HTTP filtering

Secure Web Gateway allows you to inspect HTTP traffic and control which websites users can visit.

Note

For a more detailed guide to filtering HTTP requests and other traffic for your organization, refer to the Secure your Internet traffic and SaaS apps implementation guide.

1. Connect to Gateway

To filter HTTP requests from a device:

1. Install the Cloudflare root certificate on your device.
2. Install the WARP client on your device.
3. In the WARP client Settings, log in to your organization's Zero Trust instance.
4. Enable the Gateway proxy for TCP. Optionally, you can enable the UDP proxy to inspect all port 443 UDP traffic.
5. To inspect HTTPS traffic, enable TLS decryption.
6. (Optional) To scan file uploads and downloads for malware, enable anti-virus scanning.

2. Verify device connectivity

To verify your device is connected to Zero Trust:

1. In Zero Trust ↗, go to Settings > Network.
2. Under Gateway logging, enable activity logging for all HTTP logs.
3. On your device, open a browser and go to any website.
4. In Zero Trust, go to Logs > Gateway > HTTP.
5. Make sure HTTP requests from your device appear.

3. Create your first HTTP policy

To create a new HTTP policy:

1. In Zero Trust ↗, go to Gateway > Firewall policies.

2. In the HTTP tab, select Add a policy.

3. Name the policy.

4. Under Traffic, build a logical expression that defines the traffic you want to allow or block.

5. Choose an Action to take when traffic matches the logical expression. For example, if you have enabled TLS inspection, some applications that use embedded certificates may not support HTTP inspection, such as some Google products. You can create a policy to bypass inspection for these applications:

   Selector	Operator	Value	Action
   Application	in	Do Not Inspect	Do Not Inspect

   Cloudflare also recommends adding a policy to block known threats such as Command & Control, Botnet and Malware based on Cloudflare's threat intelligence:

   Selector	Operator	Value	Action
   Security Categories	in	All security risks	Block

6. Select Create policy.

For more information, refer to HTTP policies.

4. Add optional policies

Refer to our list of common HTTP policies for other policies you may want to create.

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!