How to block streaming sites on your network and win back bandwidth
Video and music streaming is the easiest load to cut on a crowded link, but a blunt block is not always the best answer. This guide starts with measuring, then helps you choose between blocking, throttling, scheduling and quality caps.
It is written for IT admins, MSPs, school network teams and anyone running guest Wi-Fi on a link that cannot simply be upgraded.
Illustration: how one site might split a congested link
Not real measurements. Your own split will differ, which is exactly why step one is to measure. A week of logs from a normal working week is usually enough to see the pattern.
Why organisations block streaming sites
Bandwidth is the most common reason, but it is rarely the only one. Knowing which reasons apply to you tells you whether to block outright or simply make streaming behave.
Congested links
HD and 4K video uses far more capacity than browsing or email. A handful of streams can slow calls and cloud apps on a small branch link.
Metered connections
Satellite, cellular backup and maritime links are billed by volume. Streaming can burn through a monthly allowance in days.
Classroom focus
Schools block entertainment video during lessons while keeping approved educational video available.
Fair guest Wi-Fi
Hotels, clinics and venues need guest access to stay usable for everyone, not just the few devices streaming films.
Piracy exposure
Unofficial streaming mirrors carry heavy advertising, malicious redirects and copyright risk for the network owner.
Step one: measure before you block
Teams often block streaming and then discover the link is still full, because the real load was backups or updates. Spend a few days measuring by application first.
Top talkers by application
Use the application visibility report on your firewall or router. Sort by bytes over a full working week, not one afternoon.
Peak versus average
Congestion is usually a peak hour problem. Note when the link saturates and which applications are active at that moment.
Per network split
Compare staff, student, guest and IoT networks. Streaming on guest Wi-Fi may need a cap while staff networks need nothing.
Write down the baseline. Peak utilisation, top five applications and complaint volume. You need these numbers later to show the change worked.
Main streaming services and their delivery domains
Each service uses a main site plus separate domains that carry the actual video or audio. Blocking only the main domain often leaves the app working. These are well known domains; every service adds more over time.
| Service | Main domain | Delivery and asset domains | Notes |
|---|---|---|---|
| Netflix | netflix.com | nflxvideo.net nflximg.net nflxext.com | Video servers can sit inside ISP networks, so add an application signature as well. See how to block Netflix. |
| YouTube | youtube.com | googlevideo.com ytimg.com youtu.be | Do not block wider Google domains. Our YouTube blocking guide covers restricted modes. |
| Twitch | twitch.tv | ttvnw.net jtvnw.net | Live streams run for hours. See blocking Twitch. |
| Music services | spotify.com | scdn.co spotifycdn.com | Light per stream, heavy at scale. See how to block Spotify. |
| Other subscription video | Many brands and regional services | Usually large shared content networks | Too many to list by hand, which is where category blocking helps. |
Spot an unknown hostname among your top talkers? Check it in the domain category lookup tool before writing a rule. Shared content delivery networks serve thousands of unrelated sites, so block exact hostnames, not the whole network.
Four ways to control streaming
Pick per network and per user group. Most organisations end up combining two of these, for example a block on student networks and a cap on guest Wi-Fi.
Block
Deny the Streaming Media category and application signatures. Right for exam rooms, kiosks and metered links.
Throttle
Allow streaming but limit it to a fixed share of the link per user or per network. Pages still load, video drops to a lower quality.
Schedule
Block during working or teaching hours and allow at lunch or after hours. Good for staff morale.
Prioritise
Leave streaming alone but give calls and business apps priority, so streaming only uses spare capacity.
| Option | Bandwidth saved | User friction | Effort | Typical fit |
|---|---|---|---|---|
| Block | Highest | High | Medium: several layers | Schools in lesson time, secure sites, metered links |
| Throttle | High at peak | Low to medium | Medium: shaping rules | Guest Wi-Fi, hotels, branch offices |
| Schedule | High in working hours | Low | Low: one schedule object | Offices, staff networks |
| Prioritise | Indirect | Very low | Medium: QoS classes | Sites with enough total capacity |
A policy per network
One rule for every network rarely works. Split your policy by SSID or VLAN so each audience gets a fair outcome.
- Schedule: block entertainment streaming in core hours.
- Allow approved training and webinar platforms.
- Prioritise calls and business apps.
- Block Streaming Media during lessons.
- Allow curated educational video only.
- Block VPN and proxy categories to stop bypass.
- Throttle per client rather than block.
- Block piracy mirrors and adult content.
- Isolate clients from internal networks.
A simple exceptions process
Some teams genuinely need streaming: marketing checks ad placements, trainers show video, and security staff review content. A clear route to an exception stops people looking for workarounds.
- The requester names the service, the business reason and how long the exception is needed.
- The line manager approves, and IT adds the user or group to an exception group, never a one off device rule.
- The exception group gets the throttled class, not unlimited access, unless the reason needs full quality.
- Every exception has an end date and is reviewed each quarter alongside the bandwidth report.
Designing shaping classes that people accept
Throttling works best when it is predictable. Group traffic into a few classes, give each a clear purpose, and write the rule down so the helpdesk can explain it when someone asks why video looks soft.
| Class | What goes in it | Treatment | Why |
|---|---|---|---|
| Real time | Voice calls, video meetings, remote desktop for support | Highest priority, reserved minimum | These break first when a link is full, and users notice at once |
| Business | Line of business apps, cloud office suites, payment terminals | High priority | Keeps the work flowing during peaks |
| Bulk | Operating system updates, cloud backup, large file sync | Low priority, scheduled where possible | Big but not urgent, so move it out of hours |
| Entertainment | Video and music streaming, game downloads | Hard cap per client or per network | Lets people stream at reduced quality without hurting others |
| Blocked | Piracy mirrors, adult content, anonymizers | Deny | No legitimate use on a shared network |
Cap per client, not per network. A single shared cap lets one heavy user take the whole entertainment allowance. Per client limits share it fairly and are easier to explain.
Can I lower video quality without blocking?
Some services let account holders choose a data saver or lower quality setting, but you cannot set that from the network for personal accounts. A per client bandwidth cap has a similar effect, because adaptive players drop to a lower quality when they see less capacity.
What about video in training and webinars?
Put approved training and webinar platforms in the business class, not the entertainment class. Our category list keeps Webinars/E-learning separate from Streaming Media for exactly this reason.
Should game downloads count as streaming?
For bandwidth purposes, yes. Game launchers can pull very large updates. Treat them as bulk or entertainment traffic, or see our guide to blocking online games at work.
Sector notes
The same tools apply everywhere, but the right balance differs. These short notes reflect the patterns we see most often among the vendors and MSPs who build on our data.
- Block entertainment streaming in lesson time, allow curated educational video.
- Use timetables rather than permanent blocks for sixth form or college networks.
- Keep the same policy on take home devices through endpoint controls.
- Guests expect streaming, so cap rather than block.
- Offer a premium tier only if your terms allow it.
- Keep staff and point of sale networks separate.
- Block streaming by default on volume billed links.
- Allow scheduled windows when cheaper capacity is available.
- Report data use per network to site managers.
Healthcare and clinics often run patient Wi-Fi next to clinical systems. Shape patient streaming hard and give clinical applications the real time and business classes.
Rollout in four weeks
A staged rollout lets you measure the effect of each change and catch side effects before everyone notices them.
- Week 1
Baseline
Measure top applications and peak hours on each network. Announce the policy and its reason.
- Week 2
Guest and IoT
Apply caps on guest Wi-Fi and block streaming on IoT networks where nothing needs it.
- Week 3
Staff and students
Turn on schedules and category blocks. Keep a short exception process for teams with real needs.
- Week 4
Review
Compare peak load with the baseline, check logs for leaks, tune caps and remove rules that did nothing.
Methods by enforcement point
Bandwidth control needs the firewall or router, because only devices in the traffic path can shape it. DNS and endpoint policies add the blocking side.
- Firewall or router: enable application visibility, create a streaming category or application group, then attach a block, schedule or shaping rule per source network.
- Traffic shaping: create a shaper or QoS class for streaming applications with a maximum rate, and a priority class for voice and video calls.
- DNS filter: block the Streaming Media category for networks that should have no streaming at all, and force all clients to your resolver.
- Encrypted DNS and QUIC: block or disable DNS over HTTPS to public resolvers, and consider blocking QUIC on UDP 443 so browsers fall back to TCP that your firewall can classify.
- Microsoft Intune: on managed Windows devices, push a browser URL block list for streaming domains, or deploy endpoint web filtering that blocks streaming categories on any network.
- Google Admin console: for managed Chromebooks, add streaming domains to the URL block list per organisational unit and block the matching Android apps.
- MDM for phones and tablets: block or hide streaming apps on supervised and work profile devices.
Bypass routes to plan for
These are the gaps that let streaming back in after a block. Close them in your design rather than reacting later.
Network bypass
- VPN apps and browser VPN extensions: block the VPN / Proxy / Anonymizers category and VPN signatures.
- Encrypted DNS to public resolvers that skips your DNS filter.
- QUIC traffic that some firewalls cannot classify without fallback.
- Personal hotspots and mobile data, which you cannot control from the network.
Content bypass
- Unofficial mirror and piracy sites with new domains every week.
- Video embedded on social and news sites.
- Downloads saved at home and played offline.
- Cloud storage links used to share video files, covered by the file sharing category.
Testing the result
Testing a bandwidth policy has two parts: confirm the rules do what you meant, and confirm the link actually behaves better.
Rule checks
- Open each main service in a browser on each network and confirm block, cap or schedule.
- Start the apps on a phone with mobile data turned off.
- Test edge times of each schedule.
- Confirm approved training video still plays.
Outcome checks
- Compare peak utilisation with the week one baseline.
- Check call quality reports for fewer drops.
- Review top talkers for new streaming hostnames.
- Track helpdesk complaints for two weeks.
Category based blocking with our database
Streaming changes faster than any manual list: new services, regional brands, mirrors and delivery hostnames. A category database lets your filter recognise them without hand edits.
120 million domains
Categorized and ranked by how much of each site a category describes, so a news site with video is not treated as a streaming service.
Daily new domains
About 300,000 new domains are categorized each day and checked again after a week and a month.
59 categories
Streaming Media, Podcasts, Arts and Entertainment and more, plus the IAB taxonomy.
Ready exports
Licensed exports can include DNS RPZ, hosts files and firewall external dynamic lists. Compare them in blocklist formats.
Building a filtering or network product? Read how the web filtering database works inside your own systems,.
Streaming blocking FAQ
Is it better to block streaming or to throttle it?
If the goal is bandwidth, throttling or quality of service often solves the problem with fewer complaints. Block outright where streaming has no legitimate use, such as exam rooms, kiosks or metered links.
Which streaming domains should I block?
Each service uses a main domain plus delivery domains, for example netflix.com with nflxvideo.net and nflximg.net, or twitch.tv with ttvnw.net. Lists change, so a Streaming Media category feed is more reliable than a hand built list.
Will blocking YouTube break Google services?
Blocking youtube.com, ytimg.com and googlevideo.com stops YouTube video without breaking Gmail, Drive or Docs. Avoid blocking broad Google domains, and test embedded training videos you rely on.
Why is my link still full after blocking streaming?
Streaming is often only part of the load. Operating system updates, cloud backup, file sync and video calls also use a lot of capacity. Measure by application before and after the change.
Can I allow streaming on guest Wi-Fi but not on staff networks?
Yes. Apply policies per SSID or VLAN. A common pattern is a full block on staff and student networks during working hours and a bandwidth cap on guest Wi-Fi.
How do I keep the streaming block up to date?
New streaming services, mirrors and delivery hostnames appear constantly. Use a category feed with daily updates, keep firewall application signatures current and review top talkers in your logs each month.
Recognise every streaming site, including the new ones
License category data for your firewall, DNS filter or gateway product. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Talk to usNetflix is a trademark of Netflix, Inc. YouTube, Google, Chromebook and Gmail are trademarks of Google LLC. Twitch is a trademark of Twitch Interactive, Inc. Spotify is a trademark of Spotify AB. Microsoft and Intune are trademarks of Microsoft Corporation.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.