How to block WhatsApp Web on your network
Most organisations do not want to ban WhatsApp from every phone. They want it off company computers, or they want files to stop leaving through it. Pick the scope that fits, then follow the recipe.
Why organisations block WhatsApp Web
WhatsApp messages are end-to-end encrypted. That protects users, but it also means your security tools cannot see what leaves the building through the web client. These are the risks that drive most blocks.
| Risk | What happens | Who cares most | Best scope |
|---|---|---|---|
| Data leaving by drag and drop | A user drags a spreadsheet or client file from the desktop into a chat. No DLP tool can read it in transit. | Legal, finance, healthcare, R&D | A or B |
| Unrecorded business messages | Deals and instructions agreed in chats that the firm cannot archive or produce later. | Banks, brokers, insurers, regulated advisers | A or C |
| Malware delivered as files | Documents and archives arrive from unknown numbers and are opened on a work PC instead of a phone. | Every security team | B |
| Session hijacking | A scammer persuades a user to scan a QR code, linking the user's account to an attacker's browser. | Help desks, staff with public numbers | A |
| Distraction on shared screens | Personal chats pop up on screens in meetings, at reception or in classrooms. | Schools, front offices | A |
| Student contact and bullying | Group chats during lessons on school computers and tablets. | Schools and districts | C on student networks |
Regulators in several countries have acted against financial firms over business messages sent on personal messaging apps. If that applies to you, blocking is only half the answer: provide an approved, archived tool as well.
WhatsApp domains, grouped by what they do
Grouping the hosts by function is what makes the three scopes possible. These are the well-known official domains; the exact hostnames under them change, so confirm against your own logs.
web.whatsapp.comThe browser version that pairs with a phone by QR code. Block it with all its subdomains for Scope A.
whatsapp.comHome page, downloads, help pages and business pages. Blocking it also stops installer downloads.
whatsapp.netChat servers and media hosts such as mmg.whatsapp.net, used by every client including phones. Block this only for Scope C.
wa.meShort links that open a chat with a number. Often used on business websites and in scam messages.
WhatsApp runs on its parent company's wider infrastructure and IP ranges, and hosts move. A daily-updated Email and Messaging category catches what a static list misses. Check any unfamiliar host in the domain category lookup.
Three recipes, one for each scope
Each recipe lists the network controls and the device controls. Network rules cover anything on your Wi-Fi or LAN. Device rules cover laptops and phones wherever they are.
Scope A: block WhatsApp Web and desktop
Phones unaffected- In the DNS filter or web filter, block web.whatsapp.com and its subdomains.
- On the firewall, add the WhatsApp Web application signature to a block rule; leave the mobile signature allowed.
- Block the download pages on whatsapp.com if you want to stop installs from the website.
- Block QUIC so the firewall sees server names.
- Block the Store app and the desktop installer with Intune and an application control policy.
- Push web.whatsapp.com to the browser URL block list through Intune.
- In Google Admin, add web.whatsapp.com to Chrome URL blocking.
- On Macs, block the app bundle through your MDM's restricted software settings.
Scope B: allow chat, block file transfers
Needs TLS inspection- Enable TLS inspection for the WhatsApp Web traffic on a proxy or firewall.
- Deny the media hostnames under whatsapp.net, such as mmg.whatsapp.net, for computer segments only.
- Where your firewall offers it, use the application control action for file transfer in WhatsApp rather than a full block.
- Log denied uploads so security can see attempts.
- A DNS block of media hosts also breaks photos on phones using your Wi-Fi. Scope it to the computer VLAN.
- Some apps pin certificates. Exclude those flows from inspection and fall back to Scope A if needed.
- Endpoint DLP on the PC can block file uploads to the browser tab as a second control.
Scope C: block WhatsApp completely
Network and MDM- Block the Email and Messaging category, or at least whatsapp.com, whatsapp.net and wa.me with subdomains.
- Add every WhatsApp application signature to a block rule.
- Block the VPN / Proxy / Anonymizers category alongside it.
- Restrict DNS to your resolver and drop DNS over TLS on port 853.
- On supervised iOS devices, block the app with a restriction profile.
- On Android Enterprise fully managed devices, leave it off the managed Google Play list.
- Push a device-level DNS or filter profile so the block holds on mobile data.
- Apply the desktop steps from Scope A on every computer.
Platform notes: Microsoft, Google and MDM
Menu names change between releases, so these notes describe what to look for rather than exact clicks.
Microsoft Intune
- Application control blocks the Store app and the desktop installer.
- A browser URL block list handles web.whatsapp.com only, for Scope A.
- Pair it with a network filter so other browsers are covered too.
Google Admin
- Chrome URL blocking for web.whatsapp.com per organisational unit.
- Block the Android app on managed Chromebooks.
- No categories, so pair with a filter for new hosts.
MDM (Jamf, Intune, others)
- App restriction profiles for iOS and macOS.
- Managed Google Play allowlist for Android.
- Lock VPN and private DNS settings on owned devices.
Browser client vs desktop app vs phone
WhatsApp has three faces on a work network. They need different controls, which is why one rule rarely covers all of them.
Computers
- WhatsApp Web runs in any browser at web.whatsapp.com.
- Desktop apps for Windows and Mac do not depend only on the web client host, so block them by application as well.
- Portable or unpacked versions are stopped by application control, not by uninstall alone.
- Computers are where file exfiltration risk is highest.
Phones
- The app uses whatsapp.net services directly.
- On mobile data, network rules do not apply.
- Android work profiles keep personal WhatsApp in the personal side, which your MDM cannot touch.
- For BYOD, focus on preventing linked web sessions on company computers instead.
Scope A has a useful side effect: if WhatsApp Web cannot load on company computers, users cannot be tricked into scanning a QR code that links their account to an attacker's session from your network.
Choosing a scope: six questions to answer first
The right scope depends less on the technology and more on how your people actually work. Answer these with the business owner before you change any rule.
1. Do customers contact you on WhatsApp?
- If yes, a full block will cut off a sales or support channel.
- Move that traffic to an approved business messaging platform first, then block personal use.
2. Are you under record-keeping rules?
- If yes, Scope A or C on company devices is the usual starting point.
- Document the control so you can show it to auditors.
3. Is the main worry files or chat?
- Files point to Scope B, if you can run TLS inspection.
- Chat itself points to Scope A.
4. Who owns the phones?
- Company phones can be covered with MDM in Scope C.
- Personal phones are only covered on your Wi-Fi, so be honest about that in the policy.
5. Do field teams rely on it?
- Drivers, engineers and site crews often coordinate in groups.
- Agree an approved replacement before blocking their devices.
6. Who approves exceptions?
- Name one owner, usually the compliance lead or the head of IT.
- Put exceptions in a directory group with an expiry date.
What to offer instead
The collaboration suite you already license, with retention policies set, covers most staff conversations.
A business messaging platform that archives conversations and assigns them to teams, instead of personal accounts.
An approved file sharing service with expiry links and logging, so staff have a safe way to send documents.
Escape routes to plan for
These are the ways a WhatsApp Web block usually fails in practice. Each one has a straightforward control.
How to test each scope
Test from a standard user account on a standard build. Keep a phone with a test WhatsApp account ready to pair. Repeat the full set after every firewall firmware or signature update, since application signatures change.
| Test | How | Expected result |
|---|---|---|
| DNS | nslookup web.whatsapp.com from a client | Blocked answer (A, C); normal answer (B) |
| Web client | Open web.whatsapp.com in Chrome, Edge and Firefox | Block page (A, C); QR code loads (B) |
| Pairing | Scan the QR code with the test phone | Not possible (A, C); pairs (B) |
| File upload | Send a test PDF and an image from the web client | Upload fails and is logged (B) |
| Desktop app | Try to install and run the app as a standard user | Install or launch blocked (A, C) |
| Phone on Wi-Fi | Send a message and a photo with mobile data off | Works (A); photo fails if media DNS-blocked (B); fails (C) |
| Bypass | Try a VPN extension and a public DoH resolver | Both blocked |
| Logging | Check firewall and filter logs | Events tagged with the messaging category |
Category-based blocking that keeps up
Messaging apps add hosts, web clients and companion sites without notice. A category database updated every day lets your rule follow them instead of chasing them.
WhatsApp, its web client and other chat services. The core category for Scope C. Also see the email category if webmail is in scope.
Closes the most common bypass. Block it on every policy where messaging is blocked.
Stops staff reaching chats on a home computer through remote control software.
Security vendors and MSPs license the database for their own filtering products, delivered as files with a lookup API.
Firms with compliance needs can start at web filtering for banking.
Related guides: how to block Telegram on your network and how to block X (Twitter).
WhatsApp Web blocking FAQ
Can I block WhatsApp Web but keep WhatsApp working on phones?
Yes. Block web.whatsapp.com and its subdomains, and block the desktop app with application control. Leave whatsapp.net open so phones keep working. Test after each change, since hosts change over time.
Can I stop file sharing on WhatsApp Web but allow chat?
Partly. Media moves through dedicated whatsapp.net hosts such as mmg.whatsapp.net. Blocking those on a proxy with TLS inspection stops uploads and downloads in the web client. Blocking them in DNS also stops media on phones using your Wi-Fi.
Why is WhatsApp still working after I blocked whatsapp.com?
The apps talk to whatsapp.net hosts and Meta infrastructure as well as whatsapp.com. Phones on mobile data also bypass your network. Block the full set of domains, the application signature and the Email and Messaging category.
Does blocking WhatsApp Web help with record-keeping rules?
It removes one unrecorded channel from company devices. Regulators have acted against firms over business messages on personal apps, so many firms block it and provide an approved, archived messaging tool instead.
How do I block the WhatsApp desktop app on Windows?
Use Intune to block the Microsoft Store app and an application control policy to stop the installer and executable. Block the WhatsApp domains on your DNS filter or firewall so any remaining client cannot connect.
Which category should I block for messaging apps?
Email and Messaging covers chat apps and their web clients. Pair it with VPN / Proxy / Anonymizers so the block cannot be bypassed easily.
Does blocking WhatsApp Web also block WhatsApp Business?
WhatsApp Business uses the same web client and service domains, so the same rules apply to it. If a team uses WhatsApp Business to talk to customers, put those users in an exception group or move them to an approved business messaging platform before you enforce the block.
Can I allow WhatsApp Web for one team only?
Yes, if your firewall, proxy or DNS filter applies policy by directory group or by network segment. Create a group for the approved users, allow web.whatsapp.com for that group, and keep the default policy blocking it. Review the group membership every quarter.
Will users see a block page?
In a browser, yes, if your filter serves one for HTTPS sites or uses TLS inspection. The desktop and phone apps never show block pages; they simply fail to connect, so tell the help desk what that looks like.
Messaging categories for your own product
Firewall, DNS filter, SWG and MSP platforms license our database to label 120 million domains. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
WhatsApp is a trademark of WhatsApp LLC, a Meta company. Microsoft and Intune are trademarks of Microsoft Corporation; Google, Chrome and Android of Google LLC; Jamf of its owner.
They are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.