What is the challenge?
How do you protect users browsing the open internet from anywhere?
Employees no longer sit behind a single office firewall. They work from cafés, hotels, and home offices. Without an in-line inspection layer, you have no visibility into the malicious sites they land on, the credentials they paste into lookalike domains, or the categories they're visiting that violate acceptable-use policy. Legacy on-prem proxies require backhaul that kills latency.
Architecture
How it fits together
Diagram coming soon
Architecture diagram for this solution will be added here.
Cloudflare's Solution
How Cloudflare solves it
- DNS, network, and HTTP filtering in one policy. Apply rules at the DNS layer (fast, lightweight), the L4 layer (IP/port), and the HTTP layer (URL, body, headers) — all from one policy engine, all enforced at Cloudflare's edge.
- TLS decryption for full inspection. Decrypt and inspect HTTPS traffic when policy requires it, including the ability to scan for malware, sensitive data, and unsanctioned apps. Selectively bypass categories like healthcare and banking to respect user privacy.
- Categorized internet. Cloudflare classifies billions of domains into 150+ content categories and continuously-updated security feeds (malware, phishing, command-and-control, newly-registered domains). Block by category in a single click.
- Anti-phishing intelligence. Detect lookalike domains, brand impersonation, and credential-harvesting sites before users click. Block at DNS or via in-browser warnings.
- Anywhere enforcement via WARP. The WARP client sends all device traffic through Cloudflare regardless of physical location. Policies follow the user, not the office.
FAQ
Common questions
Will TLS decryption break apps or violate user privacy?
Selective decryption lets you bypass sensitive categories (banking, healthcare) and specific hostnames. Cloudflare publishes its CA root and a configuration profile so devices trust the inspection certificate. Most modern apps handle this transparently.
How is this different from a DNS-only filter like 1.1.1.1 for Families?
DNS filtering is one layer, and it's fast and lightweight. SWG adds full HTTP and L4 inspection, body scanning, file upload/download policy, and integration with identity — so you can write rules like 'allow Salesforce only for the Sales group' or 'block file uploads to unmanaged personal cloud storage.'
What does the user experience look like when something is blocked?
By default, a clean Cloudflare-branded block page explains why. You can customize the message, add a request-access link to your ticketing system, or warn-and-continue for low-severity categories.
Does it work on mobile?
Yes. WARP runs on iOS, Android, macOS, Windows, Linux, and ChromeOS. For BYOD or unmanaged devices, you can publish a hostname-based portal (Browser Isolation) instead of requiring the client.
Let's Test!
Try it live
Demo coming soon
An interactive demo for Secure Web Gateway is being built. In the meantime, check the "Dive Deeper" section below for the official docs and product blogs.
Dive Deeper