Cloud Storage and File Hosting Web Filtering Category
Cloud drives, file sync, large file transfer, one-click file hosters and online backup. Essential for daily work, and one of the main routes for data leaving an organisation and malware coming in.
Part of our 59 web filtering categories across 120 million categorized domains.
What the category includes
A site belongs here when its main job is to hold files for users or move files between them through the provider's servers. These are the service types inside the category.
Personal cloud drives
Consumer storage with web, desktop and mobile access to a user's own files.
Business file sync
Team folders, shared drives and file sync built for companies, with admin controls.
Large file transfer
Send-a-file services that email a download link for files too big to attach.
One-click file hosters
Upload anything, get a public link, often with countdown pages and paid fast downloads.
Online backup
Automatic backup of computers and phones to remote storage, with restore portals.
Photo and video storage
Photo libraries and video vaults focused on keeping personal media safe.
Secure file exchange
Encrypted portals that firms use to swap contracts and records with clients.
Image hosting
Upload-and-link image hosts used to embed pictures in forums and posts.
Document sharing
Sites for publishing and sharing documents, slides and PDFs by link.
Paste and text drops
Paste services for sharing text snippets by link, with or without expiry.
Self-hosted storage portals
Web front ends of storage that firms or people run themselves on their own servers.
Encrypted vaults
Zero-knowledge storage services where only the user holds the keys.
Three directions of risk
Storage policy is easier when you think about which way the files move. Each direction has its own risk and its own control.
Upload: data leaving
Staff copy files to personal storage, by mistake or on purpose.
- Allow the approved service only
- Block or warn on uploads to others
- Inspect uploads where policy needs it
Share: data exposed
Public links spread files beyond the people meant to see them.
- Prefer services with link expiry and access logs
- Report on use of public file hosters
- Keep anonymous file drops restricted
Download: threats arriving
Malware and phishing documents ride on trusted storage domains.
- Scan downloads from all storage categories
- Block file hosters with poor reputation
- Combine with phishing feeds for single links
What it excludes and the neighbouring categories
Files move across the web in many ways. This category is for services built around storing and sharing files, not for every site that happens to serve one.
In the category
- Storage and sync services with user accounts
- Link-based file transfer and file hosters
- Backup services and restore portals
- Document, image and paste hosting by link
Outside the category
- Torrent sites, trackers and P2P networks: File Sharing/P2P
- Content delivery and web hosting: CDN / Hosting / Infrastructure
- Code repositories: Developer Tools / Code Hosting
- Video platforms: Streaming Media
Typical example site types
The category runs from the major consumer and business cloud drives that most organisations use daily to small file hosters that appear and vanish quickly.
The company's chosen drive
The business storage service under contract, with single sign-on and admin logs.
Personal drive accounts
The same kind of service, used with a private login instead of the company one.
Large file senders
Used by agencies and studios to deliver big artwork and video files to clients.
Anonymous file hosters
No account needed, public links, ad-heavy pages. Popular for pirated and malicious files.
Backup portals
Restore pages for device backup, needed by IT and home users alike.
Client file portals
Secure exchange sites used by accountants, lawyers and banks.
Paste sites
Handy for developers, and also used to post leaked data or attack scripts.
Image hosts
Pictures embedded in forums and blogs; content quality varies widely.
Who blocks or allows cloud storage
Few organisations can block storage outright. The common pattern is to allow one approved service and treat the rest with care.
| Environment | Typical action | Main concern | Common setup |
|---|---|---|---|
| Enterprises | Approved only | Data leaving the company | Allow the sanctioned service, block or warn on others, inspect uploads |
| Regulated sectors | Strict | Client, health and financial records | Allow list of storage services; block anonymous file hosters |
| K-12 schools (CIPA) | District service only | Malware, piracy and unsuitable files | Allow the district's storage; restrict public file hosters and image hosts |
| Universities | Allow | Research data sharing | Allow broadly; scan downloads; restrict known malicious hosters |
| Guest Wi-Fi | Allow | Bandwidth on big transfers | Allow; shape very large transfers if needed |
| Parental control | Allow | Shared files with unsuitable content | Allow family storage; restrict anonymous hosters for children |
| Operational technology | Block | No reason for storage traffic | Default deny, with named update portals allowed |
| MSP client networks | Per client | Mixed client needs | Template with the client's chosen service on an allow list |
CIPA itself is about blocking obscene and harmful-to-minors images, so storage rules in schools are mostly about security and acceptable use. See K-12 school web filtering for district patterns.
Sanctioned versus unsanctioned storage
The same technology can be safe or risky depending on whose account it is. Category data tells you a site is storage; your policy decides which storage counts as approved.
Sanctioned storage
- Under company or district contract
- Single sign-on with work accounts
- Admin logs, retention and legal hold
- Data stays in agreed regions
- Allowed for upload and download
Unsanctioned storage
- Personal accounts or no account at all
- No admin view of what was shared
- Public links that never expire
- Unknown data location and retention
- Blocked, warned or read-only
Product teams pair this category with the AI tools category, because document upload AI tools raise the same data leakage questions as storage.
Policy notes by service type
Not every storage service deserves the same rule. These notes help product teams decide which types to expose as separate switches.
| Service type | Work value | Main risk | Suggested default |
|---|---|---|---|
| Business file sync | High | Personal accounts on the same service | Allow; tenant controls where the product supports them |
| Personal cloud drives | Low at work | Data leaving | Block uploads or warn |
| Large file transfer | High for creative teams | Data leaving, malware arriving | Allow for named teams; scan downloads |
| One-click file hosters | Low | Malware, piracy | Block in schools and strict profiles |
| Online backup | Medium | Unmanaged copies of company data | Allow the approved backup only |
| Photo and video storage | Low at work | Bandwidth | Allow on guest networks; limit at work |
| Secure file exchange | High | Phishing pages that copy them | Allow; phishing feed covers fakes |
| Image hosting | Low | Unsuitable images | Restrict for children |
| Document sharing | Medium | Phishing documents | Allow; scan and check links |
| Paste sites | Medium for developers | Leaked data, scripts | Allow for engineering; restrict elsewhere |
Questions to settle before writing storage rules
Storage rules touch every department, so a short agreement up front saves a lot of support tickets later.
Business questions
- Which storage service is approved, and for which kinds of data?
- Which teams send large files to clients or partners?
- Are personal drives allowed for reading but not uploading?
- Who approves a new storage service when a client insists on one?
Technical questions
- Is the rule enforced at DNS, at the gateway, or both?
- Can the gateway see uploads, or only domains?
- Are downloads from storage scanned before delivery?
- How are remote and mobile users covered?
Multi-category cases
A domain can carry several categories, ranked by how much of the site they describe. Storage often sits next to productivity, AI and security labels.
Office suite with built-in drive
Work apps lead; the storage rank lets data rules still apply to file uploads.
Drive with an AI document assistant
Upload rules should fire on either rank.
File hoster full of pirated media
The P2P-style rank brings it into the CIPA-relevant set for schools.
Throwaway file host spreading malware
The security rank blocks it everywhere.
Image host with explicit galleries
Adult on any rank blocks it under CIPA and family rules.
Paste site for code snippets
Engineering profiles keep it; general staff profiles may not.
Accountant's client portal
Finance leads; storage rank documents the file exchange.
Storage with a built-in web proxy
Rare but real; the proxy rank blocks it in schools.
How vendors use the category in their products
The database ships as CSV, Parquet or JSON files that run inside your own systems, with a lookup API included in licences. These are the common uses.
Gateway and firewall rules
Allow, warn or block storage by user group, with external dynamic list (EDL) exports.
DLP triggers
Turn on upload inspection only for storage, AI and mail categories.
Download scanning
Send files from storage domains to deeper scanning before they reach users.
Shadow IT reports
Show which storage services are in use, by how many users, across networks.
DNS filters
Block anonymous file hosters at DNS level with RPZ or hosts-style exports. See blocklist formats.
School filter presets
District storage allowed, public file hosters off by default for students.
Why trusted storage domains carry threats
Attackers like storage services because the domains are trusted and rarely blocked. Category rules set access; security feeds and scanning deal with the bad files.
Shared document lures
A real storage link to a document that leads to a fake login page.
Hosted payloads
Malicious files placed on file hosters so downloads come from a known domain.
Data drops
Stolen data posted to paste sites or anonymous hosters for others to collect.
Lookalike portals
New domains that copy a storage login page to steal credentials.
Lookalike portals and phishing pages are covered by our phishing and malware domain feed, which sits on top of the storage category in most products.
Keeping storage services current
New file hosters appear constantly and many disappear within months. These outputs keep the category accurate.
Daily new domains
About 300,000 newly registered domains are categorized daily and delivered as delta files.
Rechecks
New domains are checked again after a week and after a month.
Monthly refresh
All other domains are refreshed monthly, so closed hosters move to parked.
Validation
Regular manual validations measure accuracy, with reports for licence holders.
Check how a storage service is labelled with the domain category lookup.
Cloud Storage / File Hosting FAQ
What is the Cloud Storage / File Hosting category?
Services where people store, sync, send or download files over the web: cloud drives, business file sync, large file transfer, file hosters, online backup and photo storage.
How is it different from File Sharing/P2P?
Cloud storage keeps files on the provider's servers and shares them by link or account. File Sharing/P2P covers torrent sites, trackers and peer-to-peer networks.
Should businesses block cloud storage?
Most allow the approved service and block or restrict uploads to others, because personal storage is a common path for data leaving the company.
Why do file hosting sites appear in malware reports?
Attackers place malicious files on trusted storage services. Category rules decide access, while download scanning and phishing feeds handle single files and links.
Can I tell a company account from a personal account by category?
No. Category data identifies the service. Telling work and personal accounts apart is done by the gateway, for example with tenant or sign-in controls.
Do schools need to block file hosters for CIPA?
CIPA requires blocking obscene and harmful-to-minors images, not storage as such. Many schools still restrict public file hosters for security and piracy reasons.
Are paste sites in this category?
Yes, as text drops shared by link. Code-focused paste tools may also carry Developer Tools / Code Hosting.
Does blocking the category break software updates?
Usually not. Most update downloads come from vendor or CDN domains, which carry CDN / Hosting / Infrastructure. Where a vendor ships files from a storage service, add that domain to an allow list.
Can I allow downloads but block uploads?
That depends on the enforcement point. A gateway that inspects traffic can split upload and download actions per category; a DNS filter can only allow or block the domain.
Are self-hosted storage portals covered?
Yes, when the web front end is reachable on its own domain. Many firms run them for client exchange, so they usually rank here with Business as a second category.
Do image hosts count as storage or as social sites?
Plain upload-and-link image hosts rank here. Image sites built around profiles, likes and feeds rank Social Networking first.
How is the database licensed?
For internal use, OEM embedding or group-wide use, without resale of the raw data. Starter database tiers start from $999; enterprise and OEM licences are quoted per deployment. See pricing.
Put storage control into your product
Ranked categories for storage, file hosting and every neighbour, inside 120 million categorized domains with daily updates. Tell us about your deployment.
License the database