Web Filtering Glossary: 150+ Terms Explained

A written set of rules that says how staff, students or guests may use the network and the web. The filter is the technical part that enforces whatever in it can be checked by domain or category.

Write the policy first and map it to categories second, or the filter ends up writing the policy by accident.

The share of domains whose category matches what a careful human reviewer would choose. One headline number hides a lot, so serious buyers ask for it per category and per popularity band.

Precision and recall, further down, split accuracy into the two errors a filter actually feels.

Refusing requests to advertising and tracking domains, usually at DNS or in the browser. It speeds up pages and closes one route for malicious ads.

The category for chatbots, writing and coding assistants, image generators and other AI services. Our set covers 11,800+ AI-tool domains in 18 categories and 165 subcategories, updated daily.

It lets a policy allow approved AI tools and block the rest; see the AI and LLM tools category.

Running a filter and its data on a network with no connection to the internet at all. The category data then has to arrive as files copied in on a schedule, never as live cloud lookups.

A list of domains or URLs that are always permitted, whatever their category says. It sits above category rules and is the usual fix when a needed site is blocked.

Every entry is a small hole in the policy, so keep the list short and reviewed; see how to import allow and block lists.

A website or app built to hide where a user is browsing, usually by relaying traffic through another server. Filters treat anonymizers as high risk, because one working anonymizer defeats the whole policy.

Identifying specific applications and their functions, for example allowing a chat app while blocking its file transfers. It complements URL categories, which work at the level of whole sites.

A record of who changed the filter policy, when, and what exactly changed. Schools, regulated firms and MSPs use it to show that the policy on paper matched the policy in force.

A list of domains, URLs or IP addresses that the filter always refuses. Lists are exact and easy to audit, but they only know the entries someone has added.

They come in several file formats, compared in our guide to blocklist formats.

The page a user sees in place of a refused site, usually naming the category and offering a way to ask for a review. For HTTPS sites a DNS filter can only show it if the device trusts the filter's certificate; otherwise the browser shows a connection error.

A group of infected devices that an attacker controls remotely and uses for spam, fraud or attacks. Blocking botnet domains stops infected machines from receiving orders, even when the infection itself was missed.

A web filter that runs inside the browser and sees the full URL of every page. It suits managed browsers but misses traffic from other apps on the same device.

Loading risky pages in a remote, throwaway browser and sending the user only a safe rendering. Category data decides which sites are isolated, which open normally and which are refused outright.

Sending many domains in one request or file and receiving their categories back as a batch. Teams use it to label logs, clean lists or profile a new customer's traffic before go-live.

Personal phones and laptops that join an organisation's network. They rarely accept certificates or agents, so DNS filtering and SNI checks are the main controls for them.

A short-lived permission that lets a trusted person open a blocked site, such as a teacher researching a topic. Good designs log every use and switch the block back on by themselves.

The servers that malware calls home to for instructions and to hand over stolen data. Blocking C2 domains at DNS can cut off an infection that endpoint tools did not catch.

The web page a guest network shows before it grants access, often to accept terms or enter a code. The filter must allow the portal and everything it loads, or guests cannot get online at all.

A control point between users and cloud services that shows which apps are in use and what data moves to them. It works best with a dependable record of which domains belong to which kind of service.

A label that says what a website is about, such as Gambling or News/Media. Policies are written in categories because nobody can list millions of sites by hand.

Our taxonomy has 58 of them, listed on the web filtering categories page.

Blocking or allowing sites by their category instead of by name. One rule covers every site in the category, including sites that went live yesterday.

Setups for common devices are in how to block websites by category.

A table that translates one set of categories into another, for example from a data supplier's labels into the names a product already shows. Good mappings record one-to-many cases instead of forcing a single match.

Servers around the world that cache and deliver content for many sites at once. CDN hostnames carry traffic for unrelated sites, so they need careful labels rather than one blanket block.

An app setting that accepts only one specific certificate for its server. Pinned apps break under TLS inspection, so they go on the decryption exemption list.

A US law that ties E-Rate discounts and certain library funding to an internet safety policy and a technology protection measure. The measure must block or filter visual depictions that are obscene, child pornography or harmful to minors on computers used by minors.

The categories that matter are covered on our CIPA web filtering page.

A tracking trick where a third-party tracker is served from a subdomain of the site being visited, linked by a DNS alias. Filters that judge only the first name in a lookup miss it, so they should also check where the alias leads.

The wider practice of controlling what reaches users, by address, by page content, by file type or in search results. URL filtering and DNS filtering are its most common forms.

Deciding by reading the page itself, its words, images or scripts, at the moment it loads. It catches pages a database has never seen, at a cost in speed and with more false positives.

The share of real requests for which the database returns a category. Coverage measured on live traffic matters more than the raw number of domains in a file.

Our 120 million domains include the 20 million most visited, which account for 99.99% of web traffic.

Using someone else's device to mine cryptocurrency without consent, often through a script on a web page. Blocking mining pools and script hosts stops the drain on processors and batteries.

Three common file formats for category data: CSV for simple tables, JSON for nested records and Parquet for fast analytics on very large files. Pick the one your pipeline already reads well.

Controls that stop sensitive data leaving the organisation through uploads, pastes, email or file sharing. URL categories tell DLP which destinations are personal storage, AI tools or file sharing.

More in URL category data for DLP.

A contract that sets out how a supplier handles personal data on a customer's behalf. GDPR expects one when a filtering service stores or processes the browsing logs of a customer's users.

Examining the contents of network packets beyond their headers to recognise applications or threats. It is the engine behind application control in many firewalls.

What the filter does with traffic that no rule matches. Most web policies allow by default and block chosen categories, while high-security networks reverse that.

A file that holds only what changed since the last delivery: new domains, changed categories and removals. Daily deltas keep a product current without reloading the whole database.

Ours carry about 300,000 new domains a day; see real-time URL classification.

Standards from the Department for Education in England that describe good filtering and monitoring in schools and colleges. They cover named roles, regular reviews, blocking harmful content without unreasonable overblocking, and effective monitoring.

They are revised from time to time, so check the current version.

Code in malware that produces large numbers of random-looking domain names, so the attacker only needs to register a few of them. Defenders spot it by the pattern of the names and by how new and unvisited they are.

A small program on a laptop or phone that sends DNS lookups to the filter even away from the office network. It also stops the device from quietly switching to another resolver.

Filtering at the moment a device looks up a domain name, by refusing or redirecting answers for blocked categories. It is fast and covers every app, but it sees only the domain, never the full URL.

What is DNS filtering explains the method in depth.

DNS lookups carried inside encrypted HTTPS traffic, standardised as RFC 8484. It protects privacy, but it lets browsers and apps skip the network's filtering resolver.

How admins keep control is covered in DNS over HTTPS and web filtering.

Encrypted DNS on its own port, 853, defined in RFC 7858. Because the port is dedicated, a network can allow or block it far more easily than DoH.

The server that answers a device's DNS questions by asking other servers on its behalf. A filtering resolver adds one step: check the category, then answer or refuse.

A resolver rule that answers lookups for bad domains with a harmless address instead of the real one. Security teams also use sinkholes to spot which devices keep trying to reach known threats.

Assigning one or more categories to a domain so that policies, reports and analytics can use it. Done well, it is reviewed, validated and refreshed, because sites change.

Lookups by API are described on the domain categorization API page.

Hiding the real destination of a connection behind the name of an allowed, popular service, so the visible name and the real host differ. Many large providers now refuse the practice, but filters should still not trust a name alone.

Malware that installs itself when someone merely visits a page, usually through a browser or plug-in flaw. Blocking compromised and malicious domains is the first line of defence.

A service that keeps a name pointed at an address that changes often, such as a home connection. It has honest uses, but attackers like it for short-lived infrastructure, so many policies treat it as a risk signal.

The US Schools and Libraries Universal Service Support program, which discounts internet access and network costs for eligible schools and libraries. Applicants that take discounts for internet access or internal connections must comply with CIPA.

A TLS extension that encrypts the site name a browser sends when it opens a secure connection, published by the IETF as RFC 9849 in 2026. Where it is in use, network filters lose the SNI signal and must rely on DNS, endpoints or inspection.

A plain text list of domains, URLs or IPs hosted at a web address that a firewall fetches on a schedule. The list can change without anyone editing the firewall rules.

Controlling which outbound connections may leave a network, not only which may come in. Category data turns egress rules from long address lists into policy people can read.

Filtering performed on the device itself, by an agent, a profile or the browser. It keeps working on home and public networks where no gateway sits in the path.

A browser built or locked down for company use, with rules for uploads, pastes, downloads and site access. It sees full URLs and page actions, so category data can drive very fine rules.

A proxy that devices are told to use by name, through settings, a PAC file or WPAD. It sees each request clearly but depends on every device being configured.

What a filter does when it cannot reach its policy or data: let traffic through (fail open) or stop it (fail closed). Schools often choose closed for safety, while businesses often choose open for uptime.

A harmful or out-of-policy site that the filter lets through because its category is wrong or missing. Users rarely report these, so they are found by testing.

A legitimate site that the filter blocks because of a wrong category or an overbroad rule. Each one costs a helpdesk ticket and a little trust in the filter.

A hosting trick where a domain's addresses change every few minutes across many compromised machines. Blocking by domain name works far better than chasing the moving addresses.

Form 486 is where a school or library confirms that services have started and certifies its CIPA status for E-Rate. Form 479 is the matching CIPA certification that consortium members give to their consortium lead.

A server that makes web requests on behalf of users, so it can see, log and filter them. A secure web gateway is a forward proxy with security features added.

A complete host name such as mail.example.com, spelled out all the way to the top of DNS. Category data may be stored per FQDN, per registered domain, or both.

A complete replacement copy of the database rather than a list of changes. A common pattern is a monthly full refresh with daily deltas applied in between.

The EU data protection law, under which browsing logs linked to a person count as personal data. A filter needs a lawful basis, a clear purpose and a retention limit for those logs.

A domain category file holds no personal data, which keeps the data supply itself simple.

A licence that lets a company with several products or subsidiaries use one copy of the data across all of them. It replaces a stack of separate contracts with one set of terms.

Filtering on visitor networks in hotels, cafes, clinics and offices, usually at DNS. Its main jobs are keeping illegal and adult content off the network and protecting the venue's name.

A CIPA term for visual material that is sexual in nature, patently offensive for minors and lacking serious value for them. Filters address it mainly through adult content categories.

A fake domain that swaps in look-alike characters from other alphabets so it reads like a trusted brand. Browsers and filters counter it by showing or checking the encoded form of the name.

The name of one specific service, such as www or api in front of the domain. Categorizing at hostname level lets a shared platform carry different labels for different services.

A local file that maps names to addresses before DNS is asked at all. Pointing a domain at 0.0.0.0 in it blocks that domain on that one device.

An industry standard set of content categories used mainly in advertising, with 703 categories in version 3. Our database delivers it next to the 58 web filtering categories, in the same file.

Field layouts are on the taxonomy reference page.

A domain written with characters beyond basic Latin, such as accented letters or other scripts. Under the hood it is stored in an encoded ASCII form, and that form is what filters should compare.

Evidence that a system may be compromised, such as a domain, address or file hash seen in an attack. Domain indicators become far more useful when they carry a category and an age.

A filter placed directly in the traffic path, able to stop a request before it completes. Out-of-band tools only watch copies of traffic, so they can report but not block.

A licence to use the data inside your own organisation, for your own network, analytics or security. It does not cover shipping the data to customers inside a product.

The written policy CIPA requires from schools and libraries, covering topics such as access to inappropriate material, safety in email and chat, unlawful activity and minors' personal information. It must be adopted after public notice and at least one public meeting or hearing.

Blocking by network address rather than by name. It is blunt on the modern web, where one address can serve thousands of unrelated sites behind a CDN.

Filtering run by the internet provider, for all customers or only those who opt in, such as family plans. It works at very high volume, so lookups must be local and fast.

Statutory guidance for schools and colleges in England that expects appropriate filtering and monitoring. It makes the designated safeguarding lead responsible for online safety, including how filtering and monitoring work.

A new edition usually appears each year, so check the current one.

The delay a filter adds to each request while it decides. Local lookups add almost nothing; waiting on a remote service for every request is what users notice.

How long a filter keeps its records of requests and decisions. Keep logs long enough for investigations and reports, and no longer than your privacy rules allow.

A domain built to resemble a real brand, through misspellings, extra words or swapped characters. Lookalikes feed phishing and fake shops, so new ones deserve fast review.

Brand protection uses are covered in URL category data for digital risk protection.

A web service that returns the categories for a domain or URL on request. It suits low-volume checks and brand-new names, while a local file suits high-volume filtering.

Endpoints and fields are in the API documentation.

Malicious code or redirects delivered through ad networks, so that even a trusted site can show a harmful ad. Blocking known bad ad domains and risky redirect hosts reduces exposure.

Software written to harm devices or steal data, including ransomware, spyware and trojans. Domain filtering blocks the sites that host it, deliver it or control it.

The share of lookups in a given log that find a category in the database. Test it on your own traffic rather than trusting a headline figure.

Software that configures and controls company or school devices, including their web filtering settings. It can push a filtering profile, a DNS setting or an app allow list to each device.

Watching how devices are used and alerting staff to signs of risk, which UK school guidance treats as separate from filtering. Category data can feed monitoring tools, but a category file does not watch anyone.

A company that runs IT for other businesses, often including their firewall and web filter. MSPs want one policy model they can repeat across many client sites.

See web filtering for MSPs.

An MSP that focuses on security monitoring and incident response. Category data helps its analysts triage alerts across clients that run different tools.

A domain that carries more than one category because the site covers more than one subject. Our data stores several categories where a site fits more than one, ranked by how much of the site each describes.

A domain seen in traffic for the first time, whatever its registration date. It catches old domains that suddenly come to life, which registration dates alone miss.

A domain registered in the last few days or weeks. Many phishing and scam sites are young, so a lot of policies block or warn on NRDs for their first days.

We categorize about 300,000 new domains a day and check each again after a week and a month; see how to block newly registered domains.

A firewall that adds application awareness, intrusion prevention and URL filtering to classic port and address rules. Its URL filter relies on a category database like any other web filter.

The DNS answer that says a name does not exist. Some DNS filters return it for blocked domains, which is simple but gives users no explanation.

A licence to build the data into a product you sell or provide, such as a firewall, router, app or SaaS service. Your customers use the categories through your product, never as raw files.

Terms are explained on OEM licensing.

A copy of the category data kept inside the product or network, so lookups never leave it. It gives the lowest latency and is the only option for air-gapped sites.

A UK law from 2023 that puts duties on online platforms and search services to tackle illegal content and protect children, with Ofcom as the regulator. It targets services rather than network filters, but it shapes what schools and parents expect.

Duties are being phased in, so check the current codes.

Blocking more than the policy intends, such as health information caught by an adult rule. School guidance in several countries treats it as a real harm rather than a safe default.

A small script with a function named FindProxyForURL that tells the browser which proxy to use for each address. It can route some destinations through inspection and send others direct.

Features that let parents limit what children can reach, when, and for how long. Most of them rely on category data to sort sites by age suitability.

A registered domain that shows only ads, a placeholder or a for-sale notice. Parked domains carry little value and can switch to a live, sometimes malicious, site overnight.

See the parked and for-sale domains category.

Labelling a specific page or path rather than the whole domain, for example one section of a large platform. It only helps filters that can see the full URL.

Networks where users share files directly with each other instead of through a central server. Policies block P2P sites and trackers for legal, bandwidth and malware reasons.

A fake page or message that tricks people into handing over passwords, payment details or access. Phishing domains live briefly, so speed of categorization matters more here than in almost any other category.

See the phishing category.

A named set of filter rules applied to a group, such as students, staff or guests. Profiles let one console serve very different users on the same network.

A domain's position in a list ordered by how much real users visit it. Data buyers use it to decide how many domains they need, since the busiest sites carry most traffic.

Of all the sites a category labels, the share that truly belong there. Low precision in a blocked category means false positives and frustrated users.

A UK duty on schools and other bodies to have due regard to preventing people from being drawn into terrorism. Schools often show part of it through filtering of extremist content, so check the current guidance.

The category that describes most of a site when it carries several. Reports often group by primary category, while policies may act on any category the site carries.

A transport protocol that carries web traffic over UDP with encryption built in, and the basis of HTTP/3. Many filters block it so that browsers fall back to TCP, where SNI checks and inspection work.

Of all the sites that truly belong in a category, the share the data actually labels. Low recall in a blocked category means harmful sites get through.

A request to review a domain's category because it looks wrong or the site has changed. A short, tracked route for these requests keeps users trusting the filter.

The part of a name that someone actually registered, such as example.co.uk, found by stripping subdomains back to the public suffix. Most category databases key their records on it.

Software that lets someone control a computer from elsewhere, used by IT support and by scammers alike. Many policies block the category and allow only the one tool the organisation actually uses.

Summaries of blocked and allowed traffic by category, group and time. They show whether the policy works and often serve as evidence in school and audit files.

A number that estimates how risky a domain or address is, based on its history and behaviour. It says how dangerous a site might be, not what it is about, so it complements categories rather than replacing them.

The licence term that forbids passing on or publishing the raw data. Licensees use the categories in their own systems or products, but cannot sell the file itself.

A setting on video platforms that hides mature videos and comments. Networks enforce it at DNS or with a request header so users cannot turn it off.

Filtering set up on the home or office router, usually by pointing its DNS at a filtering resolver. It covers every device on that network without installing anything.

A DNS zone format that tells a resolver to rewrite or refuse answers for the names it lists. It is a widely supported way to load a block list into an existing DNS server.

A search engine mode that hides explicit results. Networks force it by pointing the search domains at the engine's safe address, so users cannot switch it off.

Methods per engine are in the safe search enforcement guide.

Running a suspicious file or link in an isolated environment to see what it does. It is slower than a lookup, so filters usually sandbox only files from risky or uncategorized sources.

An architecture that delivers networking and security, web filtering included, from cloud points of presence close to users. It needs one category source that every point of presence reads in the same way.

See URL category data for SASE platforms.

Rules that change with the time of day or the day of the week, such as gaming allowed after school hours. The categories stay the same; only the rule applied to them changes.

A packaged library that app makers embed to add a feature, such as category lookups or parental controls. Shipping category data inside an SDK falls under an OEM licence.

A cloud or on-premise proxy that filters web traffic by category, inspects HTTPS and scans downloads. It is the classic enforcement point for company web policy.

More in what is a secure web gateway.

Categories that describe risk, such as phishing, malware and botnets, as opposed to topics like sport or news. Most policies block security categories everywhere and vary content categories by group.

The security half of SASE, usually a secure web gateway, a CASB and ZTNA delivered from the cloud. Buyers choose it when they want those controls without replacing their network.

AI tools that staff use without approval, often pasting in company data. A category for AI tools lets IT see which ones are in use and set rules per type of tool.

Cloud apps and services that teams adopt without the IT department knowing. Categorized domains in the logs are the quickest way to find them.

A system that gathers logs from across the organisation for search, alerting and investigation. Adding categories to DNS and web logs makes them readable at a glance.

The field in a TLS handshake where the browser names the site it wants, sent in plain text unless ECH is used. Firewalls read it to filter HTTPS by domain without decrypting anything.

A page that cautions the user and lets them carry on after a click, instead of refusing outright. It suits grey-area categories where a hard block would cause too many tickets.

Sending some traffic through the company VPN or security service and the rest straight to the internet. Category data helps decide which destinations are trusted enough to go direct.

Decrypting HTTPS at a gateway, checking the content and encrypting it again, using a certificate the devices trust. It reveals full URLs, but banking, health and pinned apps are usually exempted by category.

Exemption choices are covered in SSL inspection and URL categories.

A name to the left of the registered domain, such as blog in blog.example.com. On shared platforms each subdomain can be a different site and may need its own category.

The full, structured list of categories a database uses, with a definition for each one. A clear taxonomy lets two reviewers put the same site in the same category.

Ours is set out group by group in content filtering categories.

CIPA's name for the technology that blocks or filters internet access to the prohibited visual depictions. In practice it means a web filter with the right categories switched on.

A regularly updated stream of risky domains, URLs or addresses for loading into firewalls, resolvers and security tools. Freshness and false positive rates matter more than sheer size.

Our version is the phishing and malware domain feed.

A network that routes traffic through several volunteer relays to hide where it comes from and where it goes. Policies that block anonymizers usually block Tor's own website and its known entry points too.

A script or pixel that records what a user does across sites. Tracker domains sit in advertising and analytics categories that privacy-minded policies block.

A proxy that intercepts web traffic without any setting on the device, usually from inside the network path. It is easy to roll out but sees little of HTTPS unless it also inspects.

How long a DNS answer may be cached before it is asked for again. Short TTLs on block answers let policy changes take effect quickly.

Registering misspellings of popular domains to catch people who mistype them. The sites usually host ads, phishing or malware, so they belong in risky categories early.

A domain the database holds no category for, often because it is brand new or rarely visited. Every policy needs a clear rule for these, such as allow, warn or block.

Letting through content the policy says should be blocked, usually because the data missed it. Low recall in sensitive categories is the main cause.

The part of a licence that entitles you to ongoing deliveries such as delta files and full refreshes. Without it, a one-time copy ages quickly as sites change hands and content.

Deciding whether to allow a web request by checking its address against a policy, usually by category. It can use the domain alone or, where visible, the full path.

The full picture is in what is URL filtering.

Replacing links in email or documents with links through a checking service, so each click is judged when it happens. It catches links that turned bad after the message was delivered.

A service that turns a long address into a short one that redirects. Shorteners hide the real destination, so filters either expand the link or treat the shortener with care.

A set of domains reviewed by people and used to measure how well the data performs. A sound sample is drawn at random across categories and popularity levels.

Licence holders receive validation reports with the measured accuracy of our CIPA categories.

An encrypted tunnel that carries a device's traffic to another server. Company VPNs are tools, but consumer VPN apps on a filtered network are usually a way around the filter.

Any product or service that applies a web access policy, whether in a firewall, resolver, proxy, browser or device agent. Its decisions are only as good as the data it consults.

The umbrella term for controlling which websites people can reach, whatever the method. DNS filtering and URL filtering are its two most common forms.

How the two compare is set out in DNS filtering vs web filtering.

Selling a product under your own brand while another company builds or runs it. Many MSPs and ISPs offer white-label web filtering to their own customers.

A rule that matches a domain and all of its subdomains, for example *.example.com. It is powerful and risky, since one wildcard on a shared platform can allow far too much.

A protocol that lets devices find their PAC file automatically through DHCP or DNS. It saves setup work but must be locked down, because a fake WPAD answer can redirect traffic.

A security model that trusts no user, device or network by default and checks every request. Web filtering fits in as the rule for which destinations a verified user may reach.

Access to private applications granted per user and per app, replacing broad VPN access. ZTNA products use category data to decide what goes through the tunnel and what goes direct.

See URL category data for ZTNA.