Corporate Web Security: Building Policy on Domain Categories

Classification as the Missing Layer in the Stack

The blacklist era is long over. On any given day the people in your building will touch thousands of distinct domains, most of them harmless, a handful of them not, and none of them announced in advance. What a security stack lacks is rarely enforcement capability; it is knowing what a domain actually is at the moment somebody reaches for it. That is the gap a broad categorization set fills.

Ahead of the Signature

Suspicious new registrations can be shut out within minutes of appearing, well before anything needs writing up as an incident.

Fifty-Nine Ways to Slice It

Adult content, social platforms, file sharing, gambling and dozens more, each typed separately rather than lumped together.

Feeds Your Existing Tools

Categories drop straight into firewalls, secure web gateways, SIEM pipelines and SOAR playbooks you already run.

100M+

Domains Typed

59

Classification Buckets

<10ms

Query Round Trip

24/7

Refresh Cycle

Making the Acceptable Use Policy Actually Enforce Itself

A document nobody reads becomes a rule set that applies itself, decision by decision

Almost every company has an Acceptable Use Policy sitting in a shared drive, setting out what staff may and may not reach on corporate hardware during working hours. Historically it was enforced by periodic audits and a great deal of trust. Hand the same rules to a classification database and enforcement stops being an annual exercise: it happens on every request, identically for everyone, with a record left behind.

Most clauses in a typical AUP translate almost word for word into one of the 59 categories. Social platforms open at lunch and close again afterwards. Gambling, adult material and outright illegal activity stay shut permanently. Streaming gets throttled or fenced off so the bandwidth stays where the business needs it.

Departments differ, and category-based rules follow those differences without extra effort. Engineering lives in developer forums and code hosting that finance has no reason to open. Marketing genuinely needs the social platforms everyone else is blocked from. Role templates built on top of categories deliver that separation, and nobody has to maintain a per-team list of URLs to make it work.

Rules By Job Function

Separate access profiles per department, team or individual, matched to the work

Rules By Clock

Open or close whole categories according to the hour or the working calendar

A Record of Every Call

Every policy decision written down, ready for a compliance review or an HR case

Where the Data Goes, and What IT Never Approved

Find the tools nobody signed off on, and cut the routes sensitive files use to leave

Bringing Unsanctioned Services Into View

Staff sign up for tools that solve today's problem, and nobody files a ticket about it. That habit -- shadow IT -- is one of the widest security gaps going, and it opens fastest in organisations where succession planning gaps have thinned out IT oversight. Estimates put the number of cloud services actually in use at five to ten times what the IT department believes. Running observed traffic through categorization is how that gap becomes visible.

Personal Cloud Storage Spot traffic to private Dropbox, Google Drive, WeTransfer and other file-sharing destinations never approved by IT

Off-Portfolio SaaS Catch registrations and logins to project trackers, CRMs and chat tools that sit outside the sanctioned portfolio

Webmail on Corporate Devices Keep an eye on personal mail providers, one of the oldest and simplest exfiltration routes there is

Generative AI Services See which chatbots and generative AI tools staff are pasting material into, and how often

Watching the Destination Instead of the Payload

Endpoint agents only see part of the picture. Knowing the category of every destination a workstation talks to gives security teams the other part, live rather than in hindsight. Someone in finance who starts pushing documents to a file-sharing host that is not on the approved list is an obvious signal, and the DLP system can raise an alert, cut the connection or quarantine the upload on that basis alone.

File sharing, paste sites, personal mail, cloud storage, encrypted messaging: those labels supply context that classic pattern-matching DLP simply does not have. Instead of tearing apart every packet looking for sensitive strings, category-driven DLP concentrates attention on the handful of destination types that unauthorised transfers actually use. Coverage stays broad while the false positive rate falls sharply. Additional metadata such as technology stack age sharpens the picture further by hinting at how mature the receiving infrastructure is.

Pushing Categories Into SIEM, SOAR and the Network Edge

The classification set is most useful inside the tooling your SOC already lives in

1

Enriching the Log Pipeline

Firewall, proxy and DNS logs arrive as a wall of hostnames with no meaning attached. Resolving each one against the API as it lands turns that wall into something you can write rules against, such as "raise an alert whenever a host on the finance VLAN reaches a file-sharing or paste-site domain outside working hours." The telemetry was always there; the category is what makes it worth correlating.

2

Category-Aware Playbooks

A reported email containing restricted content usually kicks off half an hour of manual work. A playbook that knows about categories does the same job in seconds: pull every URL out of the message, classify each one, then act on the result by blocking the domain at the firewall, sweeping the endpoints that already touched it, warning the recipients and opening a SOC ticket. No analyst has to be awake for any of it.

3

Perimeter Enforcement Feeds

Palo Alto, Fortinet, Check Point and the other next-generation firewall vendors all accept an external dynamic list or content classification feed, and category data drops into those mechanisms directly. Rules then execute right at the boundary, so connections toward unsafe content and command-and-control infrastructure are refused before any internal system is involved.

4

A Second Opinion for Your Gateway

Running Zscaler, Netskope or McAfee Web Gateway does not preclude a supplementary classification source, and there are good reasons to have one. It disagrees occasionally, which is useful; it typically types brand-new registrations sooner; and it tends to cover regional and niche domains that the large global vendors deprioritise.

Straightforward REST Lookups

A plain REST call returns a domain's category in under 50ms. Where volume is the constraint, batch requests take up to 100 domains at a time. Each JSON response carries the primary category, the classification detail behind it and the content risk indicators.

On-Premise Copy

Where every millisecond counts, hold the full 90-million-domain set on your own hardware and take hourly delta feeds to keep it current. There is no external dependency in the request path, and filtering carries on unaffected if the internet link drops.

Syslog and CEF Export

Decisions can be emitted as Syslog or Common Event Format records that any SIEM will accept without a custom parser. TCP, UDP and TLS transports are all available for delivery into Splunk, QRadar, Sentinel or Elastic.

Three Ways to Deploy It

Topology, authentication and what happens when a component fails: those three questions decide how a rollout goes, and they have different answers in different organisations. Rather than force one architecture, the database supports several, and most environments find one that fits without compromise.

Inline Proxy Mode: Everything HTTP and HTTPS routes through a forward proxy running the filtering engine. Each request is typed as it arrives and the policy verdict lands before the connection is ever opened. Control is as tight as it gets, at the cost of configuring proxies on endpoints or redirecting traffic at the network layer.

DNS-Based Filtering: Point corporate resolvers at filtering-aware ones that consult the category before handing back an address, answering NXDOMAIN or a redirect where policy says no. Nothing gets installed on endpoints, and because it acts at the name-resolution layer it applies to every protocol rather than only web traffic.

API-Driven Enrichment: Leave the network exactly as it is and let the equipment already in place call out for context. Firewalls, proxies and SIEM platforms query the endpoint to sharpen decisions they were making anyway. It is the least invasive of the three and usually the fastest to pilot.

What This Looks Like By Sector

Four industries, four quite different reasons for wanting domain categories

Banking and Investment

On a trading floor the concern is less about productivity than about regulation. Categories are used to keep unauthorised trading venues out of reach, close off cryptocurrency exchanges on floor networks entirely, and produce the electronic communications and data handling controls that SEC and FINRA examiners expect to see documented.

Hospitals and Clinical Networks

HIPAA obligations translate into fairly blunt rules at the network layer: personal cloud storage closed, social platforms restricted on clinical workstations, and anything likely to carry ransomware kept away from machines that hold protected health information. Ransomware in a hospital is not an IT incident, it is a clinical one.

Industrial and Critical Infrastructure

Plant networks use categories to hold the line between OT and IT, restricting control systems to a short list of approved vendor destinations. Because that list should never grow on its own, an attempted connection to anything uncategorised or suspicious is treated as an alert rather than an anomaly to review later.

Schools and Districts

Education is one of the most heavily targeted sectors there is, and a district carries every security problem a company does plus a legal duty of care toward children. That is why districts run internet filtering built for schools, which layers age-appropriate content rules on top of ordinary threat blocking.

Wiring the API Into a Security Stack

A working policy check is a few dozen lines in whichever language your tooling speaks

Turning a Category Into a Verdict

Look up the domain, compare it against the categories your policy forbids, then block, permit or send it for review.

import requests

API_URL = "https://webfilteringservice.com/api/moderate.php"
API_KEY = "YOUR_API_KEY"

# Category list drawn from the corporate AUP
BLOCKED_CATEGORIES = {
    "Adult Content", "Gambling", "Weapons",
    "Drugs", "Malware", "Phishing"
}

def enforce_policy(domain):
    result = requests.post(API_URL, json={
        "api_key": API_KEY,
        "query": domain
    }).json()

    categories = set(result.get("categories", []))
    risk_level = result.get("risk_level", "low")

    # Risk level alone is enough to refuse
    if risk_level in ("high", "critical"):
        return "BLOCK", f"High risk: {risk_level}"

    # Otherwise compare against the forbidden set
    violations = categories & BLOCKED_CATEGORIES
    if violations:
        return "BLOCK", f"Policy violation: {', '.join(violations)}"

    return "ALLOW", result.get("primary_category", "Uncategorized")

# Sample run against a few observed domains
domains_to_check = ["slack.com", "poker-site.xyz", "drive.google.com"]
for domain in domains_to_check:
    action, reason = enforce_policy(domain)
    print(f"{action}: {domain} — {reason}")

const API_URL = 'https://webfilteringservice.com/api/moderate.php';
const API_KEY = 'YOUR_API_KEY';

const BLOCKED_CATEGORIES = new Set([
    'Adult Content', 'Gambling', 'Weapons',
    'Drugs', 'Malware', 'Phishing'
]);

async function enforcePolicy(domain) {
    const response = await fetch(API_URL, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ api_key: API_KEY, query: domain })
    });
    const result = await response.json();

    // Risk level alone is enough to refuse
    if (['high', 'critical'].includes(result.risk_level)) {
        return { action: 'BLOCK', reason: `Risk: ${result.risk_level}` };
    }

    // Otherwise compare against the forbidden set
    const violations = (result.categories || [])
        .filter(c => BLOCKED_CATEGORIES.has(c));
    if (violations.length) {
        return { action: 'BLOCK', reason: violations.join(', ') };
    }

    return { action: 'ALLOW', reason: result.primary_category };
}

// Sample run against a few observed domains
['slack.com', 'poker-site.xyz', 'drive.google.com']
    .forEach(async (d) => {
        const { action, reason } = await enforcePolicy(d);
        console.log(`${action}: ${d} — ${reason}`);
    });

# Type a domain before applying policy
curl -X POST "https://webfilteringservice.com/api/moderate.php" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "query": "slack.com"
  }'

# Returns:
# {
#   "domain": "slack.com",
#   "primary_category": "Business",
#   "categories": ["Business", "Technology", "Messaging"],
#   "risk_level": "low",
#   "risk_score": 5
# }

# Now something that should fail the check
curl -X POST "https://webfilteringservice.com/api/moderate.php" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "query": "poker-site.xyz"
  }'

<?php
// Corporate policy check
$apiUrl = 'https://webfilteringservice.com/api/moderate.php';
$apiKey = 'YOUR_API_KEY';

$blockedCategories = ['Adult Content', 'Gambling', 'Weapons', 'Drugs', 'Malware'];

function enforcePolicy($domain, $apiUrl, $apiKey, $blocked) {
    $ch = curl_init($apiUrl);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
        'api_key' => $apiKey,
        'query'   => $domain
    ]));
    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $result = json_decode(curl_exec($ch), true);
    curl_close($ch);

    // Risk level first
    if (in_array($result['risk_level'], ['high', 'critical'])) {
        return ['BLOCK', 'High risk: ' . $result['risk_level']];
    }

    // Then the forbidden category list
    $violations = array_intersect($result['categories'] ?? [], $blocked);
    if (!empty($violations)) {
        return ['BLOCK', implode(', ', $violations)];
    }

    return ['ALLOW', $result['primary_category'] ?? 'Uncategorized'];
}

// Sample run against a few observed domains
$domains = ['slack.com', 'poker-site.xyz', 'drive.google.com'];
foreach ($domains as $d) {
    [$action, $reason] = enforcePolicy($d, $apiUrl, $apiKey, $blockedCategories);
    echo "$action: $d — $reason\n";
}
?>

Start With the Classification Layer

100 million categorized domains and 59 content categories, ready to sit underneath whatever policy and tooling you already have.

Look Up a Domain View Plans Get the Sample CSV

Web Security at Corporate Scale