The filter blocked a site your team genuinely needs. Do not unblock the category and do not guess — the report already knows what happened.
Every category filter eventually blocks something legitimate. The video's troubleshooting flow is the professional way to handle it: Block Event report first, Site Lookup second, Pass Site last — an exception measured in one domain, not a category surrendered in a panic.
The complaint arrives as 'your filter broke my work'. The Block Event report turns it into facts: the exact domain, the category that stopped it, the policy and the time. Half of all 'wrongly blocked' stories end right here — the site was blocked exactly as designed, and the conversation becomes about policy, not about a broken filter.
Run the domain through Site Lookup. Two different problems hide behind the same complaint: the category is correct and the policy is doing its job (a training site that really is filed under Streaming), or the category is wrong and the database mislabelled a work tool. The remedy is the same, but knowing which one you have tells you whether to expect more surprises from that category.
The Pass Site list is the surgical fix the video demonstrates: the exact domain is allowed even though its category stays blocked. Keep the exception narrow — pass it only on the policy that needs it, and pass the domain, not the whole category.
Every pass entry is a small hole in a category you chose to block. Keep a simple note — site, reason, date, who asked. When the list is reviewed (and it should be, a few times a year), exceptions nobody can explain get removed. An unaudited pass list quietly becomes the real policy.
The complete Web Filter setup on the HR policy — blocking categories, passing a site and reading the block report — is shown on screen in the full video.
▶️ Watch Full VideoIt is a good start — the block page names the site and usually the category. Confirm in the Block Event report anyway: it shows the exact domain (sites often load helper domains), the policy that fired, and every retry.
Just the policy that needs it. Passing a domain on every policy widens the exception far beyond the person who asked, and quietly changes rules for departments that never had the problem.
Many sites load content from other domains — video CDNs, login providers, payment pages. The report shows each blocked helper domain as its own event; pass the ones that are genuinely part of the same service.