reputation levels, ordered from safest to riskiest: Trustworthy, Low Risk, Moderate Risk, Suspicious, and High Risk – plus Undefined for URLs with no reputation data. Each level can be matched independently in a reputation action map, so a policy might allow Trustworthy and Low Risk traffic while blocking Suspicious and High Risk without touching the categories those URLs belong to.
Reputations also split by source. Predefined reputations come from Versa’s continuously updated URL database, refreshed through SPack updates. Custom (user-defined) reputations let administrators assign or override a reputation for specific URLs – by exact string or regex pattern, entered individually or uploaded as a CSV file – and when both exist for the same URL, VOS applies the higher-risk of the two results.
URL Reputation & Versa
URL filtering is where URL reputation does its work: a URL-filtering profile’s reputation action map lets administrators set an allow, block, alert, drop, or captive-portal action per reputation level, evaluated alongside the profile’s category action map with the more severe result winning. The same reputation model appears in NGFW URL-filtering profiles, and administrators can look up any URL’s live category and reputation directly from Director using the built-in Look Up URL tool.
Reputation also crosses into IP-based enforcement. In cloud firewall security policies, a geolocation IP-filtering profile can be configured to prioritize URL reputation over IP reputation – so a legitimate site hosted on an IP address with a poor reputation is not blocked outright, provided its URL reputation meets an administrator-selected threshold from Trustworthy up through High Risk.
Frequently asked questions
What reputation levels does Versa use?
VOS orders URLs into five graded levels – Trustworthy, Low Risk, Moderate Risk, Suspicious, and High Risk – from safest to riskiest, plus Undefined when no reputation data exists. Policies can match one or more levels in a reputation action map to allow, alert, block, or redirect traffic accordingly.
What happens when URL category and URL reputation actions disagree?
VOS evaluates the category action map and the reputation action map simultaneously and enforces whichever action is more severe. For example, if the matching category rule allows a URL but its reputation rule blocks it, VOS blocks the session rather than letting the more permissive rule win.
What reputation does an unknown URL get by default?
If a URL has no predefined categorization and no custom reputation configured, VOS assigns it the default reputation of Suspicious rather than treating it as safe. This fail-cautious default applies whenever cloud lookup is disabled and the URL is not already present in the local SPack database.
Can administrators override a predefined URL reputation?
Yes. Administrators can create custom URL reputation objects that match URLs by exact string or regex pattern, either entered individually or uploaded as a CSV file, and these custom values can override the predefined reputation VOS would otherwise assign from its local or cloud-based database.
How does URL reputation interact with IP address filtering?
A geolocation IP-filtering profile can prioritize URL reputation over IP reputation: when the URL reputation meets an administrator-selected threshold, traffic is evaluated by URL filtering instead of being blocked outright for a poor IP reputation, preventing legitimate sites on flagged IP addresses from being blocked unnecessarily.
More on URL reputation
If you want to learn more, these are sources we trust.
| Cloud Security Alliance research |
|---|
| Vendor-neutral research on threat intelligence and reputation-based filtering practices used across secure web gateways. |
Related terms
If you’re reading about URL Reputation, these are worth looking at next.
| URL Category | URL Filtering | Tenant |
|---|---|---|
| The subject-matter classification evaluated alongside reputation; VOS enforces whichever rule – category or reputation – is more severe. | The security control whose profiles carry the reputation action map that turns a reputation level into an enforcement action. | The organizational scope URL-filtering settings apply to; each tenant can carry its own reputation-based policy. |