# Web content filtering blocks high-risk categories
When you don't block high-risk web content filtering categories like criminal activity, hacking, and illegal software, users who connect through Global…
Source: https://maester.dev/docs/tests/ZTA.27000
## Overview
When you don't block high-risk web content filtering categories like criminal activity, hacking, and illegal software, users who connect through Global Secure Access stay exposed to dangerous attack vectors and liability risks. These high-risk sites can distribute exploit code, malware-embedded software, and guidance on committing illegal acts that threat actors can use to compromise your environment.
Without this protection:
- Users can access sites that provide tools, scripts, and tutorials for unauthorized access, enabling threat actors to escalate their capabilities within the network.
- Pirated software and license key generators downloaded from illegal software sites frequently contain embedded malware that establishes persistence and enables lateral movement.
- The organization faces both security vulnerabilities and legal liability from uncontrolled access to high-risk content categories.
## Remediation
- [Configure web content filtering](https://learn.microsoft.com/entra/global-secure-access/how-to-configure-web-content-filtering?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to block high-risk web content categories **Criminal activity**, **Hacking**, and **Illegal software**.
- Review all available [Global Secure Access web content filtering categories](https://learn.microsoft.com/entra/global-secure-access/reference-web-content-filtering-categories?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
- [Create security profiles](https://learn.microsoft.com/entra/global-secure-access/how-to-configure-web-content-filtering?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-a-security-profile) to group filtering policies for Conditional Access enforcement.
- [Enable the Internet Access traffic forwarding profile](https://learn.microsoft.com/entra/global-secure-access/how-to-manage-internet-access-profile?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to route traffic through Global Secure Access for web content filtering to apply.
- [Link security profiles to Conditional Access](https://learn.microsoft.com/entra/global-secure-access/how-to-configure-web-content-filtering?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-and-link-conditional-access-policy) to enforce web content filtering for targeted users and groups.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Access control |
| ATT&CK | [T1189](/docs/tests?mitre=T1189) Drive-by Compromise, [T1204.001](/docs/tests?mitre=T1204.001) Malicious Link |
| Licence | Entra_Premium_Internet_Access |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.