ASD ISM 1171Block Direct IP Access to Websites
Official control statement
Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Web filters prevent website access if using an IP address instead of a domain name.
What this means in practice
This control means stopping people from visiting websites using IP addresses instead of the usual website names. It's important because some bad actors try to bypass security filters by using these numerical addresses directly, which could lead to data theft or malware infections.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Mar 2022
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for gatewaysSection
Web content filtersTopic
Allowing and blocking access to domain names
Why it matters
By blocking direct IP access, organisations prevent attackers from bypassing DNS-based content filters, reducing exposure to phishing and malware sites.
Operational notes
Keep web filter rules current; ensure IP-based URL requests are blocked, logged, and reviewed so attempts to bypass domain filtering are detected.
Implementation tips
- IT teams should set up web content filtering tools. Choose a reliable web filtering service that specifically blocks direct IP address usage and configure it to treat attempts to access websites by IP as red flags.
- System administrators should carry out regular tests. Use sample IP addresses of known websites to ensure that attempts to access them directly are indeed blocked by the filtering system.
- Business managers should work with the IT team to ensure blocked access policies are communicated effectively. Clearly inform all staff that accessing websites using IP addresses is against company policy and part of the security measures.
- HR should include training on secure browsing habits. Implement regular training sessions that explain the risks of navigating to sites using IP addresses and educate staff on the filtering mechanisms in place.
- Procurement teams should ensure that any new web filtering software purchased supports IP blocking. When evaluating new systems, confirm they offer robust IP filtering and request demonstrations from vendors.
Audit / evidence tips
- AskProof of the web content filter settings: Request screen captures or reports from the web filter administration interfaceLook atSettings specifically designed to block direct IP accessGoodClear evidence showing a configured rule that blocks IP-based web access
- AskRecent log reports of blocked IP access attempts: These should be logs generated by the web filtering systemLook atEntries that show attempted IP-based access and successful blockingGoodIs a detailed log with timestamps, source IPs, and actions taken
- AskDocumentation or memo on policy communication: Request the internal memo or policy document circulated to staff regarding web access rulesLook atHow the policy is communicated and its clarityGoodIncludes a formally distributed document with a clear explanation of the rules
- AskTraining records: Request records or sign-in sheets from training sessions conducted about the controlLook atEvidence that employees have attended training and understood the contentGoodIs a dated record showing attendees and training outlines
- AskVendor evaluation documents: Request the criteria or checklists used when purchasing web filtering solutionsLook atThe emphasis on the ability to block IP access in the requirementsGoodIncludes detailed evaluations that explicitly mention IP blocking capabilities
Cross-framework mappings
How ISM-1171 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.23 | ISM-1171 requires web content filters to block attempts to access websites via direct IP address rather than by domain name | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Gateways
See all Guidelines for gateways controls, or browse the full ASD ISM library.