Configure Rule Content Selection

Choose whether a rule applies to an app, website, category, and more.

Tech Lockdown Team

Updated August 2, 2024

When creating a Content Policy rule, you will need to specify the content that the rule applies to.

You can select content in the following ways:

Content Category: Almost every website on the internet is categorized in multiple ways. Apply a rule to a category allows you to match many different websites automatically.
Apps: If you are wanting to block a specific App, like Tik Tok, this is the best method to choose. Apps use many different domains to function properly. Blocking an App will block all domains associated with the app.
Domains: Specify a domain name, such as example.com.

Apps

You can also block specific Apps' connection to the internet within a rule.

Note

Adding an App to a Block rule won't prevent the app from being downloaded or installed onto your device. Instead, that app will be disconnected from the internet.

You will generally be adding Apps to either Allow or Block Rules. To add an App to a rule, use the App section under the Categories menu:

Domains

You can specify a specific web domain with your Rules.

Domains apply to Allow, Block, SafeSearch, and YTRestricted rules. In most cases, you will be using them in either Block or Allow rules.

Hostnames and Subdomains

To edit websites by Hostname or Subdomain:

Either create a new rule or edit a existing one; click on the Content tab.

Under the Content tab, click on Domains.

Add a domain to the Domains section.

Click Add for each domain you want to add, then click Save to confirm changes.

There are some cases where a website uses multiple subdomains for various websites or services. For example, Google has a search engine at "google.com", but gmail is accessed through "mail.google.com". You can choose to block the entire Google domain (by blocking the "google.com" hostname), or mail specifically (using the "mail.google.com" subdomain).

Keywords

Choose a word that appears in a domain. For example, you can block any website with the word "chat" in its domain ("wechat.com" would match, but "meets.google.com" would not).

To add a domain word to a rule:

Either create a new rule or edit an existing one; Click on the Content tab.

Click on the Domain section.

Add a keyword to the Domain Words section.

Click Add for each domain word you want to add, then click Save to confirm changes.

Does Rule Order Matter?

Yes, it does. To make this as easy as possible as you create new rules, our dashboard automatically sorts rules correctly.

In general, here's how you want to order your Block, Allow, and SafeSearch/YTRestricted rules:

Allow rules should always be first, towards the top; that way they don't get ignored. When you create a new Allow rule, it should be grouped towards the top of your Content Policy.
SafeSearch and YTRestricted rules should be next. When you create a new SafeSearch or YTRestricted rule, they should be grouped after Allow rules.
Block rules should be last, after SafeSearch, YTRestricted, and Allow rules. When you create a new Block rule, it should be grouped towards the bottom of your Content Policy.

Frequently Asked Questions

How do I exclude a website or app from being blocked?

If you are blocking a category like Social Networking, but do not want to block an app like LinkedIn, add the app to an allow rule this is higher up on the list compared to the block rule.

How do I find out what rule is blocking a website?

You can use the block page or examine blocked traffic logs to narrow down why something is blocked.

On the block page, you'll see the rule name listed near the bottom. You can also click the Cloudflare Radar link to look up the categories associated with that domain.

You can also go to Activity > Traffic Logs and look at recent blocked traffic. The associated category will be listed.

How do I enforce SafeSearch?

Some search engines like Google and Bing provide a setting to filter out explicit results. You can force this on the DNS-level using your content policy.

In your content policy, create a new SafeSearch rule

Select the News, Portals, and Search category (it should already be selected).

Save the rule and go back to the content policy page

How do I block search engines that don't support SafeSearch?

Update your existing SafeSearch rule or create a new SafeSearch rule.

Name the rule "Search Engines with SafeSearch"

Uncheck all selected categories and apps (if any are selected)

Edit the domains section of the rule and add the following domains:

google.com
google.co.uk
bing.com
duckduckgo.com
search.yahoo.com
yandex.com

Save the SafeSearch rule and go back to your Content Policy page

Create a new Block Rule and name it "Search Engines without SafeSearch"

Block the category Search Engines

Save changes and then go back to your Content Policy page

Check rule order

The system should automatically handle the order, but double check that the SafeSearch rule is higher up on the list compared to the Block Search Engines rule.

Troubleshooting

My SafeSearch rule isn't working

Ensure that there isn't an Allow rule ordered above the SafeSearch rule with any of the following content selections:

Related domains added like google.com, bing.com, duckduckgo.com, search.yahoo.com.
Related applications selected like Google, Bing, or duckduckgo.
Related categories selected like Search Engines or News, Portals, and Search

Make sure you restart your browser once confirming these content policy changes.

I can't use Bing Chat (Copilot) due to SafeSearch

Bing's copilot chat won't work while SafeSearch is enforced. We suggest the following work-arounds:

Create an Allow rule, name it "Exclude Bing from SafeSearch", and use Content > Applications to select Bing.

Assign a schedule to this rule so that it's active during your productive hours and inactive during leisure time. You can also choose to have it on always.

Save rule and go back to the Content Policy page.

Ensure that this allow rule is ordered above the SafeSearch rule

Some apps or websites can be accessed during internet downtime

There are two common reasons:

Caching on the device can cause the internet downtime rule to take some time to apply to apps that were previously opened on the device. You will usually see old, cached content that was viewed previously on the app.
Content Policy rule order. The internet downtime rule should be ordered above all other Allow rules except for the rule where you specify Internet Downtime Exceptions.

I blocked an app or website but I can still access it

It can take up to 15 minutes for a new adjustment to your content policy to take effect

You may have an Allow rule that has an overlapping category, domain, or app selected. The allow rule will override the block rule. For example:

Allow rule has Social Networks category selected
Block rule below it has Facebook application selected

In this case, the Facebook application won't be blocked. You have to re-order so that Facebook block rule is above the social networking block rule.

I allowed an App, Website, or Category, but it's still blocked