Home / Block guides / X (Twitter)

How to block X (Twitter) on your network

X still answers on twitter.com, but most of the service now lives on x.com and loads from separate media hosts. This guide shows IT admins and MSPs how to block it properly, for everyone or only for some groups.

x.comtwitter.comtwimg.comt.co

Decide the policy Official domains Blocking methods App vs browser VPN bypass Testing

Decide the policy before you touch the firewall

X is a little different from most social networks in a workplace. Communications teams, executives and support staff often use it for real work, while for everyone else it is a distraction and a source of risk.

Start with a short role matrix. It saves you from a blanket block that gets reversed a week later after a complaint from the press office.

Group	Typical need	Suggested policy	Notes
General staff	None for daily work	Block	Block the Social Networking category, not only X, so the policy is consistent.
Marketing and comms	Posting, monitoring, replies	Allow	Put this team in its own directory group with its own filter policy.
Customer support	Answering public complaints	Allow	Often only needs a social inbox tool; check whether direct access is really needed.
Executives	Reading news and industry posts	Review	Some firms allow reading on managed devices only and log the traffic.
Students (schools)	None in class	Block	Age rules and school policy usually point to a full block on student networks.
Guest Wi-Fi	Varies	Review	Hotels and cafes rarely block it; offices and clinics often do.
Kiosks and shared screens	None	Block	Use a tight allowlist on these devices instead of category rules.

Why organisations block X

Productivity

Endless timelines are an easy way to lose an hour. Blocking removes the temptation on work machines.

Brand risk

A post from a work account or a work device can be screenshotted and attributed to the company.

Content exposure

The platform allows adult content behind a setting, and graphic news media spreads fast. Schools and family venues cannot accept that risk.

Phishing and scams

Fake support accounts, crypto giveaways and shortened links are common lures that end on credential-harvesting pages.

Bandwidth

Autoplay video on busy guest or school networks adds up, especially at break times.

Data protection

Staff can paste screenshots of internal tools or customer data into public posts or direct messages.

The official X and Twitter domains to block

These four registrable domains carry the core service. Block each one with its subdomains, which in most filters means entering the base domain or a wildcard such as *.x.com.

x.com

The main site, sign-in, timeline and most API calls from the web client since the rename.

twitter.com

The original domain. It still redirects and is still called by older apps, embeds and integrations, including api.twitter.com.

twimg.com

Static and media hosts: scripts, styles, profile images and video, on hosts such as abs, pbs and video.

t.co

The link shortener that wraps every link posted on the platform. See the warning below before blocking it.

The t.co decision. Blocking t.co stops users following links from posts, but it also breaks t.co links pasted into email, chat and documents. Decide on purpose, and tell the help desk which way you went.

Domain lists change. The service has moved hosts before and will again, and third-party front-ends, mirrors and viewer sites appear all the time. That is why a Social Networking category rule is more durable than this list on its own.

Hosts you should not block by accident

Embedded posts on news sitesBlocking twimg.com and x.com leaves empty boxes where posts are embedded. That is expected and harmless.

Social media management toolsScheduling platforms talk to X from their own servers, so blocking X on your network does not stop them working.

Single sign-onFew business apps use X sign-in today, but check your SaaS list before you block, as some customer portals still offer it.

Unrelated x domainsDo not use loose patterns like *x.com*. They match thousands of unrelated sites that happen to end in x.com.

Not sure what a domain is? Run it through the domain category lookup to see its categories before you add it to a rule.

Six ways to block X, from router to MDM

Pick by where your devices live. Office networks are covered by the firewall and DNS layers. Laptops that leave the building need an endpoint layer such as an endpoint web filter, Google Admin or an MDM profile.

1. Router or access point

Sign in to the router admin page and open parental controls, access control or website blocking.
Add x.com, twitter.com, twimg.com and, if decided, t.co.
Apply the rule to all clients or to the device group you want.
Reboot clients or flush their DNS cache so old answers expire.

Good for small offices and homes. Most consumer routers cannot inspect HTTPS, so they rely on DNS names and are easy to sidestep.

2. Next-generation firewall

Create a URL filtering profile that blocks the social networking category.
Add the four domains to a custom block list as a safety net.
Add the application signature for X or Twitter to an application control rule.
Enable TLS inspection or at least SNI-based filtering on the policy.
Block QUIC (UDP 443) so browsers fall back to TCP where the firewall can see the server name.

The strongest network option. Policy can follow directory groups, which is how you allow the comms team.

3. DNS filter

Point DHCP at your filtering resolver for every network segment.
Block the social networking category in the policy for the right segment.
Add the four domains as explicit blocks.
Block outbound port 53 and 853 to anything except your resolver.

Fast, cheap and covers every device, including phones on Wi-Fi. Learn the trade-offs in DNS filtering vs web filtering.

4. Intune and an endpoint filter

In your endpoint web filter, create a policy that blocks the social networking category.
Scope the policy to the right device groups.
Add x.com and twitter.com as custom blocked domains.
Push the policy and the agent through Intune so every browser on the laptop is covered.

Follows Windows laptops anywhere, on or off the office network.

5. Google Admin

Open Devices, Chrome, Settings, Users and browsers.
Choose the organisational unit, then URL blocking.
Add x.com, twitter.com, twimg.com and t.co to the blocked list.
Under Apps, remove the X Android app from the allowed Play apps for that unit.

Covers managed Chrome browsers and Chromebooks. It has no categories of its own, so pair it with a filter for new domains.

6. MDM for phones and tablets

On supervised iOS devices, deploy a web content filter payload with the domains on the deny list.
Hide or block the X app through an app restriction profile.
On Android Enterprise, only allow approved apps from managed Google Play.
Push a DNS or VPN-based filter profile so the block applies off Wi-Fi.

The only layer that reaches company phones on mobile data.

Mobile app vs browser: two different problems

The website and the app reach the same servers, but they behave differently on your network. Plan for both, because a block that only works in browsers will look fine in testing and fail in a classroom full of phones.

Browser on a laptop

Follows your DNS and web filter on the network.
Can use encrypted DNS built into the browser, so set browser policy to use system DNS.
Can use a browser extension proxy, so restrict extensions with policy.
Shows your block page, which reduces help desk tickets.
Off the network, needs a Chrome policy or an endpoint agent.

App on a phone

Uses pinned connections, so it never shows a block page; it just fails to load.
Often keeps working on mobile data, which no network rule can touch.
May retry on fallback hosts, so block every domain plus the category.
On company devices, the app itself can be removed or blocked through MDM.
On personal phones, limit the block to your Wi-Fi and say so in policy.

For BYOD networks, put personal phones on a separate SSID with DNS filtering. You cannot install anything on them, but you can control what your Wi-Fi resolves.

How users get around an X block, and how to close each gap

You do not need to stop a determined expert. You need to stop the common routes that a curious employee or student will find in a few minutes.

Consumer VPN appsBlock the VPN / Proxy / Anonymizers category in DNS and web filter, block VPN applications in firewall app control, and stop installs on managed devices.

Web proxiesProxy sites appear every day under new names. Only a category that is updated daily keeps up with them.

Third-party viewersSites that show X posts without signing in sit outside the four official domains. Category rules for Social Networking catch them as they are labelled.

Encrypted DNSDisable browser DNS over HTTPS by policy, block known public DoH endpoints, and block outbound DNS over TLS on port 853.

Changing DNS settingsFirewall rule: allow port 53 only to your resolver. Redirect or drop everything else.

Mobile hotspotA laptop tethered to a phone leaves your network. Only endpoint controls (Chrome policy, endpoint agent) still apply.

Translation and cache toolsSome translation and page-cache services fetch pages for the user. Treat them as proxies if your logs show abuse.

How to test that X is really blocked

Run the checks from a normal user account on a normal device, not from your admin laptop with its exceptions.

DNS check. Run nslookup x.com against the resolver your clients use. A filtered answer or a block-page address means the DNS layer works.
Browser check. Open x.com, twitter.com and a direct image URL on pbs.twimg.com in Chrome, Edge and Firefox. All three should show the block page.
App check. On a phone joined to the Wi-Fi with mobile data off, open the X app and pull to refresh. The timeline should fail to load.
Link check. Click a t.co link from an old email. Confirm the result matches the decision you made.
Bypass check. Try a popular free VPN app and a public DoH resolver set in the browser. Both should fail.
Group check. Sign in as a marketing user and confirm X works for them, if you set up an exception.
Log check. Confirm the blocks appear in firewall or DNS logs with the right category, so you can report on them.

Category-based blocking with our database

Blocking by name works on day one. Blocking by category keeps working on day 300, when new mirrors, short links and companion sites exist that nobody added to your list.

120Mcategorized domains in the database

59web filtering categories, plus the IAB taxonomy

~300knewly registered domains categorized each day

Dailydelta files; all other domains refreshed monthly

Social Networking

X, its official domains and the wider set of social platforms, viewers and front-ends. This is the category to block for most staff.

URL Shorteners

Use it if you want to treat t.co and similar shorteners as one group with its own policy.

VPN / Proxy / Anonymizers

Block it alongside Social Networking, or the social block will be bypassed within a day.

Streaming Media

Useful on guest networks where the real concern is video bandwidth, not the social site itself.

Vendors who build firewalls, DNS filters or MSP platforms license the database to power their own category engine.

The data runs inside your own systems as CSV, Parquet or JSON, with a lookup API included. Licensed exports can include DNS RPZ zones, hosts files and firewall external dynamic lists. See blocklist formats for what each one suits.

Managed service providers use the same data across many tenants. Read how it fits MSP web filtering, or the broader guide to web filtering software for business.

Related block guides

Messaging appsHow to block WhatsApp Web and how to block Telegram.

Another social appHow to block Snapchat on your network, a mostly mobile problem.

A four-week rollout plan for MSPs and IT teams

Switching on a social block across a whole company in one afternoon tends to generate angry tickets. A staged rollout gives people notice and gives you logs to prove the policy works.

Week 1: observe

Monitor only

Set Social Networking to log, not block.
Export a report of who uses X and how much.
Find teams with a genuine business need.

Week 2: agree

Write the rule down

Add the policy to the acceptable use document.
Get sign-off from HR and the comms lead.
Create the exception group in your directory.

Week 3: announce

Tell people

Send a short note with the date and the reason.
Explain how to request an exception.
Brief the help desk on the t.co decision.

Week 4: enforce

Switch to block

Turn on the block and the VPN category together.
Run the seven tests above.
Review logs after a week and adjust groups.

For MSPs, save the finished policy as a baseline you can apply to every new tenant. Exceptions then become a per-client group, not a new rule set.

FAQ: blocking X and Twitter

Is blocking twitter.com enough to block X?

No. The service now runs mainly on x.com, loads images and scripts from twimg.com and wraps links through t.co. A block that only lists twitter.com leaves the main site working.

Will blocking t.co break links in email?

It can. Links copied from posts often point to t.co, so blocking it stops those links from opening. Many organisations block x.com and twitter.com but leave t.co open, or block it and tell staff why links fail.

Can I let the marketing team use X while blocking everyone else?

Yes. Most firewalls, DNS filters and secure web gateways apply policy per user group. Put the social media team in a group with Social Networking allowed and keep the default policy blocking it.

How do I stop staff bypassing the block with a VPN?

Block the VPN / Proxy / Anonymizers category, restrict outbound DNS to your own resolver, stop encrypted DNS that bypasses it, and use application control to block VPN client installs on managed devices.

Why use a category database instead of a domain list?

Domain lists go stale. A category database labels new mirrors, front-ends, embed hosts and related sites as they appear, so a Social Networking rule keeps working without manual edits.

Building a filter that needs social categories?

License 120 million categorized domains for your firewall, DNS filter or MSP platform. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.

Talk to us

X and Twitter are trademarks of X Corp. Microsoft, Windows, Intune, Edge, Google, Chrome and Android are trademarks of their respective owners. They are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.