How to block a URL or domain in Zscaler ZIA
For most cases, add the domain to a custom URL category, reference that category in a URL filtering rule with the action Block near the top of your policy, and activate the change. Use a leading dot (.example.com) to cover subdomains. For non-web protocols use DNS control, and for IP addresses use the cloud firewall.
Pick the right mechanism
| Mechanism | Blocks | Best for |
|---|---|---|
| Custom URL category + URL filtering rule | Web traffic (HTTP and HTTPS) to matching hosts or paths | Most blocks. Easy to audit, easy to reverse, can be scoped to users or groups |
| DNS control rule | Name resolution for the domain, whatever the protocol | Malware call-home and non-web traffic, as long as DNS goes through Zscaler |
| Advanced Threat Protection malicious URL list | URLs treated as known-malicious | Confirmed threat indicators you want handled as threats, not policy |
| Cloud firewall rule | IP addresses, optionally by port and protocol | Raw IPs and non-web services |
Block with a custom URL category
- Create a custom URL category for the blocks (one shared category is easier to manage than one per incident) and add the host.
- Create a URL filtering rule with the action Block that references the category, and place it above any rule that would allow the site. ZIA evaluates URL filtering rules in order and the first match wins.
- Activate the configuration. ZIA stages changes until activation.
URL entry syntax
| Entry | Matches |
|---|---|
example.com | Only example.com itself |
.example.com | example.com and every subdomain (www., login., ...) |
example.com/path | That path. On HTTPS sites this needs SSL inspection, because without it Zscaler only sees the host name |
Why a blocked URL can still load
- Not activated. The rule exists but isn't enforced yet.
- Rule order. An allow rule above the block rule matches first.
- Entry doesn't match.
example.comdoesn't coverwww.example.com; use.example.com. - HTTPS path without inspection. Path entries need SSL inspection to see the path.
- Traffic bypasses Zscaler. The device isn't forwarding through Zscaler (Client Connector off, an exempted network, or a PAC or forwarding-profile exception).
- Cached responses or DNS. Retest in a fresh browser session.
How Zmate does this from Slack
/zmate url-block <host> blocks the host for everyone, live as soon as a Zmate admin confirms. /zmate threats add and /zmate firewall block handle known-malicious URLs and IP addresses, and each has an undo. For a site you're unsure about, /zmate investigate-url checks it first and offers Block as a button.
FAQ
- Why is a URL I blocked in Zscaler still loading?
- The most common causes: the change wasn't activated, an allow rule sits above your block rule, the entry doesn't match the host (example.com doesn't cover www.example.com; use .example.com for subdomains), you blocked a path on an HTTPS site without SSL inspection, or the traffic isn't going through Zscaler at all.
- How do I block a domain and all its subdomains in Zscaler?
- In a custom URL category, enter the domain with a leading dot, for example .example.com. That matches example.com and every subdomain. Without the dot, the entry matches only that exact host.
- Do I need to activate changes in Zscaler ZIA?
- Yes. ZIA policy changes are saved but not enforced until the configuration is activated. Every block, allow or category change needs an activation to take effect.