Sophos Central: How to exempt a website when it is blocked under specific category

There doesn't seem to be any consistency with the error messages when trying to access the blocked sites, sometimes it's a connection failure one and other times it's a Sophos one 

Hello Dan,

Thank you for reaching out to the Sophos Community. 

I suspect what you’re seeing is the error "Website cannot be found" when you’re trying to go to sites that are blocked. This is due to some sites using HTTPS, where-in the AV  isn’t able to inject the "Website Blocked" page into the secured traffic so that it’s displayed in the web browser. 

This is outlined in the following KBA under the section "How to check if Web Control is working."
- https://support.sophos.com/support/s/article/KB-000035338?language=en_US

Thanks for your reply, one more question, when blocking websites in the Website Management, do you have to put in all variations of the web addresses, or is there a wild card, e.g. gmai.com & mail.gmail.com?

Hello Dan,

In this situation, I recommend creating an entry for each of the base domains that will be accessed when your end-users try to reach Gmail. I suspect if you were to block "mail.google.com" but not "gmail.com" the end-users would see a web-page redirect occurring followed by nothing loading after the redirect. 

If both URLs are blocked then both will return the same behavior in strictly blocking the page when accessed, which would be a bit more suitable for your use case. 

Good day,

I followed all the steps you indicated, but the website still keeps blocking me, detecting it as phishing.

Hello, 

Thank you for reaching the community forum.

Suppose you’re confident that this website is clean. I suggest you submit a website reassessment request through our sample submission portal and specify the category you wish to have for this website. 

You can submit website reassessment by selecting "Web Address URL" and filling in the details. Once submitted, our labs' team will review the website, and the normal process will take 3-5 working days. 

I suggest checking the "Policy" section of the Sophos Endpoint Self Help tool. The timestamp shown next to "Sophos Web Control" should be updated once the policy changes have been received on the endpoint. 

If the timestamp looks okay, I suggest trying to navigate to the website using an incognito or in-private-browsing window to ensure that no cached information from the browser is causing issues.

If you wish for the website category to be changed on our end, you can proceed with the steps Glenn has suggested above. 

I've test what you suggest and the site is still blocked. We have the domain blocked in the list and are adding a more specific URL  to allow in the list is this not supported by the filter? 

May I ask if the website/subdomain looks like the following? 
- site.com
- web.site.com

Blocking site.com but allowing web.site.com will work.

If the subdomain you're trying to exclude is "site.com/example" this will not work.

That is precisely what is required. Consider a lot of sites are consolidating onto Amazon or Google Infrastructure - the same infrastructure is used by the distributors of malware and phishing attacks to host their sites. So to protect the Org I need to be able to block the entire subdomain and then only allow particular elements of the site.   For example firebasestorage.googleapis.com is used for malicious purposes as it is for legitimate sites. Google uses the subdirectory portion for routing to the appropriate customer. They use the same thing across a number of services like Forms, docs etc. The same happens with Amazon URLs. So as a customer this is a "nice to have" its a necessary element.