How to block proxy sites on your network
Web proxies and "unblocker" sites let users open any page through someone else's server. Your filter sees only the proxy, so every category rule behind it stops working.
This playbook is for IT admins, MSPs, school IT teams and filtering vendors who need proxy sites blocked and kept blocked.
Why organisations block proxy sites
Proxy sites are the most common way students and staff get around a web filter. They also bring their own risks, because the operator sees everything the user types.
One proxy page undoes every block on the network. In schools that includes the categories CIPA expects you to filter for minors.
Free proxies can read logins and session cookies passing through them. Users who sign in to work accounts through a proxy hand those details to a stranger.
Many free proxies fund themselves with aggressive ads, pop-ups and scripts. Some inject content into the pages they relay.
Logs show only the proxy domain. Investigations, safeguarding reviews and audits lose the trail.
If some users can bypass rules with a proxy, the rules stop being fair. Consistent blocking keeps the policy credible.
Abusive activity relayed through a proxy can come back to your network address in complaints or blocklists.
The proxy family: six types admins meet
"Proxy site" covers several different tools. Knowing which type you are facing tells you which control will stop it. The label in the corner shows how often a name based block alone is enough.
Web proxy sites
A page with a URL box. The user types an address and the site fetches it for them. These are the classic "unblocker" sites.
Unblocked game mirrors
Sites that copy blocked games or media onto new domains. Strictly mirrors, not proxies, but they behave the same for your filter.
Self hosted proxies
Open source proxy scripts placed on free hosting or a cloud app platform. They sit under a shared domain that you may not want to block whole.
Translation and cache services
Legitimate tools that fetch a page on the user's behalf. They can be used to view blocked content without being proxies by design.
Proxy browser extensions
Extensions that route browser traffic through a remote server. They are controlled at the browser, not at the network.
SOCKS and SSH tunnels
Technical users point a browser at a remote proxy server. These need firewall egress rules and device controls.
Anonymizer services
Commercial "browse anonymously" sites and gateways that open onion services in a normal browser.
Encrypted DNS resolvers
Not proxies, but used alongside them to hide lookups from a DNS filter. Covered in the playbook below.
The five step proxy blocking playbook
Run these in order. Steps one and two catch most proxy use on the first day; the remaining steps close the gaps that determined users find next.
Block the category
Turn on VPN / Proxy / Anonymizers in your DNS filter, firewall or gateway for every user group.
Force your DNS
Block outbound DNS to other resolvers, block DoT on port 853 and disable DoH in browser policy.
Handle the unknown
Block or warn on uncategorised and newly registered domains, where fresh proxies live.
Lock the browser
Allowlist extensions and set policies for translation, cache and reading tools on managed browsers.
Watch and refine
Review blocked and allowed logs weekly, look up suspicious domains and report misses to your data supplier.
On a router
- Set DHCP to give out a filtering DNS resolver with the proxy category blocked.
- Add a firewall rule that drops outbound port 53 and 853 to any other address.
- Use the router's site blocklist for a handful of persistent offenders.
- Accept the limit: most routers cannot see full URLs or inspect HTTPS.
On a firewall
- Enable the proxy or anonymizer URL category in the outbound web filter profile.
- Enable application control signatures for web proxies and tunnelling tools.
- Block outbound SSH and SOCKS ports from user segments that do not need them.
- Where lawful and agreed, inspect HTTPS to shared hosting platforms where proxies hide.
In a DNS filter
- Block the proxy category and the Malware / Phishing / Suspicious category together.
- Block the Firefox canary domain
use-application-dns.netso Firefox keeps your resolver. - Block known public DoH resolvers if your filter offers a list.
- Show a block page that explains the rule and how to request an exception.
In Google Admin, Intune and MDM
- Google Admin: block all Chrome extensions except an approved list, set the URL blocklist, set DNS over HTTPS to off or to your resolver.
- Intune: apply the same browser policies to Edge and Chrome, and use Defender network protection so web protection covers every browser.
- Mobile MDM: allow only approved apps and push your DNS or filtering profile.
School policy vs business policy
The same tools apply, but the stakes and exceptions differ. Use the column that fits your network, and see our pages on school web filtering and corporate web filtering for the wider policy.
Schools and districts
- Block the proxy category with no student exceptions.
- Block uncategorised domains for student groups, since new unblockers appear weekly.
- Apply filtering on the device as well as the network, so it follows Chromebooks home.
- Block unblocked game mirrors, which spread fast between students.
- Share block page reports with safeguarding staff where policy says so.
Businesses and MSP tenants
- Block the proxy category for all staff by default.
- Use warn pages, not hard blocks, for uncategorised sites, to avoid stopping real work.
- Give developer and QA teams a documented exception for proxy testing tools.
- Alert security on repeated proxy attempts from the same account.
- For MSPs, keep the rule in the baseline template and log tenant overrides.
Why proxy domain lists lose, and what wins
Proxy operators expect to be blocked. They register new domains, use free subdomains and share links in chats. A list that someone updates by hand is always behind.
| Approach | Strength | Weakness | Verdict |
|---|---|---|---|
| Manual blocklist of proxy domains | Simple, no licence needed | Stale within days, no coverage of new domains | Use only for a few persistent offenders |
| Keyword blocking ("proxy", "unblock") | Catches some obvious names | Misses most proxies, blocks innocent pages | Avoid as a main control |
| Application signatures | Recognises common proxy scripts | Needs HTTPS inspection for many cases | Good second layer on firewalls |
| Category data with daily updates | Covers new and renamed proxies across all clients | Needs a supplier and an integration | Best primary control |
| Block uncategorised and newly registered | Catches proxies before they are classified | Can block new legitimate sites | Strong for schools, warn mode for business |
The newly registered domain rule does a lot of work here. Many proxy sites are only days old when users find them. Read our guide to blocking newly registered domains for the trade-offs.
Bypass risks to plan for
These are the routes admins most often find after the main block is in place. Each one has a defensive fix that does not depend on chasing individual sites.
Proxies on shared platforms
Proxy scripts hosted on free web hosting or cloud app subdomains. Fix: categories at host name level, and inspection rules for those platforms where agreed.
Links shared in chat
Fresh proxy addresses spread through messaging apps faster than any list. Fix: uncategorised and newly registered domain rules.
Shortened links
A short link hides the proxy domain until the redirect. Fix: categories applied to the final destination, see our URL shortener guide.
Encrypted DNS in the browser
The browser resolves the proxy name privately, skipping your filter. Fix: DoH policy and resolver blocks.
VPN and Tor as the next step
Users who lose proxies try VPN apps or Tor. Fix: block VPN apps in the same project.
Personal devices on guest Wi-Fi
No browser policy applies to unmanaged devices. Fix: DNS and firewall categories on the guest network, and separate guest from internal segments.
Spotting proxy use in your logs
Blocks only show you what was caught. The signals below help you find proxy use that slipped through, so you can look up the domains and close the gap.
| Signal in the logs | What it often means | Next action |
|---|---|---|
| One domain with very long sessions and many page views from one user | The user is browsing other sites through it | Look up the domain and block if it is a proxy |
| Long encoded strings in URL paths, often with a full web address inside | A web proxy passing the target address | Block the host and check sibling domains on the same server |
| Sudden traffic to a domain registered in the last few days | A new proxy or game mirror shared among users | Apply the new domain rule and report it for categorization |
| Many users hitting the same unknown subdomain on a free hosting platform | A self hosted proxy script | Block that host name, not the whole platform |
| DNS queries that stop while web traffic continues | Encrypted DNS has been turned on in the browser | Check browser policy and resolver blocks |
| Repeated block page hits from one account across several proxies | A user actively hunting for a working proxy | Follow up under your acceptable use policy |
Exporting a week of uncategorised domains and running them through bulk categorization is a quick way to find proxies the filter has not seen yet.
A four week rollout that avoids surprises
Turning everything on at once can block legitimate tools and flood the help desk. A staged rollout keeps the block strong and the complaints few.
Week one: observe
- Enable the proxy category in report only mode, if your platform offers it.
- List the top proxy domains and the user groups that use them.
- Identify any business tools that appear in the category.
Week two: block the category
- Switch the category to block for all groups.
- Add documented exceptions for the tools found in week one.
- Publish a short notice explaining the rule and the exception process.
Week three: close the gaps
- Lock DNS, DoT and DoH, and apply browser extension policies.
- Turn on the uncategorised and newly registered domain rule, in warn mode for staff.
- Block outbound tunnel ports on user segments.
Week four: verify and hand over
- Run the full test plan below on every segment.
- Set a weekly log review and a monthly re-test.
- For MSPs, copy the final settings into the tenant baseline.
How to test your proxy block
Test from a managed device and an unmanaged one, on each network segment and user group. Keep a list of test domains and refresh it monthly, because the proxies students use change quickly.
| Check | Method | Pass condition |
|---|---|---|
| Known proxy sites | Open five well known web proxy sites | Block page shows the anonymizer category |
| Category lookup | Paste each test domain into our domain lookup tool | VPN / Proxy / Anonymizers returned |
| Fresh domain | Find a proxy domain registered in the last few days from your logs | Blocked by category or by the new domain rule |
| DNS bypass | Enable DoH in a managed browser's settings | Setting greyed out or forced to your resolver |
| Extension | Try to add a proxy extension in a managed browser | Install refused by policy |
| Tunnel ports | From a test device, try an outbound SSH connection on a user segment | Blocked by firewall egress rule |
| Reporting | Check the filter's report for the test session | Each attempt logged with user and device |
Category-based blocking with our database
Our VPN and proxy category covers web proxies, unblocker sites, anonymizer services and VPN providers. Filtering vendors and MSPs embed it, so the block stays current without manual lists.
Delivery is a file that runs in your own systems, with a lookup API included. Licensed customers can export DNS RPZ, hosts files, AdGuard and Pi-hole style lists, firewall external dynamic lists and PAC files; see blocklist formats. To check many domains from your logs at once, use bulk categorization. Pair the proxy category with phishing and malware categories to catch risky proxy pages twice.
Why several categories per domain helps. A game mirror can be both Gaming and VPN / Proxy / Anonymizers. Because each domain carries several ranked categories, a school can block the proxy behaviour even when the main category of the site is allowed.
Proxy site blocking FAQ
Why do proxy sites keep getting through my filter?
Proxy sites are cheap to launch, so operators move to new domains as soon as old ones are blocked. A static list falls behind within days. Category data that is refreshed daily, plus a rule for newly registered and uncategorised domains, keeps up far better.
Do I need SSL inspection to block proxy sites?
Not for the domain itself. DNS filters and firewalls can block a proxy site by its name without decrypting traffic. Inspection helps only when a proxy hides behind a domain that is otherwise allowed, such as a page on a shared hosting platform.
Can translation sites and cached pages act as proxies?
Yes. Translation tools, page caches and some reading modes fetch a page on the user's behalf. Most filters handle this by inspecting the requested URL inside those services or by enforcing safe modes rather than blocking the service outright.
How do I stop proxy browser extensions?
Use browser management. In the Google Admin console or Microsoft Intune you can block all extensions except an approved list, which prevents proxy and VPN extensions from being installed on managed browsers.
Which category should I block for proxy sites?
In our database web proxies, unblocker sites, anonymizing services and VPN providers all sit in VPN / Proxy / Anonymizers. Block that category, then add Malware / Phishing / Suspicious because many free proxy sites carry risky ads and scripts.
Will blocking proxy sites break legitimate tools?
Rarely. Corporate proxies are configured on devices, not visited as websites. Some developer and testing tools use proxy services, so give those teams a documented exception.
Keep proxy coverage current in your filter
License a categorized domain database with daily updates for new domains, delivered as files for your own platform. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Google, Chrome and Google Admin are trademarks of Google LLC. Microsoft, Intune, Edge and Defender are trademarks of Microsoft Corporation. Firefox is a trademark of the Mozilla Foundation. AdGuard is a trademark of AdGuard Software Ltd.
Pi-hole is a trademark of Pi-hole LLC. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.