webfilteringdatabase.com
Home Find Your Solution
Features
Domain Categorization API Real-Time Classification 58 Filtering Categories Offline Database (120M) SaaS App Hostnames Mobile App Database Managed DNS Filter Content Classification
Industries
K-12 Schools Corporate Healthcare Government ISPs
Tools
Domain Lookup Bulk Categorization Category Explorer
Resources
Pricing API Documentation Login / Sign Up
Knowledge Base

Enterprise Web Filtering: How It Works and How It Is Deployed

Enterprise web filtering decides which websites staff, devices and systems may reach, based on each site's category and risk. Companies run it in DNS resolvers, secure web gateways, firewalls, SASE platforms and endpoint agents, and every one of them relies on a URL category database to make the call.

Full filtering solution · used by US public libraries and schools

We run the web filter for your library or school

Set one DNS address on your router and every device is filtered: CIPA categories blocked, a staff PIN for adult research, and reports for your records. Nothing to install.

From $99 / month per site
See filter plansHow it works

Enterprise web filtering in one minute

Enterprise web filtering is policy-based control of web access across a whole organisation: many sites, thousands of users, managed and remote devices. It blocks threats, enforces the acceptable use policy and shows where web traffic goes.

The direct answer

Every web request is checked against a category database, the category is compared with the policy for that user or group, and the filter allows, blocks, warns or logs. The filtering product enforces the rule; the category data decides what the rule actually catches.

That is why two filters with the same policy can behave very differently: the quality of the category data behind them is not the same.

What happens on every request

Request

A user, device or server asks for a domain, by DNS query or web connection.

Identify

The filter works out who is asking: user, group, device, site or network.

Categorize

The domain is looked up in the category database, often returning several categories.

Decide

The categories meet the policy for that group, plus any allow or deny list entries.

Act and log

Allow, block, warn or log, and record the decision for reports and audits.

Five ways enterprises deploy web filtering

There is no single enterprise web filter. Large organisations place filtering at one or more points in the network, and each point sees a different amount of each request.

DeploymentWhere it sitsWhat it seesStrengthsLimits to plan for
DNS filteringThe resolver every device uses, on site or in the cloudThe domain name onlyCovers every device and protocol, light to roll out, no certificates neededNo paths or uploads; encrypted DNS and hard-coded resolvers can route around it
Secure web gateway (SWG)A proxy, on premises or as a cloud service, that web traffic passes throughFull URLs, file types and uploads when traffic is inspectedFine-grained rules, warn pages, upload and download controlsNeeds traffic steering and certificate trust; privacy exemptions must be planned
Next-generation firewallThe network edge of each office or data centreDomain and server name, more with decryptionUses hardware already in place; one policy for web and other trafficRemote users are covered only if their traffic comes back through the office
SASE platformA cloud service combining SWG, CASB, ZTNA and firewall as a service with SD-WANFull web traffic for users wherever they workOne policy for office, home and travel; identity-based rulesA larger platform change; the web filter is one part of a wider project
Endpoint agentSoftware on each managed laptop or phoneRequests from that device, often with app contextWorks off-network and on any Wi-Fi; survives network changesOnly managed devices are covered; agents need rollout and updates
Common pairing

DNS layer plus SWG

DNS filtering catches every device, including printers and IoT, while the gateway handles detailed rules for people browsing.

Branch heavy

Firewall plus cloud DNS

Offices filter at the edge they already own; cloud DNS or an agent covers laptops when staff work elsewhere.

Remote first

SASE plus endpoint agent

Users connect to the cloud service from anywhere, and the agent steers traffic and enforces policy on the device.

Domain Categorization for Enterprise Defense

Enterprise web security has evolved far beyond simple URL blacklists. Modern organizations face a complex threat landscape where employees access thousands of domains daily. A comprehensive categorization database provides the intelligence layer every security stack requires.

Proactive Blocking

Newly registered domains are categorized every day, so suspicious ones can be blocked before an incident, with no signatures needed.

58 Content Categories

Granular classification across adult content, social media, file sharing, gambling, and dozens more categories.

Stack Integration

Feed categorization directly into firewalls, secure web gateways, SIEM platforms, and SOAR playbooks.

Enforce it without an appliance

Turn your acceptable use rules into switches on a DNS filter

If your goal is to protect your own company rather than ship a security product, we can run the filter and you keep the policy. It reads the same category database that security vendors license.

  • Set the firewall or router to one DNS address, then choose which of the 22 blocking categories apply at each site.
  • Add always-allow and always-block lists for the odd exception, or import the lists you already keep.
  • Search the activity afterwards and export it as CSV for audits or HR questions.
Overview dashboard of a managed filter covering several company sites
22
blocking categories to apply per office
Milliseconds
added to a DNS lookup
99.99%
of active websites that get a category

Acceptable Use Policy Enforcement

Transform written policies into automated, real-time enforcement with granular domain categorization

Every enterprise maintains an Acceptable Use Policy (AUP) that defines which web resources employees may access during work hours and on corporate devices. Traditionally, enforcing these policies relied on manual audits and employee self-compliance. With a web filtering database, AUP enforcement becomes automated, consistent, and auditable.

The 58 content categories map directly to common AUP rules.
  • Social media domains can be allowed during break hours but restricted during work periods.
  • Gambling, adult content, and illegal activity categories can be permanently blocked.
  • Streaming media can be throttled or restricted to preserve bandwidth for business-critical applications.

Category-based policies also adapt to organizational structure.

  • Engineering teams may need access to developer forums and code repositories that would be unnecessary for the accounting department.
  • Marketing teams require social media access that other departments do not.
Role-based policy templates built on domain categories enable this granularity without maintaining individual URL lists.

Role-Based Policies

Different access rules per department, team, or individual based on job function

Time-Based Controls

Restrict or allow categories during specific hours or business periods

Audit Trails

Complete logging of policy decisions for compliance and HR investigations

Designing enterprise web filtering policy by department

One policy for everyone either blocks too much for some teams or too little for others. Most enterprises start from a company-wide baseline and add department layers on top, using groups from the directory they already run.

GroupCommon starting pointUsual exceptionsWatch for
Company baselineBlock Malware / Phishing / Suspicious, Adult, Illegal Drugs, Hate/Discrimination and Parked / For-Sale DomainsNone at this level; exceptions belong to groupsKeep the baseline short, so every group can live with it
FinanceWarn on Cryptocurrency, Cloud Storage / File Hosting and personal Email and MessagingApproved banking and payment portals, audit toolsPayment fraud can start with a look-alike banking page
HR and legalBaseline plus warn on File Sharing/P2PJob Search/Careers, Social Networking for recruitingInvestigations may need temporary access to blocked content
MarketingBaseline, with social and streaming allowedSocial Networking, Streaming Media, Advertising/MarketingAd and tracking domains that other groups block
Engineering and ITBaseline, with developer tools allowedDeveloper Tools / Code Hosting, Remote Access Tools for named adminsRemote access tools outside IT are a common attack path
Security teamMonitor rather than block for researchMalware and phishing sites from an isolated browserKeep research access off normal workstations
Guest and contractor Wi-FiBaseline plus VPN / Proxy / Anonymizers and File Sharing/P2PNone by defaultGuest traffic should never reach internal systems

Five steps to a policy people accept

  1. 1. Write the baseline firstAgree the short list of categories nobody needs, with HR and legal, before any department asks for changes.
  2. 2. Run in monitor modeLog for two to four weeks without blocking. Real traffic shows which categories each group actually uses.
  3. 3. Use warn pagesFor grey areas such as AI / LLM Tools or Cloud Storage, a warning with a reason teaches more than a hard block.
  4. 4. Time-limit exceptionsEvery allow list entry gets an owner and an end date, so exceptions do not pile up for years.
  5. 5. Review each quarterCheck blocked-request trends, open exceptions and new categories such as AI tools, then adjust.

Our guide to custom policy management goes deeper on groups and overrides, and corporate web filtering covers policy for whole companies.

Data Loss Prevention & Shadow IT Detection

Identify unauthorized services and prevent sensitive data from leaving your network perimeter

Detecting Shadow IT Through Categorization

Shadow IT, the use of unsanctioned applications and cloud services by employees, is one of the largest security gaps in modern enterprises. It grows fastest where IT oversight is thin.

Many organizations use more cloud services than IT has approved. Domain categorization shows where that traffic goes.
Cloud Storage Detection Identify employee use of personal Dropbox, Google Drive, WeTransfer, and other file-sharing domains not approved by IT
Unauthorized SaaS Discovery Detect sign-ups and logins to project management, CRM, and communication tools outside the corporate portfolio
Personal Email Usage Monitor access to webmail providers that could be used to exfiltrate corporate data
AI Tool Monitoring Track employee use of AI chatbots and generative AI services where sensitive data might be submitted

Category-Driven Data Loss Prevention

Data loss prevention extends beyond endpoint agents. By categorizing the domains employees interact with, security teams can identify potential exfiltration vectors in real time.

Example: When an employee in the finance department suddenly begins uploading documents to a file-sharing domain categorized outside the approved list, the DLP system can alert, block, or quarantine the activity.

Domain categories such as file sharing, paste sites, personal email, cloud storage, and encrypted communications provide the context that traditional DLP systems lack.

  • Rather than inspecting every packet for sensitive patterns, category-based DLP focuses on the destinations most likely to be used for unauthorized data transfers, dramatically reducing false positives while maintaining comprehensive coverage.
  • Metadata such as technology stack age further enriches this analysis by indicating infrastructure maturity.

Reporting: what enterprise web filtering should show you

Blocking is half the job. The reports decide whether the security team, HR and auditors trust the filter, and every report is grouped by category, so category quality shows up here first.

Top categories by group

Where each department's web time goes. Large shifts point to new tools, new risks or a policy that no longer fits.

Security category hits

Blocked requests to malware, phishing and suspicious domains, by device. Repeated hits from one machine deserve a closer look.

New and unknown domains

Requests to newly registered or rarely seen domains. A high share of unknowns usually means weak category coverage.

AI tool use

Which teams use AI / LLM Tools and how often, so the AI policy rests on facts rather than guesses.

Exception review

Every allow list entry with its owner, reason and end date, ready for the quarterly review.

Exports for other tools

Decision logs with categories attached, sent to the SIEM or kept for audits and HR questions.

Per-user reports touch employee privacy. In some countries monitoring rules or works council agreements apply, so check local requirements before you turn on named reporting.

120M+ Domains Classified
58 Content Categories
~300K New Domains Categorized Daily
Daily Delta Files for New Domains
Shadow IT in our records

The services that tend to show up outside the approved list

These are real entries for services employees reach for on their own. Each category can be switched per site or left open for approved teams.

DestinationHow we store it
mega.nzCloud Storage / File Hosting
pastebin.comDeveloper Tools / Code Hosting, Cloud Storage / File Hosting
gmail.comEmail and Messaging
openai.comAI / LLM Tools
slack.comEmail and Messaging

Integration with SIEM, SOAR & Network Infrastructure

Feed domain intelligence into your existing security operations ecosystem

01

SIEM Enrichment

Enrich firewall logs, proxy logs, and DNS query logs with domain categories in real time.

  • When your SIEM ingests a connection to an unknown domain, the web filtering API instantly returns its category, enabling correlation rules like "alert when any endpoint in the finance VLAN connects to a domain categorized as file-sharing or paste-site outside business hours."
  • This transforms raw network telemetry into actionable security intelligence.
02

SOAR Playbook Automation

Automate incident response with category-aware playbooks.

  • When a restricted content email is reported, the SOAR platform can automatically query the web filtering database for every URL in the message, determine categories, and execute the appropriate response: block the domain at the firewall, scan all endpoints that accessed it, notify affected users, and create a ticket for the SOC team, all without human intervention.
03

Next-Gen Firewall Feeds

Feed category data directly into next-generation firewalls via their external dynamic list or content classification feed mechanisms.

  • The firewall can then enforce category-based rules at the network perimeter, blocking connections to unsafe content, and command-and-control domains before traffic even reaches internal systems.
04

Secure Web Gateway Enhancement

Augment your secure web gateway deployment with additional categorization intelligence.

  • The web filtering database provides a second opinion on domain classification, catches newly registered domains that gateway vendors have not yet categorized, and fills gaps in coverage for regional or niche domains that global vendors may miss.

RESTful API Integration

Query domain categories through the lookup API that comes with every licence. JSON responses carry each domain's categories, ranked, so your gateway can apply policy on every request.

Local Database Mirror

For latency-sensitive deployments, run the 120-million-domain database locally and apply the daily delta files. No external API dependency, and filtering continues even during internet outages.

Ready-made Export Formats

Licensed customers can take the data as hosts files, DNS RPZ zones, AdGuard and Pi-hole style lists, firewall external dynamic lists and PAC files, so it drops into the tools already in place.

Enterprise Deployment Architecture

A successful enterprise web security deployment requires careful planning around network topology, user authentication, and failover strategies. The web filtering database supports multiple deployment models to fit any enterprise environment.

1

Inline Proxy Mode

Deploy as a forward proxy where all HTTP/HTTPS traffic passes through the filtering engine. Each request is categorized in real time, and policy decisions are enforced before the connection is established.

This model provides the highest level of control but requires proxy configuration on endpoints or network-level traffic redirection.
2

DNS-Based Filtering

Redirect corporate DNS to filtering-enabled resolvers that check domain categories before returning IP addresses. Blocked domains receive an NXDOMAIN or redirect response.

This lightweight approach requires no endpoint agents and covers all protocols, not just HTTP.
3

API-Driven Enrichment

Integrate the categorization API into existing security infrastructure. Firewalls, proxies, and SIEM platforms query the API to enrich their native decision-making capabilities.

This model adds categorization intelligence without changing network architecture.

How a category database feeds enterprise web filtering

Enterprises buy a filter; the filter vendor brings the category data. Some vendors build it, some license it, and some combine their own threat data with a licensed category file.

Category database

Domains with ranked categories, refreshed daily for new domains and monthly for the rest.

Vendor lookup store

The vendor loads the file into its own systems and maps the categories to its product list.

Enforcement point

DNS resolver, gateway, firewall, SASE service or endpoint agent answers each request locally.

Enterprise policy

The customer switches categories per group and sees the result in blocks and reports.

Why category data quality decides the result

Enterprise buyers judge a filter by what it blocks and what it misses, not by the data behind it. For vendors, every gap in the data turns into a support ticket or a lost renewal.

Data problemWhat the enterprise seesWhat it costs the vendor
New domains not coveredA fresh phishing site loads, or a new business tool is blocked as unknownSecurity incidents traced back to the filter, and helpdesk noise
Wrong primary categoryA tool a team needs is blocked under a category it does not belong toTickets, manual exceptions and doubts about every other block
One category per siteA gaming site with betting features passes a Gambling blockPolicy gaps that customers find before the vendor does
Stale labelsA domain that changed owner or became parked keeps its old categoryWrong decisions on sites that are now risky or empty
Weak coverage outside EnglishRegional sites show up as uncategorized in local officesHarder sales in regions where the data is thin
Missing new categoriesNo clean way to report on or control AI toolsCustomers ask for a category the product cannot offer

120 million domains

Categorized in 58 web filtering categories, with the IAB Content Taxonomy in the same file.

About 300,000 a day

Newly registered domains categorized daily, then checked again after a week and after a month.

Several categories per site

Ranked by how much of the site each one describes, so secondary risks stay visible to policy.

Runs inside the product

CSV, Parquet or JSON files, on premises or air-gapped, with a lookup API included in licences.

Building a filter, gateway or SASE service? See the web filtering database, OEM licensing and the web filter lookup to check how we categorize the domains your customers care about.

Staff off the office network

Remote laptops and networks that rewrite DNS

A private encrypted link keeps laptops and phones under the same rules when they leave the building, and also where a provider redirects DNS. The managed filter needs no appliance or agent on your side, and one dashboard covers many sites.

Enterprise Security Use Cases

Real-world applications of domain categorization in enterprise environments

Financial Services

Banks and investment firms use domain categorization to prevent access to unauthorized trading platforms, block cryptocurrency exchanges on trading floor networks, and ensure compliance with SEC and FINRA regulations around electronic communications and data handling.

Healthcare Organizations

Hospitals and healthcare networks enforce HIPAA requirements by blocking access to personal cloud storage, restricting social media on clinical workstations, and preventing staff from accessing domains that could introduce ransomware into systems containing protected health information.

Manufacturing & Critical Infrastructure

Industrial environments use domain categorization to segment OT networks from IT networks, ensuring that industrial control systems can only communicate with approved vendor domains. Any connection attempt to an uncategorized or suspicious domain triggers an immediate alert.

Schools & Education

Schools are among the most targeted institutions for cyberattacks, and they face the same web security challenges as enterprises, combined with a duty to protect students. Districts deploy the best web filter for schools and school districts to combine threat blocking with age-appropriate content policies.

Enterprise web filtering checklist

Use these questions when comparing enterprise web filtering products, or when reviewing the one you already run. Each answer depends partly on the product and partly on the category data inside it.

  • Remote coverage: are laptops filtered at home, in hotels and on mobile data, not only in the office?
  • Bypass handling: does the product deal with encrypted DNS, VPN apps and proxy sites that route around it?
  • Category depth: does it separate AI tools, file sharing, personal email and remote access, or lump them together?
  • Several categories per site: can a policy act on a secondary category, such as betting inside a gaming site?
  • New domains: how fast are newly registered domains categorized, and what happens to unknown ones meanwhile?
  • Exceptions: can admins add scoped, time-limited allow and deny entries with an owner and reason?
  • Inspection exemptions: can banking, health and other private categories skip decryption?
  • Reporting and export: are decisions logged with categories, and can they flow to the SIEM?
  • Groups and sites: do policies follow directory groups and work across many offices?
  • Test before rollout: can you look up your critical business sites and see how they are categorized?

Common mistakes in enterprise rollouts

Blocking all unknown domains

Safe on paper, but with weak data it breaks new business tools daily. Warn or isolate unknowns instead, and judge coverage first.

Inspecting everything

Decrypting banking, health and personal email traffic raises privacy issues. Exempt those categories from inspection by design.

One policy for all

A single rule set forces either constant exceptions or weak protection. Groups from the directory fix this at the start.

Ignoring DNS bypass

Browsers and apps with their own encrypted DNS can skip a DNS filter. Control it with device settings, firewall rules or an agent.

Exceptions that never expire

Old allow list entries become blind spots. Give every exception an end date and review the list each quarter.

Testing only famous sites

Every filter knows the top brands. Test your own suppliers, regional sites and new domains, where data quality shows.

API Integration for Enterprise Security

Integrate domain categorization into your enterprise security stack with just a few lines of code

Enterprise Security Policy Enforcement

Classify domains against corporate policy categories and take automated action: block, allow, or flag for review.

import requests

API_URL = "https://webfilteringdatabase.com/api/moderate.php"
API_KEY = "YOUR_API_KEY"

# Categories blocked by corporate acceptable use policy
BLOCKED_CATEGORIES = {
    "Adult Content", "Gambling", "Weapons",
    "Drugs", "Malware", "Phishing"
}

def enforce_policy(domain):
    result = requests.post(API_URL, json={
        "api_key": API_KEY,
        "query": domain
    }).json()

    categories = set(result.get("categories", []))

    # Check against corporate AUP categories
    violations = categories & BLOCKED_CATEGORIES
    if violations:
        return "BLOCK", f"Policy violation: {', '.join(violations)}"

    return "ALLOW", result.get("primary_category", "Uncategorized")

# Enterprise firewall integration example
domains_to_check = ["slack.com", "poker-site.xyz", "drive.google.com"]
for domain in domains_to_check:
    action, reason = enforce_policy(domain)
    print(f"{action}: {domain} ({reason})")
const API_URL = 'https://webfilteringdatabase.com/api/moderate.php';
const API_KEY = 'YOUR_API_KEY';

const BLOCKED_CATEGORIES = new Set([
    'Adult Content', 'Gambling', 'Weapons',
    'Drugs', 'Malware', 'Phishing'
]);

async function enforcePolicy(domain) {
    const response = await fetch(API_URL, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ api_key: API_KEY, query: domain })
    });
    const result = await response.json();

    // Check AUP category violations
    const violations = (result.categories || [])
        .filter(c => BLOCKED_CATEGORIES.has(c));
    if (violations.length) {
        return { action: 'BLOCK', reason: violations.join(', ') };
    }

    return { action: 'ALLOW', reason: result.primary_category };
}

// Check enterprise traffic
['slack.com', 'poker-site.xyz', 'drive.google.com']
    .forEach(async (d) => {
        const { action, reason } = await enforcePolicy(d);
        console.log(`${action}: ${d} (${reason})`);
    });
# Classify a domain for enterprise policy enforcement
curl -X POST "https://webfilteringdatabase.com/api/moderate.php" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "query": "slack.com"
  }'

# Example response:
# {
#   "domain": "slack.com",
#   "primary_category": "Business",
#   "categories": ["Business", "Technology", "Messaging"]
# }

# Check a suspicious domain
curl -X POST "https://webfilteringdatabase.com/api/moderate.php" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "query": "poker-site.xyz"
  }'
<?php
// Enterprise web security policy enforcement
$apiUrl = 'https://webfilteringdatabase.com/api/moderate.php';
$apiKey = 'YOUR_API_KEY';

$blockedCategories = ['Adult Content', 'Gambling', 'Weapons', 'Drugs', 'Malware'];

function enforcePolicy($domain, $apiUrl, $apiKey, $blocked) {
    $ch = curl_init($apiUrl);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
        'api_key' => $apiKey,
        'query'   => $domain
    ]));
    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $result = json_decode(curl_exec($ch), true);
    curl_close($ch);

    // Check AUP violations
    $violations = array_intersect($result['categories'] ?? [], $blocked);
    if (!empty($violations)) {
        return ['BLOCK', implode(', ', $violations)];
    }

    return ['ALLOW', $result['primary_category'] ?? 'Uncategorized'];
}

// Enterprise gateway integration
$domains = ['slack.com', 'poker-site.xyz', 'drive.google.com'];
foreach ($domains as $d) {
    [$action, $reason] = enforcePolicy($d, $apiUrl, $apiKey, $blockedCategories);
    echo "$action: $d ($reason)\n";
}
?>

Stack integration or a filter that is already running

For many companies the real question is how much of the web control they want to build and operate.

NeedWire the database into your stackManaged DNS filter
Time to first blockDepends on your integration workOne DNS address on the router or firewall
Staff who need research accessYou build the exception flowPIN bypass for 15, 30 or 60 minutes, logged, and it reverts
Many branchesReplicate policy yourselfOne dashboard, separate settings per site
Evidence for compliancePipe logs into your own toolsSearchable activity, reports and CSV exports
Category depthSame 120M+ domain databaseSame database, 22 blocking categories per site

Enterprise web filtering FAQ

What is enterprise web filtering?

The controls a company uses to decide which websites staff, devices and systems may reach, based on each site's category and risk. It runs in DNS resolvers, secure web gateways, firewalls, SASE platforms and endpoint agents.

Do enterprises need DNS filtering or a secure web gateway?

Often both. DNS filtering covers every device and protocol cheaply but sees only the domain, while a secure web gateway sees full URLs and uploads but needs traffic routed through it.

How does web filtering cover remote employees?

Through a cloud service the device connects to, such as a SASE platform or cloud DNS filter, or through an endpoint agent on the laptop. Traffic sent back over a VPN to the office firewall also works but adds delay.

Does enterprise web filtering require SSL inspection?

Not for category decisions on the domain, which DNS queries and the TLS server name usually reveal. Inspection is needed for path rules, upload controls and content scanning, and many teams exempt banking and health sites for privacy.

How many categories does an enterprise web filter need?

Enough to separate risks that policies treat differently, such as AI tools, file sharing, personal email and newly seen domains. Our database uses 58 web filtering categories and allows several per domain.

Where does the category data in a web filter come from?

Filter vendors build a URL category database, license one, or combine both. The enterprise sees the result as the category behind every allow or block decision.

Pricing follows the number of sites and devices you want covered. Start with a pilot on a single site, and read the blocks and reports before you commit the rest of the company.

Secure Your Enterprise with Domain Intelligence

Leverage 120 million categorized domains and 58 content categories to build a comprehensive enterprise web security strategy.