Blocking social media for the whole company sounds tidy — until HR cannot reach the job portals they are paid to use. Policies exist so each department gets its own rules.
The most common website-blocking mistake is not technical, it is one rule for everybody. The Policy Manager setup behind this video exists precisely to avoid it: users are grouped into policies, and the Web Filter in each policy blocks different categories. This page shows how to think about those groups.
The setup this video builds on has three policies in the Policy Manager, and each policy carries its own Web Filter. That is the real power of the gateway layer: you are not writing one rule for the whole company, you are writing a rulebook per group — and a user simply falls under the policy they were added to.
The video's example is the classic one. HR's work is finding people: job portals, career pages and professional networks. Block the Social Media category blindly and you block the very sites recruiters are paid to use — professional networks sit inside that category. The fix is not to unblock the category; it is to design the policy around the job, then forgive the specific work sites with the Pass Site list.
A policy that survives contact with real work follows three rules:
Apply the new policy to one volunteer machine first and let it run for a day. The Block Event report then shows you exactly what your category choices caught — including the work site you forgot — before forty people discover it at 9 a.m. on a Monday.
The complete Web Filter setup on the HR policy — blocking categories, passing a site and reading the block report — is shown on screen in the full video.
▶️ Watch Full VideoIn the Policy Manager setup (covered in the earlier setup this video builds on), users and devices are added to a policy by name, IP address or login. Anyone not matched falls into the default policy — which is why the default should be your strictest sensible rulebook, not your loosest.
Pass the specific domain. Add the professional network's domain to the HR policy's Pass Site list: that one site opens for HR only, and the rest of the Social Media category stays blocked for everyone, including HR.
As few as honestly describe your office — typically a staff policy, a stricter guest policy, and special cases like HR or a server policy. Every extra policy is another rulebook someone must maintain and audit.