We support many schools and businesses to manage their web content filtering, here we answer questions we have been asked. Find answers to common Sophos XGS web filtering questions for schools. Learn how to manage keyword blocks, identify users via Active Directory, and optimise bandwidth for staff and students.

Can the Sophos XGS block websites based on specific inappropriate words appearing on the page?

Yes. By populating the Sophos XGS content filter with inappropriate keywords, you can enforce stricter browsing rules for Students. When this filter is active, the system scans the page content and blocks access if restricted words are detected, overriding any standard “allow” policies for that site.

Why are some legitimate websites being blocked by the content filter?

This usually happens when a website contains background scripts or text strings that include one of your blocked keywords. The Sophos XGS content filter is highly sensitive and will trigger a block if it identifies a match regardless of capitalisation, such as “word” or “woRd”. It also detects the keyword when it is part of a larger string, such as “sword”. To resolve this, we have created an exception rule that allows these specific legitimate sites to bypass the content filter while keeping your security policies active elsewhere.

Why can’t we access BBC’s cbeebies site?

The Sophos XGS correctly categorised this as Kids, however the User Activities the Kids category falls under Games and Gambling and was being blocked due to rule being above the allowed categories. We can remove the Kids category from the Gambling and Gaming User Activities so that the site is allowed for students.

How can schools identify individual users in web activity reports?

To track specific usernames for reporting purposes, the Sophos XGS is connected to your Active Directory server. By adding this as a firewall authentication server and enabling Active Directory Single Sign On (SSO), the system can map web traffic to specific accounts. This allows the school to generate detailed reports on the web activity of both staff and students.

Why are staff unable to access WhatsApp even though the site is on the allowed list?

Although WhatsApp may be permitted in your web policy, its end to end encryption can sometimes interfere with how the firewall inspects traffic. Because the Sophos XGS cannot see into the encrypted stream, it may block the connection by default. To resolve this, WhatsApp has been added to the decryption skip list, allowing the encrypted traffic to pass through safely for staff members.

How does the Sophos XGS help support our bandwidth and web use?

The Sophos XGS plays a dual role in maintaining a productive network environment. Firstly, it ensures that web browsing is safe by using intelligent content filtering and user identification through Active Directory. Secondly, it protects our connection speeds through proactive traffic management. By identifying high demand activities, such as bulk device updates, the firewall can limit the bandwidth those tasks consume. This prevents the network from becoming saturated and ensures that critical educational resources always have the priority they require.