What is URL Filtering?

URL Filtering (URLF) is a security control that inspects HTTP and HTTPS requests and enforces an allow, block, alert, or captive-portal action based on a URL’s category, reputation, and administrator-defined allow and deny lists – governing which websites users can reach.

Key takeaways

• URLF allows, blocks, or redirects web traffic by URL category and reputation.
• Predefined and custom categories classify web traffic against a curated database.
• Cloud lookup extends local databases to billions of categorized URLs.
• Captive portal pages can warn, require justification, or demand an override PIN.
• Filtering profiles apply per user or group, from permissive to tightly restricted.

On this page: Why it matters · How it works · Types · URL Filtering & Versa · FAQ

Why is URL Filtering important?

Uncontrolled web access is a direct path into an organization: a single click on a malicious or miscategorized link can deliver malware, harvest credentials, or exfiltrate data through an unsanctioned file-sharing site. A security stack without URL filtering has little visibility or control over where users actually go once a connection is permitted at the network layer.

URLF matters because it applies policy at the level users and auditors care about – the destination website, not just the IP address or port. It lets security teams separate acceptable business use from legal, compliance, and productivity risk without blocking the internet outright, consistently whether enforcement happens at a branch firewall, a cloud secure web gateway, or a SASE point of presence. Paired with SSL decryption, it extends that control to encrypted traffic – most of what crosses the wire today.

What is URL Filtering?

A URLF engine classifies each requested URL – typically matched against the HTTP Host header or, for HTTPS, the TLS SNI field – against a category and reputation database. Vendors maintain large local databases of pre-classified URLs and supplement them with real-time cloud lookups against a much larger cloud-hosted database for URLs the local copy hasn’t seen yet. Administrators can also define custom categories using string or regex patterns.

Enforcement happens through a URL-filtering profile attached to a security policy rule. Profiles evaluate, in order, explicit deny lists, allow lists, a category-based action map, and a reputation-based action map, falling back to a default action if nothing else matches. Actions range from silent allow and logged alert through block and session/packet drop to captive portal – an interstitial page that can inform, ask for confirmation, require a written justification, or demand a one-time override PIN.

Types of URL Filtering

Category-based filtering matches the classification assigned to a URL – such as gambling, social media, or malware – against category-specific allow or block rules; it is the most common approach for enforcing acceptable-use policy. Reputation-based filtering scores a URL’s risk, from trustworthy to high-risk, using threat-intelligence signals, catching newly weaponized or unrated domains a category database hasn’t classified yet. List-based filtering uses explicit administrator-maintained allow and deny lists for specific domains, overriding category and reputation results for known-good or known-bad destinations.

Deployment also varies by architecture. Appliance-based filtering enforces at an on-premises firewall or proxy in the traffic path, keeping enforcement local but tying policy to a physical location. Cloud-delivered filtering enforces at a distributed cloud point of presence instead – the model favored by secure web gateway and SASE architectures, because the same policy follows a user regardless of where they connect from.

URL Filtering & Versa

Versa Operating System (VOS) devices implement URLF as part of the next-generation firewall, classifying requests against a local database of up to 20 million URLs and, with cloud lookup enabled, a cloud database of more than 2 billion categorized URLs. Administrators choose from predefined profiles – including Allow All, Block All, and the Versa-recommended Corporate profile, which blocks categories like adult content, gambling, and weapons – or build custom profiles with their own deny lists, allow lists, and category or reputation action maps.

Within Versa Secure Internet Access, URLF profiles are typically scoped per user group: IT staff might run the permissive Corporate profile while contractors get a tighter custom profile that blocks additional categories outright. URLF works with or without SSL decryption, though decryption sharpens HTTPS classification and is required for captive-portal redirection on encrypted sessions.

Frequently asked questions

What is the difference between URL filtering and DNS filtering?

DNS filtering blocks or allows an entire domain at resolution, before a connection is made. URL filtering inspects the full request afterward, so it can apply different policy to different paths on one domain using richer category and reputation data.

Does URL filtering require SSL decryption?

No. URLF can classify HTTPS traffic using the TLS SNI field without decrypting it. Enabling SSL decryption sharpens accuracy – filtering can then use the actual requested host and path – and is required for captive-portal pages to display over HTTPS.

What is a URL reputation?

A risk rating – typically Trustworthy, Low Risk, Moderate Risk, Suspicious, High Risk, or Undefined – assigned to a URL based on threat intelligence. Reputation is evaluated alongside category, and policy enforces the more severe of the two matching actions.

What happens when a URL cannot be categorized?

Uncategorized URLs fall through to the URL-filtering profile’s default action, which administrators set explicitly. Many deployments treat uncategorized traffic cautiously – logging it, restricting it, or routing it through additional inspection – until cloud lookup returns a classification for that URL.

Can URL filtering block content within an otherwise allowed website?

Yes, with the right match criteria. Filtering can key off the specific host and path rather than only the top-level domain, and administrators can layer deny-list patterns on top of category rules to block specific pages on an otherwise-permitted site.

More on URL Filtering

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about URL Filtering, these are worth looking at next.