← All articles

Web Content Filtering for Canadian Businesses in 2026

Web content filtering explained for Canadian businesses: how it works, how to block websites at work, what to put in a policy, and Ontario monitoring rules.

Administrator configuring business web filtering

Web content filtering is the control that decides which websites and categories of content your employees’ devices can reach, and it is one of the cheapest ways to cut off phishing pages, malware downloads and time-wasting traffic before they cause damage. Done well, it combines category rules, allow and block lists, reporting and a written policy your staff have actually read. Done badly, it is a blocklist nobody maintains and a false sense of security. This guide explains how filtering works, how to block websites at work without breaking legitimate workflows, what a defensible web filtering policy contains, and what Ontario and federal privacy rules expect of you.

247techify
Build a More Secure IT Environment
247Techify brings a cybersecurity-first approach to managed IT services for Canadian businesses seeking secure, efficient technology systems.

TL;DR

  • Web content filtering sorts sites into categories (malware, phishing, adult content, streaming, social media) and allows or blocks each category by policy, on the network, the device, or both.
  • DNS filtering blocks whole domains and is quick to deploy; URL and content filtering is more granular and can block individual pages. Neither replaces endpoint protection, a firewall or staff training.
  • Start in audit mode, review the reports, then block. Add a small, documented exception process so filtering does not stall real work.
  • Write the policy first. Canadian federal cyber guidance says technical controls should enforce a written acceptable use policy, and Ontario employers with 25 or more employees must have a written electronic monitoring policy.

Table of Contents

What web content filtering actually does

A content filter sits between your users and the internet and compares each request against a database of categorized sites. Businesses use hardware or software rules to group sites into categories and block the ones in undesirable categories, whether that means known high-risk malware hosts or distractions such as streaming video.

The filter can live in several places:

  • At the DNS layer. When a device asks for a site’s IP address, the filter checks the query against allowed and blocked domains and denies the request if the domain is on the blocklist. Nothing connects, so the page never loads.
  • At the firewall or secure gateway. Traffic is inspected on the way out, which allows URL-level rules and, with the right configuration, inspection of encrypted sessions.
  • On the endpoint. The filter travels with the laptop. Microsoft’s documentation says its web content filtering can block categories on managed devices whether users are on or off the corporate network, and apply different policies to different device groups.

For a Toronto firm with staff split between the office, home and client sites, that last point matters most. A filter that only works inside the office firewall does nothing for the accountant on a hotel network in March.

DNS filtering versus URL filtering

The two terms are often used interchangeably, but they block at different levels of precision.

Method What it blocks Strength Limit
DNS filtering Entire domains, at lookup Fast to roll out, light on performance, covers any app that uses DNS Cannot separate one page from another on the same domain
URL filtering Specific pages or files at the application layer Granular: block one path, allow the rest of the site Needs traffic inspection or an endpoint agent; encrypted traffic complicates it
Category filtering Groups of sites by topic or risk Scales without maintaining long lists Miscategorization and uncategorized new sites

This split is described plainly in an explanation of DNS and URL filtering: DNS filtering blocks DNS queries for domains, while URL filtering blocks specific webpages or files at the application layer.

For small offices, DNS filtering at the router is the lowest-effort starting point, and the principle is the same one used at home. If you want to see how the DNS layer compares with more granular application-layer filtering, this walkthrough of DNS filtering at the router shows where DNS rules stop and where bypass gaps appear. Canadian organizations also have a domestic option: CIRA runs a free protected DNS service called Canadian Shield, noted in the Canadian Centre for Cyber Security’s BYOD guidance. Free resolvers are a reasonable baseline for a home office. A business with regulated data needs centralized policy, logging and reporting on top.

Why businesses block websites at work

There are three practical reasons, in descending order of importance.

  1. Stop known-bad destinations. Filtering can block sites known to carry malware before they deliver a payload, including credential-phishing pages. Most intrusions that begin with a click begin on a page that was already categorized as malicious somewhere.
  2. Reduce legal and compliance exposure. Adult content, illegal file sharing and unvetted file-transfer services create liability and data-leak paths. For clinics and finance firms, uncontrolled cloud storage is a compliance problem before it is a productivity problem.
  3. Protect focus. Blocking social media and streaming during working hours is a legitimate choice, but it is the one most likely to cause friction. Apply it by role and, if needed, by time of day.

What filtering does not do

Filtering is a layer, not a wall. CIRA’s own materials present DNS threat intelligence as something businesses should add to endpoint, firewall and other controls rather than use instead of them. Category databases cannot catch a compromised legitimate site, a brand-new phishing domain registered an hour ago, or an attacker hiding inside encrypted traffic. A user who approves a malicious multi-factor prompt is not stopped by a web filter at all. That is why we pair filtering with endpoint protection, monitoring and training; see our guide to layered security that prevents data breaches and the measurable security awareness topics that make staff the last line of defence rather than the first point of failure.

Web filter alongside other security controls

How to block websites at work, step by step

The sequence below follows the pattern Microsoft documents for Defender for Endpoint and works, in spirit, with any filtering platform.

1. Decide what you are protecting and from whom

List the outcomes you want: no access to malware and phishing categories, no unmanaged file sharing, no adult content, and perhaps limits on streaming. Decide which groups differ. Finance, front desk and IT rarely need the same rules.

2. Run in audit mode first

Microsoft notes you can deploy a policy with no categories blocked to audit user behavior before you enforce anything. Two to four weeks of reports show which categories your staff really use, which saves you from blocking a tool the billing team depends on.

3. Create category policies and scope them to device groups

Select the categories to block and the device groups the policy covers. Start with the unambiguous ones: malware, phishing, command-and-control, adult content, and anonymizers and proxies that exist to defeat your filter.

4. Add custom allow and block entries carefully

Rules can be based on a web category, a URL or a fully qualified domain name. Microsoft’s guide for its Global Secure Access filtering says it supports wildcards and that administrators must distinguish a root domain from its subdomains when creating entries. That is a common error: blocking example.com does not necessarily cover files.example.com, and allowing one can accidentally allow the other.

The Defender documentation also lets you create a custom allow indicator for a specific site, scope it to device groups and, optionally, set an expiry date. Use the expiry. Permanent exceptions are how filters decay.

5. Expect propagation delays and miscategorization

Microsoft states that new sites might not be categorized immediately and that policies can take up to two hours to enforce. If a legitimate domain is wrongly categorized, you can dispute it with the vendor. Tell staff this up front so a blocked page produces a ticket, not a workaround.

6. Review monthly

Centralized reports show web activity by category, domain and device group. Look for repeated blocked attempts to the same destination (a possible infected device), growing exception lists, and categories nobody should be visiting.

This kind of tuning is routine work for a managed provider. If you would rather not run it yourself, our Microsoft 365 and endpoint management team configures and reviews these policies as part of ongoing support.

Writing a web filtering policy that holds up

Search interest in a “web filtering policy” is small, but the document matters more than the tooling. The Canadian Centre for Cyber Security’s Wi-Fi guidance says an organization should define permitted classes of web access and use technical controls to enforce the policy, which also reduces legal liability. It adds that firewalls and web filtering services should enforce a written acceptable use policy, because controls without a policy may not withstand legal challenges.

A workable policy fits on two pages and covers:

  • Purpose and scope. Which devices, accounts and networks, including personal devices that touch company data. Our BYOD policy controls cover that boundary, and the Canadian Centre for Cyber Security advises that BYOD policies be enforceable and auditable, spelling out data handling, encryption and permitted use.
  • Blocked and restricted categories, with the reason for each.
  • What is logged. Domains, categories, timestamps, user or device identifiers, and who can see them.
  • Exception process. Who approves, how fast, and when exceptions expire.
  • Remote and off-network behaviour. The filter follows the device or it does not; say which.
  • Consequences and review cadence. Annual review at minimum, and after any incident.

Pair it with your remote access policy so the same rules apply from a kitchen table as from the office.

Ontario and federal privacy rules for monitoring staff

Filtering produces logs, and logs of employee browsing are monitoring. In Ontario, employers with 25 or more employees as of January 1 must maintain a written policy on electronic monitoring that describes how and why employees are monitored, including website tracking. The employer must give each employee a copy and keep records of the policy for three years after it stops being in effect.

The Office of the Privacy Commissioner of Canada notes that such a policy must state whether monitoring occurs, how it is done, in what circumstances and how the information is used, and that the Act does not grant new privacy rights. Privacy law still applies on top of it.

The practical guidance from the OPC’s findings is proportionality. Monitoring should be limited to specific, appropriate purposes and use the least privacy-invasive means that achieve the goal. That finding dates from 2004, but the principle still shapes how regulators read workplace monitoring. In practice: block categories automatically, and look at an individual’s browsing history only when there is a security or conduct reason. If your business also handles health or financial data, our overview of Canadian data privacy laws and the HIPAA and PIPEDA mapping for clinics show how filtering logs fit into wider obligations. This is general information, not legal advice; have an employment lawyer review the final policy.

Perspective: filtering belongs inside a security program

We see the same pattern in small and mid-sized Toronto-area firms. A filter is switched on once, exceptions pile up, nobody reads the reports, and the first time anyone looks is after an incident. The tool was never the weak point. The missing owner was.

Our view is that web filtering earns its place only when it is wired into the rest of the stack: endpoint protection that sees what the filter missed, monitoring that flags a device repeatedly contacting blocked destinations, and a response process that treats those alerts as incidents rather than curiosities. Blocklists catch the known. Attackers rely on the new, the encrypted and the user who clicks anyway. A cybersecurity-first approach means assuming some traffic will get through and making sure someone is watching when it does.

We also think policy should be generous where risk is low and strict where it is high. Blanket bans on social media produce shadow IT and resentment. Blocking anonymizers, unmanaged file sharing and newly registered domains costs users almost nothing and removes real attack paths. Write the reasons down, tell staff, and review quarterly.

— 247techify Team

Getting filtering managed for you

If you would rather have filtering designed, enforced and reviewed by people who do it every day, our managed IT and cybersecurity services cover threat monitoring, endpoint protection and incident response, with 24/7 support and an average response time under 30 minutes. Business managed IT plans run from $1,099 to $2,499 CAD per month, and the GTA price index shows what drives the difference. Toronto businesses can start from our managed IT services page for Toronto.

247techify

For one-off help, such as a filter that blocks the wrong thing, pay-per-ticket support is $79 per ticket, and the full list is on our pricing page.

Common mistakes to avoid

  • Blocking before auditing. You will break a line-of-business app and teach staff to distrust the filter.
  • Ignoring HTTPS. Without a way to inspect or at least categorize encrypted traffic, URL-level rules have blind spots. Standalone URL filtering is widely viewed as insufficient for exactly this reason, so combine it with endpoint and network controls.
  • Forgetting remote staff. A filter only on the office network protects the office network.
  • Permanent exceptions. Give every exception an owner and an expiry.
  • No written policy. Without it, enforcement is hard to defend, and in Ontario it may be a legal requirement.
  • Treating logs as free data. Collect what you need for the stated purpose, restrict who sees it, and keep it only as long as your policy says.

FAQ

What is the difference between web filtering and content filtering?

Web filtering usually means allowing or blocking whole sites or domains, while content filtering can look deeper at pages, files and the data inside them. In practice, vendors use the terms loosely, so check whether a product works at the domain level, the URL level or both before you buy.

Can employees get around a web filter?

Sometimes. Personal VPNs, anonymizing proxies, mobile hotspots and alternative DNS settings are the usual routes. Block proxy and anonymizer categories, enforce filtering on the device rather than only the network, and restrict who can change DNS or network settings.

Do I need a web filtering policy if I have fewer than 25 employees in Ontario?

The Ontario written electronic monitoring requirement applies at 25 or more employees, but a short policy is still sensible below that threshold. Federal cyber guidance says technical controls should enforce a written acceptable use policy, and telling staff what is blocked and logged avoids disputes later.

Will filtering stop ransomware and phishing?

It reduces exposure by blocking known malicious sites, but it cannot stop everything, particularly brand-new domains and attacks that rely on a user’s approval. Use it alongside endpoint protection, multi-factor authentication, tested backups and staff training.

Sources