Control Access to URLs
URL filtering mechanics
URL filtering resolves each session to a PAN-DB category and applies a URL Filtering profile attached to an allow rule, directly or through a profile group. Each category maps to an action: allow, block (with a block page), continue (a warning page the user can click through), override (requires a password to proceed), or none. The block page is customisable and can display the URL category and requesting user. Profiles also support safe search enforcement, HTTP header insertion (X-Forwarded-For, user agent) and credential enforcement, which detects corporate credentials submitted to sites in selected categories and alerts or blocks.
Visibility limits
On HTTPS without decryption the firewall derives a category from handshake information and sees the application 'ssl'; per-URL control, file blocking and credential detection generally require SSL decryption. This is the most common trap: an engineer enables URL filtering, tests an HTTPS site, sees no block page, and assumes the profile is broken when the traffic was never decrypted.
Custom categories and lists
Custom URL categories hold explicit URL lists or can be sourced from an external dynamic list of URLs, domains or IPs. They can be referenced in profiles and, where appropriate, in policy. The unknown category should normally be logged rather than silently allowed.
Best practice pattern
Block high-risk categories (malware, phishing, command-and-control, hacking), warn or continue on moderate risk (proxy-avoidance, unknown), and allow business categories. Pair the profile with a user-based rule so reporting shows who, not just what.
Worked example: a rule allows web-browsing and ssl with a URL profile blocking 'malware'. A user opening a known malicious URL over HTTPS receives the block page only once SSL forward proxy is enabled; otherwise the session passes as 'ssl'.