Web Content Filter

Introduction

MDM lets you control the contents that can be viewed on the browsers of managed devices using Web Content Filter. Web Content Filter lets you Blocklist or Allowlist URLs as explained below:

Allowlisting: Only URLs added in this filter can be viewed on the device browser, while all other URLs are blocklisted(restricted from viewing on the device browser).
Blocklisting: URLs added in this filter cannot be viewed on the device browser, while all other URLs are allowlisted(can be viewed on the device browser)

Other than restricting URLs, Web Content Filter also provides the option of restricting content, whereby websites with adult content are automatically blocked irrespective of whether the website URL has been allowlisted or blocklisted. Web Content Filter is applicable for Supervised devices running iOS 7.0 or later versions. Enabling Automatic restriction of inappropriate content ensures that inappropriate content is restricted on the devices. Apple restricts inappropriate content based on blocklisted keywords such as adult content, and content to be restrained from children below 18.

Blocklisted URLs can be still be accessed if the corresponding app is present on the device. For example, even if all Facebook URLs have been restricted, users can still access Facebook, if the app is installed on the device. To prevent this, the apps must be blocklisted as explained here.
Blocklisting/allowlisting HTTP version of the URL automatically Blocklists/Allowlists the HTTPS version of the URL and vice-versa.
If a blocklisted URL is redirected, then the restriction will not be applied on the redirected URL, unless it is also blocklisted
Wild card-based URLs such as *.example.com, https://*.com etc., are not supported.
Mobile version of the URL and country based domain extensions should be considered as separate URLs. Example : facebook.com, facebook.co.uk, m.facebook.com, etc

Adding URLs in Web Content Filter

The following table explains the various scenarios where Web Content Filter can be used.

SCENARIO	EXAMPLE URLs
Fully Blocklist all the sub-folders/directories of a website	Specify http://example.com to automatically block all the sub-folders/directories(example.com/directory1). However, this doesn't block the sub-domains such as m.example.com
Blocklist a specific sub-domain of a website	Specify sub-domain.example.com to block the sub-domain. However, this doesns't block the website http://example.com or other sub-domains such as m.example.com
The URL blocklisted/ allowlisted gets redirected to another URL	Specify the second URL(to which the first redirects to). If http://example.com redirects to http://example.us,then http://example.us must be specified
The URL combined with a port number	The URL gets completely blocklisted/allowlisted as port numbers are not considered

Distributing multiple Web Content Filter policies to the same device

The following table explains how Web Content Filter works on the device, when multiple profiles are pushed to the device.

PROFILE 1	PROFILE 2	EXPECTED BEHAVIOUR
Allowlist URL #1 and #2	Allowlist URL #1 and #3	URL #1 is allowlisted. All other URLs are automatically blocklisted.
Blocklist URL #1	Blocklist URL #2	URL #1 and URL #2 are blocklisted. All other URLs are automatically allowlisted.
Blocklist URL #1	Allowlist URL #1	All URLs are automatically blocklisted.
Blocklist URL #1 and URL #2	Allowlist URL #3 and URL #4	URL #3 and URL #4 are allowlisted. All other URLs are automatically blocklisted.

ManageEngine