WorkAuditor Blog

You block websites on company computers at one of three layers — DNS, firewall, or endpoint software — and the right answer for most companies is DNS filtering with category blocks, plus an exception process that isn't painful. In the deployments I've run, the blocking layer matters less than the policy around it. A strict blocklist with no appeals process fails; a category policy with a fast exception path works.

Choose Your Blocking Layer

DNS filtering is the easiest place to start. Every website request begins with a DNS lookup, and a filtering service can answer "no" before the page ever loads. It blocks by domain, works for laptops on any network, and takes minutes to configure. Its weakness: it doesn't block sites reached by IP directly, and it's bypassed by a few determined users with VPNs.

Firewall blocking sits at the network edge and is great for office floors — you can block entire categories for the building. It does nothing for laptops at home or on client wifi. Endpoint software is the third layer: an agent on each machine enforces policy wherever the computer goes. For companies with remote staff, endpoint enforcement is the only layer that travels with the device. Most setups use DNS or endpoint, not both.

Category Blocking Beats URL Lists

A list of forbidden URLs decays within a week. Sites change, mirrors appear, and new streaming platforms launch monthly. Category blocking — social media during work hours, streaming video, gambling, adult content, shopping — stays current because the filtering vendor maintains the lists. When I recommend blocking, I recommend categories, with two or three individual exceptions per company.

The Allowlist Strategy

For some teams, blocking everything except an approved list is the better design. An audit firm or a regulated call center might allow only the tools work requires: the CRM, email, office suite, and finance systems. The allowlist eliminates whole classes of problems — malware downloads, data uploads, time sinks — because nothing unapproved can load at all.

The cost is friction. A designer who needs a reference image from a site that isn't on the list waits for approval instead of working. That's why I recommend allowlists for teams with narrow job functions and category blocking for everyone else.

Exceptions: Who Approves What

A design studio of 22 people taught me the exception lesson. The owner blocked streaming video entirely — and the studio's motion designer used YouTube constantly for reference work. Within a day, two designers had VPNs on their personal phones for streaming, and the policy was dead on arrival. We rebuilt it: streaming blocked by default, YouTube allowed for the design team, and a one-click exception form that any manager could approve. Blocked-site complaints dropped 36% in the first month, and for the first time the policy was actually enforceable, because it matched the work.

The mechanics matter: exceptions should be granted by category and role, expire after a set period, and show up in a monthly review. A manager who approves a YouTube exception for a designer isn't being loose; they're making a work decision. The review exists so those decisions stay visible.

What Blocking Does Not Solve

Blocking is a control, not a solution. A blocked site on a company computer doesn't stop anyone with a personal phone, and company-wide blocks don't stop a remote employee's home router. If your concern is productivity, blocking alone will disappoint you — the honest version is usage reports alongside the blocks, so you see what work-related time actually looks like. If your concern is security, blocks reduce one attack surface, but phishing email still lands in inboxes.

I tell clients to be explicit about which problem the block solves. It solves "the office network is full of gambling and streaming at 2 p.m." It doesn't solve "someone is unproductive" — that's a management conversation backed by activity data.

Rolling It Out Without Rebellion

The announcement matters more than the settings. Three rules I've never seen fail: give a week's notice, publish the categories being blocked (not a secret list), and explain what to do when a blocked site is needed for work — the exception form, who approves it, how fast it turns around. Secret blocklists are a culture disaster; they get tested, reverse-engineered, and reported on Reddit. Public policies get respected.

Also worth deciding: blocking during work hours only, or always? For shift-based teams, time-based blocking — social media blocked 9 to 6, open after — tends to be accepted far better than an absolute ban, because it reads as a schedule rather than a punishment.

Keep the Policy Alive

A website blocking policy is a living document. Teams change roles, new tools launch, and the categories that made sense at rollout look wrong a year later. Review the blocklist quarterly with the people it affects — managers, not just IT. In that review, drop blocks that no longer serve a purpose and add categories the work now needs. The policy that survives is the one that gets edited.

If you want blocking and activity visibility in one place, WorkAuditor is cloud-based employee monitoring software for Windows and Mac with website and app usage reporting — take a look at https://www.workauditor.com. Which category would your team argue about first: streaming, social media, or shopping? The answer tells you where your exception process needs to be strongest.