HTTP filtering
Secure Web Gateway allows you to inspect HTTP traffic and control which websites users can visit.
To filter HTTP requests from a device:
- Install the Cloudflare root certificate on your device.
- Install the WARP client on your device.
- In the WARP client Settings, log in to your organization's Zero Trust instance.
- Enable the Gateway proxy for TCP. Optionally, you can enable the UDP proxy to inspect all port 443 UDP traffic.
- To inspect HTTPS traffic, enable TLS decryption.
- (Optional) To scan file uploads and downloads for malware, enable anti-virus scanning.
- In Zero Trust ↗, go to Settings > Network.
- Under Gateway logging, enable activity logging for all HTTP logs.
- On your device, open a browser and go to any website.
- In Zero Trust, go to Logs > Gateway > HTTP.
- Make sure HTTP requests from your device appear.
To create a new HTTP policy, go to Gateway > Firewall policies > HTTP in Zero Trust. We recommend adding the following policies:
Bypass HTTP inspection for applications which use embedded certificates. This will help avoid any incompatibilities that may arise from an initial rollout. By the Do Not Inspect app type, Gateway will filter any new applications when they are added to the group.
| Selector | Operator | Value | Action |
|---|---|---|---|
| Application | in | Do Not Inspect | Do Not Inspect |
Block known threats such as Command & Control, Botnet and Malware based on Cloudflare's threat intelligence.
| Selector | Operator | Value | Action |
|---|---|---|---|
| Security Categories | in | All security risks | Block |
Refer to our list of common HTTP policies for other policies you may want to create.