Frequently Asked Question

Some websites use HSTS (HTTP Strict Transport Security). When you block this type of websites via a custom Web-filter, users may encounter two different situations depending on the browsing history of the device being used.

Take facebook.com as an example.

• Situation 1: The device has already accessed facebook.com before.
  After the Web-filter has been applied to this device, if users try to visit facebook.com, their browser will display a page notifying that the connection is not secure, and users will not be able to proceed to this website. Below is an example using Firefox on a PC (actual message may vary with browser and device).


• Situation 2: The device has never accessed facebook.com before.
  After the Web-filter has been applied to this device, users will be directed to the "Oops! Website blocked!" page when they try to visit facebook.com.

How do I know if a website uses HSTS?

Well-known websites that use HSTS include Google, Facebook, Twitter, PayPal, and Dropbox. You can find out if a website uses HSTS by following the steps below:

1. Launch Google Chrome.
2. Type chrome://net-internals/#hsts into the address bar, and then hit Enter on the keyboard.
3. Under the section Query domain, enter a domain name into the Domain field, and then click Query.
4. If the result is Found, it means the website uses HSTS.

Additionally, you will also know that a website uses HSTS when you encounter the following situation:

1. As you try to connect to a secure website (URL begins with https://), you see an "insecure connection" message.
2. You find out that you are not able to proceed to the website. This means the website uses HSTS.

What if I still want the "Oops! Website blocked!" page to pop up when connecting to a blocked website using HSTS?

You should wait until the HSTS expiration time of the website elapses before you try to load the web page again. The expiration time varies with website.