How to block websites by category
Blocking site by site does not scale. There are far too many websites, and thousands of new ones appear every day. Category blocking lets you say "no gambling" or "no social networking in lesson time" once, and have the filter apply it to every matching domain.
This guide explains how category blocking works, how routers, firewalls, DNS filters, Microsoft 365 and Google Workspace apply it, which categories suit which organisation, and how to test the result. It also links to every service specific guide in this series.
How category blocking works
Every category filter has the same three parts: a database that assigns categories to domains, a policy that says what to do with each category, and an enforcement point that sees the traffic. The quality of the first part decides how well the other two work.
What a category is
- A label describing what a website is mainly about, such as Gambling, News/Media or Developer Tools / Code Hosting.
- Assigned to the domain, so every page on it shares the label unless a more specific entry exists.
- Grouped into sets, for example security categories, legal liability categories and productivity categories.
- Kept current as sites change, launch and disappear.
Our full list of web filtering categories covers 59 categories, plus the IAB Content Taxonomy in the same file.
Why ranking matters
Many sites fit more than one category. Ranked categories say how much of the site each one describes.
Where category blocking happens: platform comparison
Each enforcement point sees a different slice of traffic and has different blind spots. Most organisations combine two or three of them.
| Platform | What it sees | Categories | Main blind spot | Best for |
|---|---|---|---|---|
| Home and small office routers | Domains, sometimes only manual lists | Built in on some models, often by subscription | Encrypted DNS, VPNs, devices off site | Small offices, shops, home offices |
| Next generation firewalls | Domains, full URLs with TLS inspection, applications | Vendor category service plus custom categories | Devices off site, uninspected encrypted traffic | Offices, campuses, branch networks |
| DNS filters | Domain names only | Usually the core feature | Encrypted DNS to other resolvers, direct IP access | Every network size, guest Wi-Fi, MSPs, ISPs |
| Secure web gateways and proxies | Full URLs, users, uploads | Detailed categories plus actions like warn | Apps that ignore the proxy | Larger organisations, regulated sectors |
| Microsoft 365 and Intune | Web traffic on managed Windows and other supported devices | Edge URL lists; categories via an endpoint filter | Unmanaged devices | Microsoft centred fleets, remote staff |
| Google Workspace and Chrome | URLs in managed Chrome and ChromeOS | URL patterns in the Admin console; categories via add ons | Other browsers and apps | Schools and Chromebook fleets |
Category blocking on a router
- Check whether the router has a content filter or security subscription with categories. Many business routers do; many consumer routers only accept manual domain lists.
- If it has categories, select the ones to block per network or per device group, and set schedules if needed.
- If it does not, set the router's DHCP DNS server to a DNS filtering service that supports categories, and block outbound DNS to other servers if the router allows it.
- Restart client devices or flush their DNS cache before testing.
Open source firewall distributions can load category based DNS block lists into their resolvers. Licensed exports in hosts file, DNS RPZ or Pi-hole style formats work well here; see blocklist formats.
Category blocking on a firewall, vendor neutral
- Enable the web or URL filtering service and confirm the licence is active.
- Create a filtering profile and set an action for each category: allow, block, warn or monitor.
- Create custom categories or URL lists for local exceptions, and order them above the category actions.
- Attach the profile to security rules by source network, user group and schedule.
- Add application control for apps that a URL rule cannot see, such as game clients or messaging apps.
- Decide on TLS inspection: it improves accuracy but needs certificates on devices and exemptions for banking and health.
Category blocking with a DNS filter
- Create a policy per network or user group, and tick the categories to block.
- Point networks at the filter: router DHCP settings, a forwarder on your own DNS servers, or an agent on roaming devices.
- Block outbound port 53 to any other resolver at the firewall.
- Block or disable DNS over HTTPS to public resolvers, through browser policy and by blocking known endpoints.
- Set a block page, ideally one that names the category and links to an exception form.
DNS filtering is the usual base layer for MSPs and ISPs because it is light and works for every device, including IoT. See DNS filtering integration for how vendors plug category data into resolvers.
Microsoft Intune and managed devices
- Check which devices are enrolled in Intune, because policy only reaches managed devices.
- Deploy Edge settings such as URL block and allow lists for the sites you need to control.
- For category blocking off site, push an endpoint web filter agent through Intune and assign its policy to the right device groups.
- Set browser policy so other browsers cannot bypass the filter, or block their install.
Google Admin console and Chrome
- In the Admin console, the Chrome user and browser settings include URL blocking with a blocklist and exceptions list.
- Entries are URL patterns, such as a domain with all subdomains, not categories.
- Apply different lists to different organisational units, for example students and staff.
- Block Android apps and Chrome extensions for the same units where needed.
- For category filtering, pair the console with a DNS filter, a web gateway or a filtering extension. Check whether your Chrome Enterprise edition includes additional URL filtering options.
Schools running Chromebooks will find more context on K-12 school web filtering.
Which categories to block, by organisation type
There is no universal list. These starting points reflect common practice. Blue tags are usually blocked; green tags are policy decisions often handled with schedules or role based access.
| Organisation | Usually blocked | Policy decision | Notes |
|---|---|---|---|
| K-12 schools and libraries | AdultGamblingWeaponsIllegal DrugsViolenceHate/DiscriminationVPN / ProxyDatingAlcoholTobaccoFile Sharing/P2P | GamingSocial NetworkingStreaming MediaAI / LLM Tools | CIPA applies to schools and libraries receiving E-Rate discounts. See CIPA web filtering. |
| Businesses | Malware / PhishingAdultGamblingIllegal DrugsVPN / ProxyParked domains | Social NetworkingShoppingGamingStreaming MediaAI / LLM ToolsCloud Storage | Security categories first; productivity categories by role. |
| Healthcare | Malware / PhishingAdultGamblingRemote Access ToolsFile Sharing/P2P | Cloud StorageEmail and MessagingAI / LLM Tools | Data protection drives the policy. Keep Health and Medicine open. |
| Guest and public Wi-Fi | Malware / PhishingAdultIllegal content | Streaming MediaFile Sharing/P2PGambling | Family venues are stricter; hotels and cafes lighter. |
| ISPs and parental controls | Customer chosen | Age based profiles | Offer presets by age with full category choice. |
Industry specific notes are collected on the industries overview. For a business buyer's view of filtering tools, read web filtering software for business.
Every blocking guide in this series
Category rules do most of the work, but individual services have their own domains, apps and quirks. Each guide below covers one service or one category in depth.
Social networks
Messaging and chat
Video, music and streaming
AI tools
Bypass and anonymity
File transfer
Eight mistakes that weaken category blocks
Most failed category blocks have nothing to do with the categories themselves. They come from rule order, missing layers and untested exceptions.
Allow rules above the block
A broad allow rule placed first means the category rule never runs. Review rule order after every change.
Encrypted DNS left open
Browsers using their own DNS over HTTPS bypass a DNS filter completely.
VPN category not blocked
Blocking a category without blocking anonymizers invites the obvious workaround.
Only one network covered
Guest, IoT and student SSIDs often use different policies than the staff network.
No endpoint layer
Laptops leave the building. Without a roaming agent or browser policy, the block stops at the door.
Uncategorized treated as allowed
New domains with no category yet should be warned or blocked on strict networks.
Blocking whole shared platforms
Blocking a full content delivery network or site builder to stop one site breaks many legitimate ones.
Never re-tested
Firmware updates, new apps and new domains change results. Test after each change and every quarter.
Bypass routes every category policy should close
These apply whichever category you block. They are listed so administrators can plan controls, not as instructions.
VPNs and proxies
Block the VPN / Proxy / Anonymizers category and VPN application signatures.
Encrypted DNS
Disable DNS over HTTPS by browser policy and block known public endpoints.
Mobile data
Out of network reach. Use MDM on managed phones and accept the limit elsewhere.
New domains
Mirrors and copies on fresh domains. Block or warn on newly registered domains.
Direct IP access
Rare for browsers, common for some apps. Application control on the firewall helps.
Translation and cache
Services that show a page through their own domain. Most filters categorize these separately.
Unmanaged devices
Personal laptops on staff networks. Network access control keeps them on guest Wi-Fi.
Admin exemptions
IT staff in exempt groups who test from their own accounts and miss real results.
How to test a category block
A good test plan is short, repeatable and run from a normal user account. Keep the results so you can compare after each change.
Check categories first. Look up a handful of well known domains for each blocked category in the domain category lookup tool, so you know what result to expect.
Test a famous site and a small one. A famous site may be blocked by a manual rule; a small one proves the category rule works.
Test on every network. Staff, student, guest and IoT networks, plus a managed laptop off site.
Test in two browsers. One with encrypted DNS disabled by policy and one you have not configured, to find gaps.
Test apps, not just websites. Launch the mobile or desktop app of a service in a blocked category.
Test exceptions. Sign in as a user in an exempt group and confirm access, then as a normal user and confirm the block.
Test schedules. Check the minutes either side of every time window.
Review logs a week later. Look for allowed requests to domains in blocked categories and for uncategorized domains with heavy traffic.
Category based blocking with our database
Everything above depends on the category data underneath. Web Filtering Database supplies that data to firewall, DNS filter, gateway, MSP, ISP, parental control and edtech vendors, as files that run inside their own systems.
Built for filtering products
- Several categories per domain, ranked by how much of the site they describe.
- New domains rechecked after a week and after a month, because many add content after launch.
- Daily delta files; all other domains refreshed monthly.
- CSV, Parquet and JSON, with a lookup API included.
- Licensed exports can include DNS RPZ, hosts files, firewall external dynamic lists and PAC files.
Licences and next steps
- Internal use, OEM or embedded use, and group wide licences for companies with several products. See OEM licensing.
- Runs on premise, including air gapped deployments.
- Validation reports with measured accuracy for the CIPA categories are available to licence holders.
- Read how the web filtering database is structured, or browse the taxonomy.
Category blocking FAQ
What does blocking websites by category mean?
Instead of listing sites one by one, your filter looks up the category of each requested domain, such as Gambling or Social Networking, and applies the action you set for that category. New sites in a blocked category are blocked automatically once they are categorized.
Can I block websites by category on a home or small office router?
Some routers include category filtering through a built in subscription, and others only support manual domain lists. If yours does not, point the router at a DNS filtering service that offers categories.
Does Microsoft 365 or Intune block websites by category?
Intune itself deploys Edge URL block and allow lists, not categories. For category blocking on managed devices, push an endpoint web filter agent through Intune, and use a DNS filter for devices Intune does not manage.
Does Google Workspace block websites by category?
The Google Admin console blocks URLs by pattern for managed Chrome browsers and Chromebooks. For category based filtering, most organisations pair it with a DNS filter, a web gateway or a filtering extension.
Why do some sites in a blocked category still load?
Common causes are a site that is new and not yet categorized, a site whose main category is different, encrypted DNS that skips your resolver, a VPN, or an allow rule placed above the category rule. Check the domain's category and your rule order first.
Which categories should a business block?
Most businesses block security categories such as Malware, Phishing and newly registered domains, plus Adult, Gambling, Illegal Drugs and VPN or proxy services. Social, streaming, shopping and games are policy decisions that often use schedules or role based access.
What happens when a website has several categories?
Good category data ranks them by how much of the site each describes. Your filter can act on the primary category only, or on any listed category, depending on how strict you want to be.
Put category data behind your filtering product
120 million domains, 59 categories plus IAB, ranked and updated daily, delivered as files for your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Microsoft, Microsoft 365, Intune, Edge and Windows are trademarks of Microsoft Corporation. Google, Google Workspace, Chrome, ChromeOS and Chromebook are trademarks of Google LLC.
Service names in the guide directory, including TikTok, Instagram, Facebook, X, Snapchat, Reddit, Pinterest, Discord, WhatsApp, Telegram, YouTube, Netflix, Twitch, Spotify, Roblox, Fortnite, Steam, Minecraft, ChatGPT, DeepSeek and Tor, are trademarks of their respective owners.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.