Skip to main content
This article covers advanced techniques for refining GoGuardian Admin filtering policies.

​
Use Wildcard Rules

You can block or allow websites and URLs with keyword rules in the form of wildcards. When added to the Website URLs section of a policy, a wildcard (denoted by asterisks) blocks or allows a site if the keyword appears anywhere in the URL.
Every allowed or blocked website URL has an implicit wildcard at the end. Blocking or allowing website.com in a policy works the same as website.com*.
Examples of how to use wildcards:
  1. Keyword blocks: adding *proxy to the block list blocks any site with “proxy” in the URL.
  2. Multi-word keywords: adding *harry+potter blocks any URL for these terms, where + represents a single space.
  3. Sub-domain blocks: adding *.mlb.com to a block list keeps mlb.com accessible but blocks sub-domains such as yankees.mlb.com.
  4. Multi-word keywords with more than two wildcards: adding *unblocked*games blocks searches or URLs containing both terms in order, with any characters between them.
GoGuardian recommends adding these wildcards to the block list on a default policy: *proxy, *search*vpn, *bypass, *unblock, *agar, *slither, *splix, *sl4sh, *123movie, *putlocker.
Be careful blocking short keywords. Many URLs contain long strings of random letters, which can cause unexpected blocks — for example, blocking *games* blocks educational games sites that contain “games” in the URL. If a site is unintentionally blocked by a wildcard, add an allow rule to create an exception.

​
Block Google Images

To fully block Google Image searches, add the wildcards *tbm=isch and *udm=2 to your block list. Both strings are specific to Google Image searches.
Google.com cannot be directly allowed if you want to granularly filter Google content.

​
Filter Google Search Results

To keyword-filter specific Google search results, add a block rule in the format *search*term*, where “term” is the word you want blocked. For example, *search*snake blocks a search for “snake” but still allows sites that contain “snake” in the URL.
Google.com cannot be on the allow list if you want to keyword-filter specific Google searches.

​
Apply Multiple Policies and Policy Priority

You can apply multiple policies to a single OU. When both an Assigned (or locally added) policy and an Inherited policy apply to the same OU, the Assigned policy has higher priority. When you use more than one policy, GoGuardian recommends keeping school-wide Inherited policies less restrictive, then applying more restrictive or targeted policies to specific OUs. These examples show the outcome when both an Assigned and an Inherited policy apply to a user’s OU:
  • Example 1: The Social Networking category is blocked in an Assigned policy, but facebook.com is an allowed website (URL rule) in an Inherited policy. Facebook.com is blocked.
  • Example 2: The Social Networking category is blocked in an Inherited policy, but facebook.com is an explicitly allowed website in an Assigned policy. Facebook.com is allowed.
  • Example 3: The Social Networking category is allowed in an Assigned policy, but blocked in an Inherited policy. Facebook.com is blocked.
Comparing Examples 2 and 3 shows that an allowed website category does not carry the same weight as an explicitly allowed website in the Website URLs section of a policy. An allowed category simply means “not blocked” — it is not the same as an allow rule.

​
Multiple policies with Restrictive Mode

When an applied policy is set to Restrictive Mode, it no longer receives higher priority than an Inherited policy; both policies are weighted equally. For example, if an applied policy with Restrictive Mode enabled directly blocks amazon.com but an Inherited policy allows amazon.com, then amazon.com is allowed.

​
Note on GoGuardian DNS

GoGuardian DNS is a network-level, device-agnostic filtering solution. DNS filtering and the OU-based filtering from the GoGuardian extensions or app do not communicate: a website blocked through DNS cannot be allowed through an OU-level policy, and vice versa. To learn more, see DNS Filtering.
Last modified on August 10, 2026