WSS Admin Guide

Overriding Website Filters

After marking site categories and subcategories as allowed, blocked, or coached, you can use the Override subtab to exempt specific website URLs from those settings if appropriate. When users access sites, the Web Security Service first checks the override settings, then implements the controls defined in the Site Categories subtab.

Note: To check Webroot's analysis of a specific website, see Determining a URL's Classification.

The following example shows the Site Override tab with an entry in the list at the bottom.

Using the Site Override subtab, you can:

• Define a list of sites that override the filter settings of their parent categories.
• Import site overrides from a comma-separated list, or add sites individually.
• Use a combination of both methods without losing data unless you explicitly delete sites.
• Re-categorize sites if you don't agree with the standard categorization in the Site Categories subtab.
• Update site override information by importing from the edited comma-separated list.
• Define a maximum of 2,500 site overrides per policy.

Note: Settings on the Site Override subtab are enabled if you purchased the Web Filtering feature. To enter settings, you must have Site Override permission for Manage Policy. Additionally, to import sites from a file, you must first create the CSV file.

Site override processing

Before a policy is applied to a category or file type, the Web Security Service checks for and uses overrides. Settings on the Site Override tab take precedence over most settings in the other Policies subtabs, except for Malware Protection. The following table provides additional details about the subtabs.

Site Categories	On this subtab, you have defined blocked and coached categories.
Site Override	On this subtab, you override blocked or coached URLs by setting them to Allowed.
Malware Protection	Regardless of override settings, malware protection is always in effect but you must ensure that Full Threat Protection is enabled. Allowed sites containing malware are therefore blocked.
Files	On the Files subtab, you deny or allow the uploading or downloading of file types. Allowed sites take precedence over blocked file types. For example, the Graphics file type is blocked. You can access an allowed site containing graphics, and you can view, upload, or download any image to and from that site.
Quotas	You limit the number of allowed sites that the user can access. If you override by allowing certain sites, access to these overridden sites are counted towards quota.

You can specify how site overrides are handled while defining your policy. For example, you might want to ban executables in general, but you require executables from legitimate sites such as your qualified computer suppliers. In this case, first block the executable file types, but allow sites of your qualified vendors so you can download their updates. You can also block streaming file types, but allow known TV sites, so that users can only view streaming news videos from those sites. If you enable Full Threat Protection, you are always protected from malware.

Site override settings

Site Override Settings	Description
Label	Required. The label provides a meaningful description of the site. A label is useful if the URL itself is not descriptive. Enter up to 64 characters. Valid characters are any combination from A to Z, a to z, 0 to 9, and spaces.
Domain	This is the fully qualified domain name (FQDN) of the website. For example: abc.com or www.photos.xyz.com Do not include http://, https://, or any additional separators (/) within the domain name.
Include all Subdomains	Select the checkbox to include subdomains in the override. By default, the override applies to the specific entry in the Domain box. This option allows you to include subdomains. A domain level is in this format: xyz.com If you include subdomains, these URL formats are automatically affected by the override: mail.xyz.com phones.xyz.com anything.xyz.com ... If you don't include subdomains, the override is based on the entry in Domain. For example, within the xyz.com domain, only photos.xyz.com is overridden if this is what you specified in Domain. Note: After you have defined many site overrides, you can include subdomains for all by clicking the Select All Subdomain button above the list of overrides.
Action	Required. The actions are: Blocked. Blocks a specific site within a category of allowed or coached sites. Allowed. Allows a specific site within a category of coached or blocked sites. Re-categorize Site. Includes this site in one of the predefined subcategories in the Site Category subtab. Don't re-categorize sites if your Web Filtering option is either Allow All Websites or Block All Websites. If you select this option, a drop-down list displays the subcategories for you to select. A re-categorized site inherits the access settings from its new category. If you are unsure of a site's category, see Determining a URL's Classification.

Site Override: sample scenarios

The Site Override settings take the highest precedence over settings in the Site Categories subtab. Below are possible scenarios for using overrides.

Scenario 1: Policies conflict because a single site falls under multiple categories:

Suppose your business rules dictate the blocking of a certain category, such as Business/Services, and your rules also allow access to Real Estate. Some sites can be under both Real Estate and Business/Services categories.

Because of precedence rules, blocking takes precedence for sites with overlapping categories. If you know of sites that are affected by conflicting settings for blocking, override URLs from the blocking policies that apply to their general category.

Scenario 2: Overriding 'block all' or 'allow all' categories:

On the Site Categories tab's Web Filtering field, you can have one general filtering option for all categories. For this option you can filter selected website categories, allow all websites, or block all websites. In Allow All or Block All, the only override action that applies is to turn off the global setting. For example:

• If the Site Categories setting for Web Filtering is Allow All Websites and you want to override a few sites, your Site Override setting for Action should be Blocked.
• If the Site Categories for Web Filtering is Block All Websites and you want to override a few sites, your Site Override setting for Action should be Allowed.
• For Allow All Websites or Block All Websites, the override action to re-categorize sites does not apply.

Scenario 3: Overriding blocked file types from allowed websites:

On the Files subtab, you can grant or deny permission to upload or download file types by categories or specific types. For example, you might want to deny streaming video files in either direction. File-type blocking takes precedence even for allowed sites. If you generally allow access to news sites that would have streaming videos, therefore, those file types are still blocked. If you allow streaming videos from specific sites only, add the URLs of these sites (for example, CNN.com) in the Site Override subtab and set Action to Allowed.

Adding a batch of site overrides using file upload

You can maintain an external comma-separated values (CSV) file containing site overrides and then upload the information from that file. With a CSV file, you can:

• Add a large batch of site overrides
• Maintain your site override changes in the list and re-import the updates into the Management Portal.

To create a CSV file:

• Use a text editor and type the first line, the header, exactly like this:

  LABEL,DOMAIN,SUBDOMAIN,ACTION,CATEGORY

  These represent the column headers for the actual values.
  Here is an example of a CSV file:


• Enter information about the overridden sites, one line per override, separating each value with a comma.

  Site Override Values in the CSV File	Description
  Label	Required. The label provides a meaningful description of the site. A label is useful if the URL itself is not descriptive. Enter up to 64 characters. Valid characters are any combination from A to Z, a to z, 0 to 9, and spaces.
  Domain	This is the fully qualified domain name (FQDN) of the website. For example: abc.com or www.photos.xyz.com Do not include http://, https://, or any additional separators (/) within the domain name.
  Subdomain	Type 1 to include subdomains or 0 to use the fully qualified domain in Domain. By default, the override applies to the specific entry in the Domain box. This option allows you to include subdomains. A domain level is in this format: xyz.com If you include subdomains, these URL formats are automatically affected by the override: mail.xyz.com phones.xyz.com anything.xyz.com ... If you don't include subdomains, the override is based on the entry in Domain. For example, within the xyz.com domain, only photos.xyz.com is overridden if this is what you specified in Domain.
  Action	Type one exactly as shown: allow to allow access. Use only if Web Filtering=Block All Websites. block to prevent access. Use only if Web Filtering=Allow All Websites. category to re-categorize the site. CATEGORY is required. Use only if Web Filtering=Filter Websites. If category, the category's integer ID is required.
  Category	Leave blank if ACTION is block or allow. If ACTION is category, enter the category's integer ID. Get the ID in Category Descriptions.

• Save the file with a .txt or .csv extension.

To upload the CSV file:

• On the Policies tab, create a new policy or display an existing one in Edit mode.
• Select the Site Override subtab.

• Browse to the CSV file and open it.
• Locate the CSV file, select it, and click Open.
  The Select File field shows the path to the file.

• Select an entry from the Upload Options list:

  • Select Append to Existing Entries to add entries to your current overrides list.
  • Select Overwrite Existing Entries to replace your current list with this upload.
• Click Save.
  The Policies page reopens. Open the policy in View or Edit mode to view the updated list in the Site Override tab.

If you plan to delete overrides in the future, use the Management Portal, see Deleting Overridden Sites, further down on this page. You must also remove deleted site overrides from the CSV file, or the discontinued category IDs will be ignored and the Admin will get email notification with validation errors.

If you are adding one or two sites intermittently, you can override a site category manually:

• On the Policies tab, create a new policy or display an existing one in Edit mode.
• Select the Site Override subtab.
• Enter information as described in the Site Override Settings table above.
• Click Add Site Override.
  The site is added to the list of overridden sites.
• Click Save.

Updating site overrides

Using a CSV file import to update site overrides, you can update this information:

• Label
• Action
• Category, if action is to re-categorize
• Include or exclude subdomains

You can also update sites that you added manually or through a CSV import.

If you use the Management Portal to edit site overrides, you can only change the Subdomain setting using the checkbox.

Note: The Domain is the identifier for the override record to change, so keep the Domain value in the file. If you change the Domain, this entry is added as a new override.

To update the Subdomain setting:

• On the policy's Site Override subtab, locate the site to change.
• To change specific records, select the corresponding checkbox under Subdomain.
  To change all records, click the Select All Subdomains button (this changes to Unselect All Subdomain, which clears all checkboxes).
  Checkmarks indicate that subdomains of the Domain are included in the override. Absence of checkmarks indicates that only the Domain is overridden, but not its subdomains.
• Click Save.

To import updates on the CSV file:

• Open the CSV file containing the site override information.
• To include changes to sites that were added manually, add those sites in the file. Ensure that the Domains match those on the Site Override subtab. Follow the required format.
• Change the settings for Label, Action, Category (if Action is Re-categorize), or Subdomain as required. See the Site Override Settings table above.
• On the policy's Site Override subtab, import the file. In this case, select Append to Existing Entries as your Upload Option.
• Click Save.

Replacing the override list

Replace the existing overrides list by importing a new list.

To replace the override list:

• Create or edit the CSV file with new entries.
• On the policy's Site Override subtab, import the file. This time, select Replace All Entries as your Upload Option.
• Click Save.
  The Web Security Service deletes your old list and replaces it with the new list.

Deleting overridden sites

You can delete selected sites, or all overridden sites from the list.

To remove overridden sites:

• Locate the sites to be deleted from the Site Override subtab's list.
• Select the corresponding checkbox in the Delete column. Or to delete all overrides, click the Select All Delete button.

• Click Save.
  The selected sites are removed. If you clicked Select All Delete, the list is cleared.

Exporting site overrides

You can export the list of site overrides to a CSV file. The format of the CSV file will be:

• Label
• Domain
• Subdomain ('1' to include subdomains or '0' for Fully Qualified Domain Name)
• Action (block, allow or category)
• Category (integer ID, if applicable)

To export site overrides to a CSV file:

• Locate the desired policy in the Policy tab.
• Open the policy in View mode.
• Select the Site Override subtab.
• Scroll down to Add Individually, similar to the following example.
• Select Export All Site Overrides.
  This button is disabled if there are no site overrides defined in this policy.

• Select Save at the prompt, give the file a name, then click Save again.