What is a secure web gateway?
A secure web gateway (SWG) sits between users and the internet and decides what happens to each web request. It acts as a forward proxy: the browser's request goes to the gateway, the gateway checks it against the organization's acceptable use and threat policies, and only then fetches the page or file on the user's behalf. Every request is tied to a user and logged. SWGs grew out of web proxies and URL filters, and today they run either as appliances in a data center or as a cloud service, where the SWG is one of the core components of security service edge (SSE).
What an SWG checks
- URL categories and reputation: block gambling, adult content, known phishing and malware sites, and domains registered only days ago.
- Downloads: scan files with antivirus engines and send unknown executables or documents to a sandbox before releasing them.
- Application control: allow a webmail or storage service but block uploads, posting or file sharing within it.
- Data loss prevention: inspect uploads and form submissions for card numbers, Social Security numbers or labeled documents.
- Logging: record user, device, URL, category and action for investigations and reports.
Encrypted traffic
Almost all web traffic is HTTPS. Without decryption, the gateway sees little beyond the server name in the TLS handshake, which is enough for category blocking but not for malware scanning or DLP. Full inspection requires TLS interception: the gateway ends the user's TLS session, inspects the content and opens a second session to the site. Managed devices trust the certificates the gateway presents because the organization installs the gateway's signing root CA on them. Policies usually exempt categories such as banking and health care for privacy and legal reasons, and apps that pin certificates need bypass rules or they fail.
Example: a phishing link stopped at the gateway
A user clicks a link in a fake invoice email. The gateway log records what happened:
2026-10-22T09:14:51Z user=mlopez action=block category=newly-registered-domain host=invoice-portal-update.example.net domain_age=2d rule="Block domains under 30 days old"
The page never loads, so the credential-harvesting form never reaches the user. The security team then searches the gateway logs for other users who requested the same host and checks whether anyone reached it from an unmanaged device that the gateway doesn't cover.
Deployment options
An on-premises SWG serves users inside the building; browsers find it through explicit proxy settings or a PAC file, or traffic is redirected to it transparently. A cloud SWG serves everyone, using an endpoint agent or tunnels from branch routers. Either way, decide what happens when the gateway is unreachable: failing open keeps people working without inspection, while failing closed blocks browsing until the service returns.
SWG vs. firewall, WAF and CASB
- Next-generation firewall: enforces rules on all ports and protocols at the network edge; an SWG specializes in users' outbound web traffic.
- Web application firewall (WAF): a reverse proxy that protects your own web applications from inbound attacks; an SWG protects your users going out.
- CASB: controls data and activity inside specific SaaS services and can scan a tenant through its API; an SWG filters web requests in general.
- DNS filtering: blocks bad domains at lookup time, but can't inspect pages, files or uploads.
Secure web gateway on the CompTIA Security+ exam
SWGs are taught under SY0-801 objective 3.2, which covers managing the security architecture, as a core component of security service edge. The same filtering ideas, forward proxies and content filters, also come up under objective 4.1, which covers mitigating controls. Wording such as "filter and log web browsing for remote employees without sending traffic through the VPN", "block newly registered domains" or "scan downloads before users receive them" points to an SWG. Distractors include a WAF, which faces inward to protect web servers; a reverse proxy; a CASB, when the scenario is about general browsing rather than one SaaS tenant; and a basic port-based firewall rule, which can't apply URL categories or DLP.