Freeware/Software: the web filtering category for software download sites
Freeware/Software labels sites built to hand people software to install: freeware and shareware portals, trials, drivers, utilities and app installers. It is one of the 59 categories in our web filtering database.
Most of these sites are legitimate. The category exists because installs are where a lot of security and licensing trouble starts, so IT teams want a clear switch for it.
What the Freeware/Software category includes
The test is the main action on the site: download and install. The audience is everyday users, not software developers.
Download portals
Catalogues of free and shareware programs with descriptions, screenshots and download buttons.
Trials and shareware
Time-limited or feature-limited versions of paid programs offered for download.
Vendor download pages
Consumer software makers' own sites where the download is the main purpose.
Drivers and firmware
Driver collections, printer and device utilities, firmware download sites.
Utilities and tools
System cleaners, archivers, media converters, PDF tools and similar desktop utilities.
App installer mirrors
Sites offering mobile app packages outside official app stores.
Open source apps for end users
Project sites for desktop open source apps whose visitors come to download a build.
Software review and download hubs
Review sites that pair ratings with download links or mirrors.
Add-on and plugin libraries
Libraries of themes, add-ons and plugins for desktop programs, aimed at users.
What it excludes, and the neighbouring categories
Downloads happen on many kinds of site. Three columns show what stays, what moves and what moves for security reasons.
Stays in Freeware/Software
- A portal listing thousands of free desktop programs
- A consumer antivirus maker's download page
- A printer driver collection
- An open source photo editor's download site
- A shareware archive with trial versions
Moves to a neighbour
- Code repositories and registries: Developer Tools / Code Hosting
- Game stores and game downloads: Gaming
- VPN apps: VPN / Proxy / Anonymizers
- Remote desktop clients: Remote Access Tools
- File lockers: Cloud Storage / File Hosting
Moves for security reasons
- Cracks and key generators: Malware / Phishing / Suspicious
- Torrent indexes: File Sharing/P2P
- Fake download pages for real brands: phishing
- Installers that carry harmful code
- Pages pushing fake "update your player" prompts
The same domain can move over time. A download portal that starts wrapping installers in harmful bundles gains a security label, and security policies act on that label first.
Typical site types and their risk level
Not all download sites are equal. This ladder shows how admins usually rank them, from lowest to highest concern.
- Lowest concern
Official vendor download pages. The maker distributes its own signed installer. Risk is mostly about licensing and unapproved software.
- Low
Curated open source app sites. Project-run download pages with checksums. The main risk is a lookalike domain pretending to be the project.
- Moderate
Large download portals. Many are fine, but some wrap installers in their own downloader or show ads styled as download buttons.
- Elevated
Driver and app mirror sites. Packages may be old, altered or repackaged. Hard for users to verify.
- Security label
Crack, keygen and fake download sites. These leave Freeware/Software and carry a malware or phishing label instead.
Domains that move into the highest rung are also available as a security feed. See the phishing and malware domain feed.
How fake download sites catch users
Fake download pages are one of the main reasons this category gets attention. The pattern is consistent, which is why fast labelling of new domains matters.
- Step 1
A lookalike domain is registered. The name copies a popular program, often with an extra word such as "download", "free" or "official".
- Step 2
The page copies the real site's look. Logo, colours and a large download button make it hard to tell apart at a glance.
- Step 3
Paid search ads or links send traffic. Users searching for the program click the first result they see.
- Step 4
The installer carries extras. It installs the real program plus adware, a password stealer or a remote access tool.
- Step 5
The domain is dropped and replaced. Campaigns move to fresh domains quickly, so static lists fall behind.
Very new domain
A download site registered days ago for a program that has existed for years is a warning sign.
Brand name in a new domain
The program name appears in the domain, but the domain does not belong to the maker.
Odd installer types
Archives with passwords or script files where a normal installer would be expected.
About 300,000 newly registered domains are categorized every day and rechecked after a week and a month. A lookalike download site that turns harmful after launch gets its security label on recheck.
Three ways organisations handle software downloads
The category supports three common operating models. Each has trade-offs in user friction and risk.
| Model | How it works | Strength | Weakness |
|---|---|---|---|
| Open with inspection | Category allowed; files scanned at the gateway or endpoint. | Low friction for users. | Relies on scanning catching new threats. |
| Blocked with catalogue | Category blocked; approved software comes from an internal catalogue. | Strong control over what runs on devices. | Needs a fast request process or users look for workarounds. |
| Role-based | Blocked for most staff, open for IT and engineering groups. | Balances control with flexibility. | Group membership must be kept up to date. |
| Ask-first | Users see a request page; a manager or parent approves. | Good for families and small teams. | Approvals can pile up without clear owners. |
Good fit: schools
- Block for students
- Allow for staff and IT
- Approved apps pushed by device management
Good fit: mid-size firms
- Role-based rules
- Self-service software catalogue
- Scanning for exempt groups
Good fit: homes
- Ask-first for children
- Allow for adults
- Security categories always on
Who blocks or allows freeware sites: policy table
This is one of the categories most often blocked at work and on student devices, even though it is not a liability category.
| Environment | Common default | Main reason | Usual exception |
|---|---|---|---|
| K-12 schools (CIPA) | Block for students | Managed devices should not install software; games often hide in download portals. CIPA does not require it. | Teachers and IT staff, plus specific education software |
| Universities | Allow | Students own their devices and need tools for coursework. | Lab machines may follow a stricter profile |
| Businesses | Restrict | Unapproved installs, licence compliance and bundled adware. | IT, engineering and help desk groups |
| Regulated sectors | Block | Change control rules require approved software only. | Software requests through a catalogue |
| Guest Wi-Fi | Allow or Limit | Guests manage their own devices. Some venues cap download bandwidth. | None needed |
| Parental control, young children | Block | Children may install games, fake apps or unwanted extras. | Parent approval per request |
| Parental control, teens | Ask first | Older children have legitimate needs but still meet bundled offers. | Known vendor download pages |
| ISP family profiles | Optional | Network-wide blocks affect adults in the household too. | Off by default, on in strict profile |
For school category sets see K-12 school web filtering. For workplace patterns see web filtering software for business.
Multi-category cases
Each domain can carry several categories ranked by how much of the site they describe. These combinations are common around downloads.
Portal with a large games section
School rules on gaming apply through the second label, even where software downloads are allowed for staff.
Privacy tools download site
Filter bypass tools are caught by the VPN label in school and business profiles.
Open source project with installers
Engineers read code; end users download builds. Both labels apply.
Desktop AI app download page
AI governance rules catch it first, download rules second.
Remote support client download
Remote access is often abused in scams, so it carries its own label for policy.
Ad-heavy download mirror
Ad blocking reduces fake buttons. See advertising filtering.
How vendors use the Freeware/Software category
Products that license the database usually put this category behind a single "software downloads" switch, with some useful refinements.
Secure web gateways
Block for most users, allow for IT, and inspect downloaded files for the groups that keep access.
Firewalls
Use the category in application rules and push lists as external dynamic lists for devices that read them.
DNS filters
Offer a "software downloads" toggle, usually on for schools and off for home users.
Endpoint and MDM tools
Pair category blocks with install restrictions, so a blocked portal and a blocked installer tell the same story.
Parental control apps
Turn the category into an approval request, so a parent sees what the child wanted to install.
Browser isolation
Open download portals in isolation and pass files through scanning before they reach the device.
Licensed customers can export the category as hosts files, DNS RPZ, AdGuard or Pi-hole style lists, EDL or PAC files. See blocklist formats and the lookup API.
Rollout checklist before blocking downloads
Blocking this category is common and usually smooth, if a few things are checked first.
- Allow operating system and browser update services separately from this category.
- List the vendor download domains your approved software needs.
- Give IT and help desk staff an exempt group.
- Check which labels your rule reads: first label only, or any label.
- Pair the block with endpoint install controls for a consistent message.
- Write a block page that tells users how to request software.
- Look up a sample of domains with the domain lookup tool.
- Watch logs for a week before switching from monitor to block.
Block page: say why
Tell users the site was blocked because it offers software downloads, not because it is dangerous. That lowers alarm and help desk calls.
Block page: say how
Link to the software request form or catalogue, so the user has a next step instead of a dead end.
Block page: show the label
Showing the category name helps IT staff spot mixed sites quickly when a user reports a problem.
Review: monthly
Look at the most requested blocked domains each month. Popular legitimate tools can move to the approved list.
Review: after incidents
When an unwanted program reaches a device, check which domain it came from and whether your rule read all of that domain's labels.
Review: new staff groups
New teams such as data science or design often need tools outside the catalogue. Plan their exemptions before they start.
Edge cases and how they are labelled
Some download sites sit right on a border. The table shows the usual outcome and the reason for it.
| Site | Main label | Reasoning |
|---|---|---|
| Office suite maker's download page | Freeware/Software, with Business | The download is the purpose of the page, while the company itself is a business software maker. |
| Browser maker's download page | Freeware/Software or Search Engines & Platforms | Depends on how much of the domain is the download versus the wider platform. |
| Educational software for schools | Education/Reference, with Freeware/Software | Teaching purpose leads, so school profiles can allow it while blocking general portals. |
| Antivirus trial download | Freeware/Software, with Computers & Technology | Security products are still software downloads for policy purposes. |
| Fan-made game mods | Gaming, with Freeware/Software | The game community leads, which keeps gaming rules in charge. |
| Emulator and ROM site | Gaming, often with File Sharing/P2P | Distribution of copyrighted game files moves it away from plain freeware. |
| Font download library | Freeware/Software, with Arts & Entertainment | Fonts are installed like software, and design is the topic. |
Freeware/Software FAQ
Short answers to the questions admins and product teams ask most.
What is the Freeware/Software category?
It covers sites whose main purpose is software download for installation: freeware and shareware portals, trials, consumer vendors' download pages, driver sites and installer mirrors.
Why do businesses block software download sites?
To stop unapproved installs, reduce exposure to bundled adware and harmful installers, and keep licensing under control. IT staff usually keep access.
Are pirated software and crack sites in this category?
No. Sites distributing cracks or harmful files carry Malware / Phishing / Suspicious, and torrent distribution carries File Sharing/P2P.
Does CIPA require schools to block freeware sites?
No. CIPA targets obscene images, child pornography and images harmful to minors. Many schools still restrict downloads on student devices for security reasons.
Will blocking this category stop operating system updates?
It should not if update services are allowed separately. Test first, because some applications fetch updates from their vendor's download domains.
Is a browser extension store in this category?
Official extension stores tied to a browser usually sit with that browser maker's services. Third-party add-on libraries for desktop programs are in this category.
Should guest Wi-Fi block software downloads?
Usually not. Guests manage their own devices and expect downloads to work. Venues worried about bandwidth tend to cap speed rather than block the category.
How fast are new download domains labelled?
New domains are categorized daily, about 300,000 a day, and rechecked after a week and a month. Customers receive them as daily delta files.
Can I license this category for my security product?
Yes, for internal, OEM and group-wide use. See OEM licensing and the full list of web filtering categories.
Put a reliable software downloads switch in your product
120 million categorized domains across 59 categories plus the IAB taxonomy, ranked multi-category labels and daily new-domain deltas. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
License the database