🎥 Watch the full setup in the video — Web Filter categories, Pass Site and reports, step-by-step
Most confusion about website blocking comes from one missing fact: on an HTTPS connection, the domain is visible and everything after it is sealed. Every strength and every limit of the Untangle Web Filter in this video follows from that single sentence.
What the Web Filter sees on an HTTPS visit
User opens: https://videos.example.com/watch?v=abc123
Filter sees: domain videos.example.com visible
category Streaming Media visible
Filter misses: the page /watch?v=abc123 encrypted
the video, the search text encrypted
Illustration — the firewall judges the domain; the page itself travels encrypted.
1
The Domain Is Visible, the Page Is Not
Nearly every site today is HTTPS, and the honest truth of gateway filtering is this: the filter can see which domain a user connects to — from the connection itself and the name lookup — but the actual page, video, search term and message travel encrypted past it. Category blocking works because it only ever needed the domain.
2
So Blocking Is All-or-Nothing per Site
Domain-level vision means domain-level decisions:
You can block a whole video site, but not one channel or one video on an allowed site
You can allow a whole news site, but not only its business section
Anyone who promises page-level control without deeper inspection is selling something the traffic does not contain
3
SSL Inspection Exists — and It Is a Serious Decision
Firewalls can optionally decrypt traffic (SSL inspection) to see full addresses and content. It requires installing the firewall's certificate on every device, it breaks some apps and encrypted services, and it means the company can technically read banking and personal mail content on office machines. That is a legal, HR and trust decision, not a settings tweak — most small offices honestly look at what it involves and decide category-level filtering is enough.
4
What the Filter Still Cannot Judge
Even with perfect domain control, a gateway filter cannot tell why someone opened an allowed site, or what they did inside it. It is a boundary tool: it keeps whole neighbourhoods out. Conduct inside allowed sites is a management and acceptable-use matter, and no filter setting will change that.
🔴 For employees reading this: category filtering on the office network does log which domains were requested and blocked — the Block Event report is built from exactly that. It does not read the content of your HTTPS pages. Both halves of that sentence are true.
🎥 See It Done Live in the Video
The complete Web Filter setup on the HR policy — blocking categories, passing a site and reading the block report — is shown on screen in the full video.
Can the filter see my passwords or messages on HTTPS sites?
No. With ordinary category filtering, the content of HTTPS pages — passwords, messages, forms — stays encrypted between the device and the website. The filter records the domain and the block decision, not the page content.
Why can it block a site but not a single page on that site?
Because the page address travels inside the encrypted part of the connection. The filter's decision point is the domain; everything finer than that requires SSL inspection, which is a separate, much heavier setup.
Does HTTPS stop category blocking from working?
No — categories are a property of the domain, and the domain is exactly what remains visible. HTTPS limits how fine-grained the control can be, not whether it works.
This guide is based on the Technical Anshu video linked above • Stuck on a step? Ask in the video comments — that is where answers come from 🙏