What is a secure web gateway?
A secure web gateway, or SWG, is a security proxy between users and the internet. It inspects web requests, checks each URL against categories and threat data, and allows, blocks, warns or isolates according to policy.
This page explains what a secure web gateway does, how traffic reaches it, how it uses URL categories, and how it fits next to firewalls and DNS filtering.
A secure web gateway in plain words
Think of an SWG as a checkpoint for web traffic. Every request to a website passes through it. The gateway knows who is asking, what the destination is, and often what is being sent or downloaded.
A plain web proxy just forwards and caches pages. A secure web gateway adds a decision engine: URL categorization, malware scanning, application controls, data loss rules and detailed logs. That is what makes it a security product rather than a network utility.
The gateway can sit in your own data centre, inside a firewall, or in a provider's cloud. Where it runs changes cost and reach, but the core job stays the same: see the web request, decide, and record the decision.
Definition: a secure web gateway is a proxy-based control that enforces security and acceptable use policy on web and cloud application traffic, using URL categories, threat intelligence and content inspection, for users in the office and on the road.
Core functions of a secure web gateway
Products differ in depth, but nearly every SWG offers the same eight building blocks. URL filtering is usually the first one switched on and the one users notice most.
URL filtering
Allow or block by category, using a database of categorized domains and URLs. See what is URL filtering.
TLS inspection
Decrypting HTTPS so the gateway can see full URLs and content, with exemptions for sensitive categories.
Malware defence
Scanning downloads and scripts, and blocking known malicious and phishing destinations.
App control
Recognising web apps and limiting actions, such as allowing viewing but blocking uploads or posting.
Data loss rules
Stopping sensitive files or text leaving through web forms, cloud storage and AI chat tools.
Identity-aware policy
Applying rules per user and group from the directory, not just per network address.
Isolation
Rendering risky or uncategorized sites remotely so active code never reaches the device.
Logging and reports
Full URL logs for investigations, usage reports for managers and evidence for audits.
How traffic reaches the gateway
A gateway only protects the traffic that passes through it. These are the four common ways to steer web traffic, and many deployments combine two.
Explicit proxy
Browsers are configured, often through a PAC file, to send web requests to the gateway address.
Good: precise control, easy user identification. Weak: apps that ignore proxy settings slip past.
Transparent proxy
A firewall or router redirects web ports to the gateway without device settings.
Good: covers unmanaged devices. Weak: user identity is harder, and HTTPS needs careful handling.
Endpoint agent
Software on laptops forwards web traffic to a cloud gateway from any network.
Good: protects remote staff the same as office staff. Weak: agents must be deployed and kept healthy.
Branch tunnel
Branch routers send internet traffic through an encrypted tunnel to the cloud gateway.
Good: no settings on individual devices. Weak: tunnel capacity and location affect speed.
PAC files and the related WPAD discovery protocol are covered with other formats in our blocklist and policy formats guide, which also lists the exports licensed customers can use.
What happens to one request inside an SWG
Here is the order of checks a typical gateway runs when a user opens a link. The URL category lookup sits early, because its answer decides how much further work is needed.
- 1. Identify
Match the session to a user and group through the agent, directory or login.
- 2. Categorize
Look up the hostname, and the path if visible, in the URL category database.
- 3. Decide on decryption
Skip TLS inspection for exempt categories such as Online Banking and Health & Medicine.
- 4. Apply policy
Allow, block, warn, isolate or inspect according to category and group.
- 5. Inspect content
Scan downloads, check uploads against data rules, enforce app actions.
- 6. Log
Record user, URL, category, action and bytes for reporting.
The five actions most gateways support
Warn and isolate are the actions that make a gateway feel fair to users. Uncategorized or newly registered sites can be opened in isolation instead of blocked, which keeps work moving while risk stays low. Our guide on blocking newly registered domains discusses that trade-off.
Secure web gateway vs firewall vs DNS filter
These three controls overlap, which is why buyers often ask whether they need all of them. The short answer is that each sees a different slice of the traffic.
| Question | DNS filter | Network firewall | Secure web gateway |
|---|---|---|---|
| What does it see? | Domain names in lookups | Addresses, ports, protocols, often hostnames and apps | Full web sessions, URLs, files and actions |
| Granularity of web rules | Whole domain | Domain or app, URL if decrypting | Path, file type, app action, user |
| HTTPS content visible? | No | Only with decryption enabled | Yes, where inspection is allowed |
| Non-web traffic | Any app that uses DNS | All protocols | Mostly web and web-like traffic |
| Remote users | Agent or encrypted DNS profile | Through VPN back to the site | Agent or cloud tunnel |
| Cost and effort | Low | Medium to high | Medium to high |
| Category data needed | Domain categories | Domain and URL categories | Domain and URL categories |
The DNS filtering vs web filtering guide looks at the first two columns in more depth. For DNS basics see what is DNS filtering.
Choose DNS filtering first when
- You need fast, broad protection for every device
- Many devices cannot run agents or use proxies
- Budget and staff time are limited
- Whole-site blocking is enough for your policy
Add a secure web gateway when
- You must allow a site but block some of its pages or uploads
- Downloads need malware scanning in line
- Data loss rules must cover web forms and AI chat tools
- Audits require full URL logs per user
HTTPS inspection: the gateway's hardest job
Most web traffic is encrypted. Without decryption, a gateway sees the hostname but not the path, the page or the file. With decryption, it sees everything, which brings privacy and compatibility duties.
What decryption adds
- Rules on specific paths and file types
- Malware scanning of encrypted downloads
- Data loss checks on uploads and form posts
- App action control, such as blocking posting
What it demands
- A trusted root certificate on managed devices
- Bypass lists for apps that pin certificates
- Category-based exemptions for banking and health sites
- Clear notice to users and legal review where needed
We cover this topic in detail, including which categories teams usually exempt, in SSL inspection and URL categories.
Deployment models: appliance, cloud or hybrid
| Model | Where the proxy runs | Strengths | Points to plan |
|---|---|---|---|
| On-premise appliance | Hardware or virtual machine in your data centre | Full data control, works in closed networks, predictable latency on site | Remote users must come back through VPN, capacity is yours to size |
| Cloud SWG | Provider points of presence | Same policy everywhere, no hardware, fast to add branches | Traffic leaves your network for inspection, check where logs are stored |
| Hybrid | Appliance for head office, cloud for roaming and branches | Keeps sensitive sites local while covering mobile users | Two policy engines must stay in sync |
| Embedded in a platform | Part of a firewall, router or security suite | One box, one console, fewer moving parts | Depth of SWG features varies widely |
Cloud gateways are often sold as part of wider security service edge or SASE bundles, which add zero trust access and cloud app controls. The URL category layer works the same way in all of them.
How to choose between them
Start with where your users are. If most work happens away from the office, a cloud or hybrid gateway avoids sending traffic back through head office. If networks are closed or data must stay in the country, an appliance with locally held category data is the safer fit.
Then look at who will run it. An MSP-run cloud gateway suits teams without security staff, while an in-house appliance suits teams that already manage firewalls and want full control of updates.
For product teams: the URL category engine inside an SWG
If you build a gateway, firewall or security service edge product, the URL category database is a component you either build, license or both. It has to be fast, local and current.
Local lookups
Data delivered as CSV, Parquet or JSON files that load into your own engine, so no lookup leaves the gateway.
Coverage
120 million categorized domains, with the 20 million most visited covering 99.99% of web traffic and usage.
Freshness
About 300,000 newly registered domains categorized daily as delta files, the rest refreshed monthly.
Ranked labels
Several categories per domain, ordered by how much of the site each describes.
Two taxonomies
59 web filtering categories plus the IAB Content Taxonomy in one file. See the taxonomy.
AI tools
16,000+ AI-tool domains in 18 categories, updated daily, for AI governance features.
Lookup API
Included with licences, for long-tail misses and support tooling. See the API page.
OEM terms
Embedded and group-wide licences for vendors. Read OEM licensing.
Design tips from gateway builders
Keep the category lookup in memory with a hostname cache in front of it. Fall back from full hostname to registered domain when a subdomain is unknown. Treat uncategorized as its own policy outcome, usually isolate or warn, instead of silently allowing it.
Map the database categories to your product's own policy labels once, in a table you control. That way updates to the data never change how customer policies behave.
Example SWG policies by category
Real policies are short. Most organizations need fewer than fifteen category rules, plus a handful of exceptions. These examples show the shape, and you can adapt them group by group.
| Category | Typical action | Why |
|---|---|---|
| Malware / Phishing / Suspicious | Block for all | No business reason to reach them |
| Uncategorized and newly registered | Isolate or warn | High risk, but some are legitimate new services |
| AI / LLM Tools | Allow approved, block uploads to the rest | Data loss risk through prompts and file uploads |
| Cloud Storage / File Hosting | Allow downloads, block uploads to unapproved services | Stops data leaving through personal storage |
| Online Banking, Health & Medicine | Allow without decryption | Privacy and legal sensitivity |
| Social Networking | Allow read, block posting for some groups | Brand and confidentiality protection |
| Adult, Gambling, Hate/Discrimination | Block | Acceptable use and workplace conduct |
| VPN / Proxy / Anonymizers | Block | Prevents the gateway being bypassed |
Who uses a secure web gateway
Gateways started in large enterprises, but cloud delivery has made them common in much smaller organizations. Each group leans on different functions.
Enterprises
Full inspection, data loss rules for AI tools and cloud storage, and detailed logs for security operations.
Key need: identity-aware policy across many offices and remote staff.
Schools and universities
Category filtering for students, safe search enforcement, and separate rules for staff and research networks.
Key need: student-safe categories and clear audit trails. See higher education web filtering.
MSPs
A multi-tenant cloud gateway sold as a managed service, often bundled with endpoint and email security.
Key need: per-client policy and reporting from one console.
Public sector and regulated firms
On-premise or hybrid gateways where data must stay inside national or company networks.
Key need: category data that runs locally, with no outside lookups.
Three myths about secure web gateways
"HTTPS makes them useless"
Without decryption a gateway still sees the hostname and can filter by category. Decryption adds depth, it is not the only value.
"Only big companies need one"
Cloud gateways sold through MSPs bring the same controls to offices of ten people, priced per user.
"Cloud apps are out of scope"
Most cloud apps run over the web, so the gateway is often the best place to control uploads and logins to them.
"Block everything risky"
Overblocking drives users to personal phones and hotspots. Warn and isolate keep visibility while reducing friction.
Performance, sizing and user experience
A gateway that slows browsing gets bypassed or switched off. Plan capacity and user experience from the start, not after the first complaints.
What drives load
- Share of traffic that is decrypted and scanned
- Peak concurrent sessions, not just daily volume
- Large file downloads and video streams
- Distance between users and the nearest gateway
- Number of policy rules evaluated per request
What keeps users happy
- Clear block pages with the category name and a request link
- Warn instead of block for grey areas
- Fast category lookups held in memory
- Bypass for video calls and other latency-sensitive apps
- Quick handling of wrong-category reports
An evaluation checklist
| Area | What to test |
|---|---|
| Category accuracy | Run your own list of known sites per category and count wrong or missing labels |
| New domain handling | Check how quickly recently registered domains get a category and what the gateway does before that |
| Bypass resistance | Try anonymizer sites, encrypted DNS and unmanaged browsers from a test device |
| Decryption exemptions | Confirm banking and health sites pass without inspection when policy says so |
| Reporting | Ask a manager to answer a real question from the reports without help |
| Data location | Find out where logs are stored and who at the provider can read them |
Frequently asked questions
What is a secure web gateway?
A proxy between users and the internet that applies security and acceptable use policy to web traffic: URL category filtering, HTTPS inspection, download scanning, app and data controls.
What is the difference between a secure web gateway and a firewall?
A firewall governs network connections by address, port and protocol. An SWG is built around web sessions, full URLs and content, with detailed per-user web policy.
Is a secure web gateway the same as a web proxy?
It is a web proxy with security added: categorization, threat protection, file inspection, data rules and reporting.
Do I need an SWG if I already have DNS filtering?
DNS filtering blocks whole domains. An SWG adds path rules, inspection and app controls. Many teams run both on the same category data.
What is a cloud secure web gateway?
An SWG hosted in a provider's data centres, reached through agents, tunnels or PAC files, so policy follows users everywhere.
How does a secure web gateway categorize URLs?
It looks up the hostname, and the path where visible, in a URL category database, usually held locally with a cache.
Can we license your data for our gateway?
Yes, for internal use or embedded in a product. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Building or running a secure web gateway?
Give your URL filtering engine 120 million categorized domains, 59 categories and daily new-domain updates that run inside your own systems.