Premium IT support provider in Norwich, Norfolk

A member of staff clicks a convincing delivery notification, a job advert or a search result that looks genuine. Within seconds, they may be on a phishing page or a site carrying unwanted downloads. To configure web filtering well, you need more than a long list of blocked websites. You need rules that reduce risk without stopping people from doing their jobs.

For small and medium-sized businesses, web filtering is one of the most practical layers of cyber security. It can help prevent access to malicious websites, inappropriate content and known phishing domains before a problem reaches a device, mailbox or business network. The right setup also supports productivity by limiting obvious time-wasting categories while allowing legitimate work to continue.

Start with the risks your business actually faces

Web filtering is most effective when it reflects how your team works. A construction business with mobile engineers, a school, a professional office and a retail business will not need the same policy. Before choosing categories to block, consider the devices in use, where staff work and which online services are essential.

Start by identifying the activity you must protect. This usually includes access to banking and accounting platforms, Microsoft 365, cloud storage, supplier portals, video conferencing and industry-specific systems. These services should be tested before any filtering policy is rolled out across the business.

Then look at the threats most likely to affect your organisation. Phishing, credential theft, malware downloads and fake invoice scams are common across every sector. A web filter will not replace staff awareness training, multi-factor authentication or endpoint protection, but it can stop many unsafe connections at an early stage.

There is also a commercial question. If your internet connection is shared by a busy office, unrestricted streaming, gaming, file-sharing and social media can affect available bandwidth. Blocking every non-work site may create frustration and workarounds, but sensible limits can keep the connection available for business-critical tasks.

Choose where web filtering will be applied

The location of your filtering matters. A filter applied only through an office firewall protects devices connected to that office network. It may not protect a laptop used from home, on public Wi-Fi or through a mobile hotspot. For businesses with hybrid staff, cloud-managed filtering or an endpoint-based solution is often the better fit.

Network-level filtering is a practical option for a single office, shop or warehouse. It can cover all devices using the connection, including guest Wi-Fi, meeting room equipment and devices that are not centrally managed. It is also useful where you need different rules for staff, visitors and business systems.

Device-level filtering follows the user or device wherever it is connected. This gives more consistent protection for remote workers and company laptops, although it needs proper installation, management and monitoring. It can be particularly valuable when employees regularly travel between customer sites, home and the office.

Many businesses benefit from a combination of both. The office network receives a baseline policy, while managed laptops retain protection away from site. The best approach depends on your budget, staff mobility and how much control you need over devices.

How to configure web filtering policies

Begin with a sensible default policy rather than trying to create a perfect rule set on day one. Block categories that present a clear security, legal or productivity concern, then review the results. Most filtering platforms group sites into categories, which makes policy management far easier than blocking individual URLs one by one.

For a typical business environment, categories commonly blocked include malware, phishing, command-and-control sites, anonymisers and proxy avoidance tools, illegal content, adult content, gambling, file-sharing and newly registered or suspicious domains. Blocking these categories gives a useful security baseline without requiring a large administration effort.

Be careful with broad category blocks. Social media may be essential for marketing and customer service. Streaming platforms might be needed by a training department. Cloud storage can be central to collaboration, but uncontrolled personal storage services may introduce data protection concerns. The aim is to create a policy that matches a user’s role, not one that treats every member of staff identically.

Where possible, create separate groups for administrators, general office staff, marketing teams, guest Wi-Fi and devices used by younger people. A guest network should be isolated from business systems and have its own straightforward filtering policy. This protects the main network while providing visitors with appropriate access.

Use allow lists carefully

Allow lists are necessary when a legitimate site is incorrectly categorised or a supplier uses an unusual online platform. However, they should be the exception, not the main method of configuration. Large allow lists become difficult to maintain and can accidentally bypass wider protection.

Record why each exception was added, who approved it and when it should be reviewed. If an employee needs temporary access for a project, set an expiry date where the platform allows it. This keeps the policy tidy and reduces the chance that old exceptions create a long-term gap.

Do not rely on block pages alone

A clear block page can help staff understand why access has been restricted, but it is not a security awareness programme. Use plain language that explains the category or policy reason and gives staff a route to request access if they believe a site is needed for work.

This reduces unnecessary frustration. It also provides useful feedback: repeated access requests may reveal that a category is too broad, a business process has changed or staff need a safer approved tool for the task.

Test before enforcing every rule

A filtering policy that blocks a key supplier portal at 9am on a Monday will quickly lose support. Test in stages. Start with a small group of users or a monitor-only mode if your system provides one, then review which websites would have been blocked.

Check the services your business relies on, including email links, online banking, cloud applications, remote support tools and supplier systems. Remember that some legitimate sites use third-party content delivery, payment or identity services. A block can affect an application in ways that are not immediately obvious.

Testing should also include different devices and browsers. A policy may behave differently on a managed Windows laptop, an Apple device, a mobile phone and a device connected to guest Wi-Fi. If staff work remotely, test from outside the office as well as on the business network.

When you move to enforcement, tell staff what is changing and why. Position filtering as a measure that protects the business, its customers and their accounts, rather than as an attempt to monitor every click. Clear communication normally results in better cooperation and fewer attempts to bypass controls.

Monitor reports and review the policy

Web filtering is not a set-and-forget service. Cyber criminals register new domains, staff change roles and businesses adopt new cloud tools. Reviewing reports helps you spot patterns, such as repeated phishing attempts, devices trying to reach malware sites or an unexpected increase in blocked traffic.

Focus on useful information rather than collecting data for its own sake. Security alerts, recurring blocked categories, attempted policy bypasses and unusual activity outside normal working patterns are usually more valuable than a detailed browsing report for every employee. Any monitoring should be proportionate, transparent and aligned with your employment policies and data protection responsibilities.

Review the policy at regular intervals and after major changes, such as moving office, introducing new devices, hiring a remote team or adopting a new cloud platform. It is also worth reviewing after a security incident, even if the filter successfully blocked it. The event may reveal a need for additional training, email protection or stronger account controls.

Web filtering works best with other protections

A web filter is an important control, but it cannot inspect every risk or correct poor security habits on its own. A user may still receive a convincing phishing email, use a weak password or approve an unexpected multi-factor authentication request. Good protection comes from layers that support each other.

Keep operating systems, browsers and applications updated. Use managed endpoint security, secure DNS or firewall controls where appropriate, multi-factor authentication for key accounts and reliable backups that are regularly tested. Staff should know how to report suspicious emails, websites and pop-up messages without worrying that they are wasting anyone’s time.

For local businesses that need help with policy design, installation or ongoing monitoring, Anglian Internet can help assess your network, users and remote-working requirements. A properly configured solution should fit the way your business operates, not force your team into unnecessary workarounds.

The right filtering policy is one your staff can live with and your business can trust. Start with clear security priorities, test changes carefully and keep reviewing the results as your organisation grows.