How to block online shopping sites at work
Shopping sites are one of the most common workplace blocks, and one of the easiest to get wrong. Block too little and staff spend the afternoon in sales; block too much and purchasing cannot order toner.
This guide starts with the policy decision, then shows how to apply it on firewalls, DNS filters, browsers and phones using the Shopping category rather than a list you maintain by hand.
Why organisations block shopping sites
Time spent browsing is the reason people quote, but the security and data reasons are often stronger. Here are the four that come up most in policy documents.
Fake shops and scams
Pop up stores with deep discounts, fake delivery notices and coupon pages are frequent phishing lures. Many sit on domains only days old.
Card data on work devices
Personal card numbers typed on corporate laptops widen the scope of any incident and blur the line between work and personal data.
Malicious advertising
Deal and voucher sites carry heavy advertising. Bad ad networks and redirect chains are a known route to unwanted downloads.
Productivity and peaks
Big sale days bring a visible spike in traffic to retail sites. Some teams block only during those weeks.
Decide your stance first
There are three realistic stances. Most offices pick the middle one, because it removes the risk without upsetting the people who buy things for a living.
Allow, but protect
Shopping stays allowed. Only the risky edges are blocked.
- Block fake shops, phishing and new domains
- Block coupon and deal sites with heavy ads
- Good for small teams and creative agencies
Block in hours, allow by role
The Shopping category is blocked during working hours on staff networks.
- Purchasing, marketing and facilities exempt
- Open at lunch or on guest Wi-Fi
- Fits most offices, branches and call centres
Block everywhere
Retail sites are blocked on all managed devices and networks.
- Procurement through approved portals only
- Common in regulated, secure and shop floor settings
- Needs endpoint controls as well as network rules
Sites you almost always keep open
Watch the parent domain. Large retailers often run cloud services, business accounts or sign in pages on subdomains of the same domain as the store. Blocking the whole retail domain can break a cloud console or a business purchasing account. Allow those subdomains explicitly before you block.
Department matrix: who needs what
Write the exceptions down by department before you build anything. This matrix is an example; adjust it to your own organisation and keep it with the policy.
| Group | Retail stores | Marketplaces and auctions | Deal and coupon sites | Reason |
|---|---|---|---|---|
| Purchasing | Allow | Allow | Review | Buys supplies and compares prices |
| Marketing and ecommerce | Allow | Allow | Allow | Checks listings, competitors and ad placement |
| Facilities | Allow | Review | Block | Orders equipment and spare parts |
| Finance | In hours: block | Block | Block | Payment portals allowed separately |
| Contact centre | Block | Block | Block | Shared desks, high phishing exposure |
| Shop floor kiosks | Block | Block | Block | Kiosk use only |
| Guest Wi-Fi | Allow | Allow | Review | Visitors, with security categories blocked |
Use groups, not people. Map each row to a directory group your firewall or DNS filter can read. When someone changes role, the right access follows them automatically, and nobody keeps a forgotten personal exception for years.
Marketplaces, classifieds and auction sites are a separate category from retail stores in our data. See the marketplaces, classifieds and auctions category to decide whether to treat them differently.
Methods: four places to apply the rule
Retail is a huge and fast changing space, so domain by domain lists do not scale. Each method below uses a category rule with a short allow list on top.
Firewall or secure web gateway
- Create an allow list object for procurement, supplier and cloud subdomains.
- In the web filter profile, set the Shopping category to block or warn.
- Attach a schedule if you use working hours only.
- Apply per user group if the firewall knows identities, or per network otherwise.
- Order the rules: allow list first, then the category block.
Several gateways offer a "continue" page that lets the user proceed after reading the policy. It suits the restricted stance, because it reminds people without stopping a real business task.
DNS filter
- Enable the Shopping category for the staff network policy.
- Add allowed domains for suppliers and cloud consoles.
- Block outbound DNS to other resolvers and public DNS over HTTPS endpoints.
- Use a separate policy for guest Wi-Fi with only security categories blocked.
DNS blocking sees the domain, not the page. For warn pages and per user rules a proxy is better. Read DNS filtering vs web filtering.
Managed browsers and Microsoft 365
- In Microsoft Intune, push an Edge policy with URL block and allow lists for roaming laptops.
- For Chrome on managed devices, use the URL blocklist and allowlist policies.
Phones, tablets and Chromebooks
- Block or hide retail apps through your MDM on supervised and work profile devices.
- In the Google Admin console, add retail domains to the URL block list for the right organisational units.
- Accept that personal phones on mobile data are outside your control, and say so in the policy.
Common retail domains and the problem with lists
You can start with the big names, but a list will always be a few thousand stores behind. The table shows why a category rule is the real control.
| Example domain | Type | Watch out for |
|---|---|---|
amazon.com and country domains | Retail and marketplace | Cloud and business purchasing subdomains on the same parent |
ebay.com | Auction and marketplace | Used by some teams to source spare parts |
etsy.com | Marketplace | Mostly personal use |
aliexpress.com, temu.com, shein.com | Cross border retail | Heavy app use on phones, so MDM matters |
| Thousands of brand stores | Direct to consumer shops | Too many to list; only a category catches them |
| Pop up sale sites | Often fake or short lived | Registered days before a sale, then gone |
Always block the security edges. Whatever stance you take, keep phishing and malware categories blocked, and consider blocking newly registered domains. That alone stops most fake shops.
Communicating the policy
Shopping blocks feel personal in a way security blocks do not. A short, clear announcement and a friendly block page cut helpdesk tickets far more than any technical tweak.
What to put in the announcement
- The reason in one line: security first, then focus.
- When it applies: hours, networks, devices.
- What stays open: lunch break, guest Wi-Fi, approved suppliers.
- How to ask for an exception and who approves it.
- A reminder about fake shops and delivery scams.
What to put on the block page
- The category that matched, so users understand the reason.
- The time the rule ends if it is scheduled.
- A link to the exception request form.
- A way to report a supplier site that was blocked by mistake.
- No blame, no jargon, no device details.
Review cycle
Blocked supplier reports
Add genuine suppliers to the allow list and note them in the matrix.
Exceptions
Remove exceptions that have expired or are no longer used.
Security edges
Confirm new domain and phishing blocks are active on every network.
Stance
Ask whether open, restricted or closed still fits the business.
Seasonal peaks to plan around
Shopping traffic is not flat across the year. Some organisations run a lighter policy most of the year and tighten it around big sale events, when fake shops also peak.
Black Friday and Cyber Monday
Highest risk of fake stores and delivery scams. Review new domain blocking before the week starts.
Holiday shopping
Parcel notification lures rise. Remind staff that carriers do not ask for card details by text.
Sales season
Good time to review the matrix and remove expired exceptions.
Platform sale events
Large marketplaces run their own sale days. Check your logs for spikes and adjust.
Bypass routes and how to close them
Shopping blocks are bypassed with the same tools as any other block. Plan for these from the start.
Technical routes
- VPN apps and proxy sites: block the VPN / Proxy / Anonymizers category.
- Encrypted DNS in the browser: disable by policy on managed devices.
- Retail apps on phones: control with MDM, not the network.
- Translation and cache services that show a page through another domain.
Human routes
- Using guest Wi-Fi from a work laptop: keep managed devices off the guest SSID.
- Asking a colleague with an exception: exceptions should be personal and logged.
- Shopping through social apps with built in stores, covered by your social media policy.
Testing checklist
Test the blocks and, just as important, the things that must keep working. Most complaints come from the second list.
Run the checklist from a normal user account on each network, not from an admin device that may sit in an exempt group. Repeat it after every firmware update and after any change to the department matrix.
- A large retail site shows your block page on the staff network.
- A small brand store you have never listed is also blocked.
- Procurement portal and supplier sites load normally.
- Cloud console and business purchasing logins still work.
- Parcel tracking pages for your carriers load.
- Guest Wi-Fi allows shopping but blocks phishing.
- Exempt users in purchasing can shop during hours.
- The schedule opens and closes at the right minute.
- Retail apps are hidden on managed phones.
- A brand new test domain in the Shopping category is caught after the daily update.
- The block page names the category and links to the exception form.
- Logs show the user or device, so repeat attempts can be discussed with the manager, not guessed at.
Check how any store, supplier or odd hostname is categorized with the domain lookup tool before you add an allow or block entry.
Category based blocking with our database
The hard part of shopping policy is the grey zone: a manufacturer with a small web shop, a news site with a deals section, a supplier that also sells to consumers. Ranked categories handle that grey zone.
Shopping is the top ranked category. A rule on the primary category blocks it.
Business ranks first and Shopping second. Block only primary Shopping and the supplier stays open.
News/Media ranks first. It stays reachable, and you can still block a separate deals domain.
What licence holders get
- 120 million categorized domains, with the 20 million most visited covering 99.99% of traffic.
- 59 web filtering categories plus the IAB taxonomy in one file.
- About 300,000 new domains categorized daily, rechecked after a week and a month.
- Files that run in your own systems, with a lookup API included.
Where to go next
- Shopping category details and example coverage.
- Web filtering software for business buyers guide.
- Corporate web filtering notes for larger organisations.
- How to block websites by category, the master guide.
Shopping site blocking FAQ
Will blocking amazon.com break anything at work?
It can. Cloud consoles, sign in pages and business purchasing accounts can sit on subdomains of the same domain. Test cloud and procurement tools first, and allow specific subdomains before blocking the store.
How do I block shopping sites but keep supplier portals?
Block the Shopping category and add your supplier and procurement portals to an allow list that sits above the category rule. A category database that ranks several categories per domain also helps, because many supplier sites are mainly Business with a small shop.
Is blocking shopping sites a security measure?
Partly. Fake shops, coupon scams and malicious ads around shopping are common, and card details typed on work devices raise risk. Combine the shopping policy with a block on phishing and newly registered domains.
Should I block marketplaces and classifieds too?
Decide separately. Marketplaces, classifieds and auction sites are a different category from retail stores. Some teams use them to source parts or sell surplus stock.
Can staff still shop during lunch?
Yes, if your policy allows it. Most firewalls and DNS filters support schedules, so you can block the Shopping category during working hours and open it at lunch or on a guest network.
How do I keep the shopping block current?
New stores and pop up shops appear every day, especially before holiday sales. A category feed with daily updates for newly registered domains keeps the rule current without manual edits.
Category data that understands the grey zone
Ranked categories for 120 million domains, updated daily, for firewalls, DNS filters and gateways. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Amazon is a trademark of Amazon.com, Inc. or its affiliates. eBay is a trademark of eBay Inc. Etsy is a trademark of Etsy, Inc. AliExpress is a trademark of Alibaba Group. Temu is a trademark of PDD Holdings. SHEIN is a trademark of the SHEIN group.
Microsoft, Intune and Edge are trademarks of Microsoft Corporation. Google and Chrome are trademarks of Google LLC. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.