Web Filtering and URL Control: A Policy for the SME Office

Summary: Web filtering in an SME office isn't just "block social media". A proper policy weaves three dimensions together: security (malicious domains, phishing, drive-by malware, ransomware C2), productivity (off-task content during work hours), and legal obligations (Law 5651 logger, KVKK information notice). Filtering can be done at the DNS level, via a proxy, or with a next-gen firewall; category-based policy, department-specific customisation, and exception management require ongoing care.

Without a web filter in an office, employees spend hours on social media; but that's the smallest problem. The real risk: an employee opening a malicious ad (malvertising) lands ransomware on the office network, or a click on a phishing email leads them to enter their bank password into a fake page. Without a web filter, EDR, firewalls, and other defence layers aren't enough on their own — the attack's starting point is the user's browser.

In this article we cover web-filtering policy design, solution selection, and operational management at SME scale. Target audience: IT owners, office managers, and decision-makers managing employee productivity alongside security.

The Three Dimensions of Web Filtering

Three different objectives must be balanced in a filtering policy.

1. Security

• Malicious domains (malware, phishing, ransomware C2)
• Sites with drive-by download risk
• Command-and-control (C2) server lists
• Categories that detect leaked corporate data

2. Productivity

• Social media (during work hours)
• Video streaming (bandwidth-heavy)
• Games, betting sites
• Shopping, dating

3. Legal Alignment

• Law 5651 access records
• KVKK information notice (disclosing that filtering happens)
• Prohibited content (national regulation)
• Access blocks to non-compliant services (unlicensed software)

Balanced across the three, the filter protects without creating an unbearable user experience.

Filtering Methods

Three core technical approaches:

DNS-Based Filtering

Malicious or unwanted domains are blocked at the DNS-query level.

Pro	Con
Quick rollout (changing DNS is enough)	Only at the domain level; doesn't see the URL path
Affects all devices (including mobile)	Bypassable via DoH / DoT
Low cost	Doesn't look inside HTTPS
Transparent — no user configuration	Only a "yes/no" decision

Common solutions: Cisco Umbrella, Quad9, NextDNS, Cloudflare Gateway, AdGuard.

HTTP/HTTPS Proxy

All browser traffic flows through a proxy; with HTTPS inspection, even encrypted traffic is examined.

Pro	Con
Filtering at URL-path and page-content level	User experience may slow down
Depth via HTTPS inspection	Certificate management is complex
Detailed productivity filtering	Long configuration cycle
Category + time-based rules	Some applications become incompatible

Common solutions: Squid (open source), Sophos, Forcepoint, Trend Micro IWSVA.

Next-Gen Firewall (NGFW)

Modern firewalls filter web traffic with L7 (application layer) inspection.

Pro	Con
Firewall + filter in one box	Licensing cost
Application-aware (Facebook, YouTube, etc.)	NGFW capacity ceiling
Time-based categories	Configuration is complex
KVKK logging integrated	A second NGFW required for HA

Common solutions: FortiGate (FortiGuard), Palo Alto Networks, Sophos XG, Cisco Firepower.

Category-Based Policy Design

Modern filtering solutions offer URL databases split into hundreds of categories. A typical SME policy:

Category	General staff	Managers	IT / Developers
Malware / phishing	❌	❌	❌
Adult content	❌	❌	❌
Betting / gambling	❌	❌	❌
Violence / hate	❌	❌	❌
Social media	⚠️ Break times	✓	✓
Streaming video	⚠️ Limited	✓	✓
Shopping	⚠️ Limited	✓	✓
News / blog	✓	✓	✓
Education / reference	✓	✓	✓
File sharing	⚠️ Approved providers	✓	✓
Anonymous proxy / VPN	❌	❌	Limited
Crypto mining	❌	❌	❌
Unknown / new domain	⚠️ After approval	⚠️	⚠️

Customisation by Department

• Marketing: social media open (job requirement)
• Sales: LinkedIn, CRM tools open
• Developers: GitHub, Stack Overflow, package distributors (PyPI, npm) open
• HR: job sites open
• Accounting: bank portals, financial sites open

Department / role-based customisation is ideal instead of a single policy for everyone.

Time-Based Rules

Some categories aren't "fully banned" — only limited during work hours.

A Typical Time Policy

• 09:00–12:00 and 13:00–18:00: social media, shopping, games inaccessible
• 12:00–13:00 (lunch break): social media open
• 18:00–09:00 (outside work hours): broad access
• Weekend: full access

Modern filter solutions configure these as calendar-based rules.

HTTPS Inspection — a Sensitive Topic

Over 90% of web traffic is HTTPS-encrypted. To see URL paths and page content, you need HTTPS inspection (TLS interception).

How HTTPS Inspection Works

1. The employee's browser requests https://example.com
2. The proxy / firewall sits between the employee and the site
3. The proxy issues a new certificate signed by the corporate CA
4. The browser trusts that certificate (the corporate CA was pre-installed on the device)
5. The proxy sees the traffic, can filter, and logs it
6. It forwards to the employee over a new encrypted channel

The KVKK Angle

HTTPS inspection makes the employee's traffic visible. Under KVKK:

• The information notice must clearly state HTTPS inspection
• Banking, healthcare, personal-finance sites should be excluded from inspection (whitelist)
• Access to collected data must be tightly controlled (IT only, on need)
• Records must be retained for the statutory period, then deleted

Filtering Without Inspection

Filtering is still possible without HTTPS inspection — only at the domain (SNI) level:

• All access to facebook.com is blocked
• But facebook.com/specific-page can't be blocked (content isn't seen)
• For an average SME, this is usually enough

Block-Page Design

The page shown to the user when the filter blocks is critical.

A Good Block Page

• Why it was blocked (category name, rule number)
• Who approves (IT manager, email)
• Whitelist-request form (one-click)
• Link to the KVKK information notice
• "Mis-categorised" reporting

A Bad Block Page

• Just "Access denied" text
• No context
• Employee has to open a support ticket

A good block page turns even a filter-averse employee into a user who at least understands the decision.

Exception and Whitelist Management

A filter is never 100% perfect. Exception management is essential.

A Typical Exception Flow

1. The employee wants to reach a blocked site
2. Submits a request via the button on the block page
3. The request goes to IT (ticket)
4. IT reviews — legitimate business need or personal?
5. If approved, it's whitelisted (temporary or permanent)
6. The employee is notified

Whitelist Hygiene

• Expiry dates on temporary whitelists
• Annual whitelist audit (anything unnecessary gets removed)
• Who approved, when, with what reason — logged

Mobile Devices and Remote Workers

The filter shouldn't disappear when the employee leaves the office.

Methods

• Cloud filter + agent: providers like Cisco Umbrella, NextDNS install a small agent on the device; wherever the device is, traffic flows through the cloud filter
• Always-on VPN: the device stays connected to the corporate VPN; all traffic flows through the corporate filter
• DNS profile (MDM): a mandatory DNS-server profile on the device (Apple, Android support this)

For SMEs, cloud filter + agent is the most practical; works regardless of the device's location.

What Yamanlar Bilişim Offers

Our web-filtering support areas at SME scale:

• Audit of current filter state
• Solution-selection advisory (DNS / proxy / NGFW)
• Policy design (department, role, time-based)
• Cisco Umbrella, NextDNS, Sophos, Fortinet rollout
• HTTPS inspection and KVKK information-notice support
• Remote-worker coverage architecture
• Annual policy review and reporting

Frequently Asked Questions

Conclusion

Web filtering is an invisible but critical layer in SME cybersecurity. It can be applied at DNS, proxy, or NGFW level; correct policy design weaves security, productivity, and legal alignment together. On the KVKK side, HTTPS inspection and the information notice must be managed carefully. In remote-worker environments, the cloud filter + agent model is steadily leaving classic VPN behind.

Yamanlar Bilişim offers web-filtering designs customised to your office scale and employee profiles — keeping the employee's browser within the limits set by the company, not the attacker.