The email looked like the courier company. The link looked like the login page. The only thing that saved the office was a block page. This guide sets up that block page — web filtering and threat protection that work even on the user's busiest, least careful day.
Phishing is not mainly a technology failure; it is a timing success. The fake page arrives at 6:40 pm, the user is tired, and the login box looks right. Browser-level protection exists for that exact moment. Three layers work together in Browser Security Plus: enforced safe browsing (the browser's built-in bad-site warnings, locked on so they cannot be disabled), web filtering (categories of sites blocked outright by policy), and web isolation (untrusted sites opened in a sandboxed window so nothing they carry touches the real machine). Set up with a little restraint, staff see a block page a few times a month — and each one is a small, cheap victory. Set up carelessly, the filter blocks the bank and gets switched off by Diwali. This guide is the restrained version.
Chrome's Safe Browsing and Edge's SmartScreen already know millions of bad URLs, and they update constantly. Their weakness is social, not technical: a user who has clicked "proceed anyway" five times, or turned the feature off after a false alarm, has no shield left. Threat protection policy enforces the setting — enhanced protection on, non-negotiable, on every managed browser. This is the cheapest layer to deploy and the first one to verify: pick a sample PC, open the browser's policy page (chrome://policy or edge://policy), and confirm the value is set by policy, not by preference.
Web filtering blocks whole categories: malware and phishing sources, gambling, adult content, file-sharing and anonymous proxies are the usual office list. The restraint matters more than the list. Every false block costs the policy credibility, and a blocked business site — a new supplier, a government portal on a fresh domain — costs real work. Start with the dangerous categories only, run a month, read the block log, and add categories your office actually argues about, in a meeting, not in a panic after one incident. Keep a one-form exception request, answered the same day, so staff never need a workaround.
Some sites are neither clearly good nor clearly bad: the vendor portal nobody has used before, the link in a genuine-looking email from a new client. Web isolation opens such sites inside a sandbox — the page renders and works, but its scripts and downloads run in a disposable environment, not on the PC. Where your edition of Browser Security Plus includes isolation, aim it at the grey zone: uncategorised and newly registered domains. It is the honest middle answer between "block everything unknown" (unworkable) and "trust everything clickable" (how incidents happen).
The report nobody reads is the most valuable one. A single block is a user saved; a pattern of blocks is a campaign against your office — same fake brand, same week, several staff targeted. That pattern should trigger three things: a warning message to all staff naming the fake email, a check that nobody entered credentials before the block era (password resets if unsure), and a note to your email filtering, which let the messages through. File the monthly summary; when management asks what the security spend does, three prevented credential thefts is a better answer than any brochure.
Every block list in the world learns about a new phishing site after its first victims. For the first hours of a fresh campaign, the only defences are the browser's built-in heuristics, isolation for unknown domains, and a user who pauses. So the last part of this setup is not in the console at all: teach the two-minute habit — hover before you click, and any page asking for a password after an email link gets closed, and opened again by typing the address yourself. The block page handles the known bad; the habit handles the new bad; neither is asked to do the other's job.
Filtering categories, isolation and the block-report — follow the video to see each one configured live.
▶️ Watch Full VideoSometimes, yes — new domains and unusual categories are the usual false positives. That is why the setup starts with only the dangerous categories, why the exception request must be answered the same day, and why the block log is reviewed monthly. A filter with a fast, human exception route keeps its credibility; one without it gets disabled.
The untrusted website opens inside a sealed box. Staff can see and use the page, but anything harmful in it runs inside the box and is thrown away with it, instead of running on the real computer. It is for the grey zone — sites that are not known-bad, but not known-good either.
Yes, both. Email security reduces how many phishing messages arrive; this browser layer catches the ones that get through at the moment of the click; training covers the first hours of a brand-new campaign that no list knows yet. Each layer exists because the others have a gap, and the gaps are exactly where incidents live.