Keyword-based policy enforcement

Keywords are associated with categories, and then used to offer protection against URLs that have not explicitly been added to the Forcepoint URL Database or defined as a custom URL. Three steps are necessary to enable keyword blocking:

  1. Enable keyword blocking at a global level (see Configuring filtering settings).
  2. Define keywords associated with a category (see Defining keywords).
  3. Enable keyword blocking for the category in an active category filter (see Editing a category filter).

When keywords have been defined and keyword blocking is enabled for a specific category, web protection software tries to match the keyword against each requested URL as follows:

  • If the keyword contains only ASCII characters, the keyword is matched against the domain, path, and query portions of a URL.

    For example, if you associated the keyword “nba” with the permitted Sports category, the following URLs are blocked:

    • sports.espn.go.com/nba/
    • modernbakery.com
    • fashionbar.com
  • If the keyword contains characters outside the ASCII character set, the keyword is matched against only the path and query portions of the string.

    For example, if you associated the keyword “fútbol” with the permitted Sports category:

    • “www.fútbol.com” is permitted (the domain portion of the URL is not matched)
    • “es.wikipedia.org/wiki/Fútbol” is blocked (the path portion of the URL is matched)

When a site is blocked by keyword, the site is recategorized according to the keyword match. Reports show the keyword category, rather than the Forcepoint URL Database category, for the site.

Be cautious when defining keywords to avoid unintended overblocking.

Important: Avoid associating keywords with any of the Extended Protection subcategories. Keyword blocking is not enforced for these categories.

When a request is blocked based on a keyword, this is indicated on the block page that the user receives.