Forcepoint False Positive: How to Recategorize a Blocked Website
To dispute a Forcepoint verdict, open the Site Lookup Tool on Forcepoint Support. Guests can use it without logging in. Add the URL, click Analyze, then Recategorization. The dropdown has no clean or safe option, so suggest the site's real content category and explain in the comment. Forcepoint's KB says its team will evaluate a request within 96 hours.
| Vendor | Forcepoint |
|---|---|
| Channel | Web form (owner submits; we prepare the text) |
| Where | Forcepoint Support → Site Lookup Tool → Recategorization |
| Account needed | None. Forcepoint's KB says non-customers can use it "as a guest (no login needed)". An email reply needs a free Forcepoint account. |
| Vendor states | The KB says: "the Forcepoint Security Labs team will investigate and evaluate your request within 96 hours. If the change is deemed appropriate, the change will be applied in the next database rollout." It also says the URL Database is built and released once per day. |
| What we have seen | Not enough data yet. |
What a Forcepoint flag looks like
Forcepoint LLC is headquartered in Austin, Texas. Its page for blocked visitors says: "If you've been denied access to a website because of Forcepoint, your organization is using our technology to apply its Internet use policy." It adds that you can ask your Help Desk or IT administrator to change a website's category, and that they can override the Forcepoint category. The block page says a security risk was blocked. The verdict also shows as the "Forcepoint ThreatSeeker" engine on VirusTotal.
Why clean sites end up flagged here
- Forcepoint's risk categories include Security: Malicious Web Sites, Security: Phishing and Other Frauds, and Security: Compromised Websites ("Sites that are vulnerable and known to host an injected malicious code or unwanted content").
- Its Extended Protection categories are Suspicious Content, Elevated Exposure and Newly Registered Websites. A clean new site could land in the last one (our reading; Forcepoint does not say this).
- Forcepoint's KB says: "If a website has been categorized as malicious, it is important to confirm the site is not compromised."
- A past compromise that has been cleaned, but was recorded before the cleanup (our reading; Forcepoint does not say this).
Where to submit: Forcepoint Support → Site Lookup Tool → Recategorization
https://support.forcepoint.com/s/site-lookup
Account: None. Forcepoint's KB says non-customers can use it "as a guest (no login needed)". An email reply needs a free Forcepoint account..
What it asks for:
- Add the URL (up to 10 per lookup), click Analyze, then click Recategorization
- Dialog "What is your suggestion?": shows the URL and its current URL Database and Real-time categories
- "Suggest:" dropdown (required)
- "Comments:" (required; "Please provide an explanation for your suggestion.")
- Guests only: a "Site Owner" checkbox plus an email field, required once ticked
- Submit
We read these fields from the page's code and have not seen a submission go through. The dialog says: "To receive an email response to this submission, please login for a free Forcepoint account."
Step by step
- Look the URL up. Open the Site Lookup Tool, add the URL (up to 10 per lookup) and click Analyze. Note the URL Database and Real-time categories it shows.
- Confirm the site is not compromised. Forcepoint's KB says that for a site categorized as malicious, it is important to confirm the site is not compromised. Remove anything flagged and note what was removed and when (our advice).
- Click Recategorization and pick a real category. In the "What is your suggestion?" dialog, use the "Suggest:" dropdown. It has no clean or safe option, so pick the category that matches what the site is, for example Business and Economy, Information Technology, Shopping, or News and Media.
- Write the comment and submit. "Comments:" is required: explain the suggestion. As a guest, tick "Site Owner" and enter your email if you are the owner. To get an email response you need a free Forcepoint account. Then click Submit.
- Submit each blocked URL, home page first. Forcepoint's KB says: "Forcepoint does not re-categorize websites at the domain level; they are re-categorized at the page level." So file each blocked URL, home page first (our advice).
- Look it up again after the next database release. The KB says the Forcepoint URL Database is built and released once per day. Run the Site Lookup Tool again after the next release. To check the VirusTotal verdict, reanalyze there.
What to write
Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.
URL: {full URL}
Current category: {category shown by the Site Lookup Tool}.
Suggested category: {real content category, e.g. Business and Economy}.
What the site is: {one-line description}.
{Either: 'The site was cleaned on {date}: {what was removed or secured}.' Or: 'This page has not hosted malware or phishing.'}
Please review this page's category.Why requests get rejected, and the fix
- The request was for a whole domain. Forcepoint's KB says it does not re-categorize at the domain level, only at the page level. Submit each blocked URL, home page first (our advice).
- The site may still be compromised. The KB says it is important to confirm that a site categorized as malicious is not compromised. Check the site and its subdomains, remove anything flagged, and say what was fixed in the comment.
- The suggested category does not match what the site is, or the comment explains nothing (our reading; Forcepoint states no rejection reasons). Pick the real content category, and use the comment to say what the site is and what changed.
Who copies this verdict
- VirusTotal shows Forcepoint's URL verdict as the "Forcepoint ThreatSeeker" engine.
- Forcepoint's KB lists Forcepoint Web Cloud, On-Prem, Hybrid and Content Gateway; Forcepoint ONE SSE Web and SmartEdge Agent; NGFW Engine; and Email. We do not say how each uses the category.
Sources
Open the Site Lookup Tool on Forcepoint Support, add the URL, click Analyze, then click Recategorization. Guests need no login. Suggest the site's real content category, explain in the comment and submit.
Forcepoint's KB says its Security Labs team will investigate and evaluate a request within 96 hours, and that an approved change is applied in the next database rollout. It adds that the database is released once per day. We do not have enough data yet to give an observed time.
The dropdown has no clean or safe option. Pick the category that matches what the site is, for example Business and Economy, Information Technology, Shopping, or News and Media. Use the comment to explain.
Forcepoint's page says that if you are denied access, your organization is using its technology to apply its Internet use policy. It says you can ask your Help Desk or IT administrator to change the site's category, and that they can override the Forcepoint category.