Web Content Gateway (WCG)

The Web Content Gateway (WCG) is a security feature inside the Moftgate agent that sits between the user’s browser and the internet. It inspects web traffic - including encrypted HTTPS - and enforces your organization’s web and data-loss-prevention (DLP) policies on the actual content being sent and received, not just on URLs.

Because WCG can see inside encrypted traffic, it can do things URL filtering alone cannot: detect sensitive data being uploaded through a browser, block unapproved cloud storage services, limit SaaS access to approved tenants, throttle bandwidth-heavy sites, and coach users with in-page warnings. It is the web enforcement layer of your DLP strategy.

Close image

WCG is enabled per agent profile. When you turn it on, every endpoint assigned to that profile automatically starts the local proxy on its next heartbeat - no manual setup is required on the endpoint itself.

1. 1
   Confirm your DLP license is active

   WCG is part of the DLP module. Make sure your organization has an active DLP license on the endpoint that should receive WCG protection.

2. 2
   Open the agent profile

   In the Moftgate panel, navigate to the agent profile assigned to the endpoint (or group of endpoints) you want to protect.

3. 3
   Turn on Web Content Gateway

   Enable the WCG toggle inside the profile. This tells the agent to start the local proxy, install the trusted certificate, and route browser traffic through it.

4. 4
   Save and wait for the next heartbeat

   Save the profile. On the next agent heartbeat the endpoint receives the updated profile, starts the proxy, and begins enforcing your web and DLP policies automatically - no reboot or user action required.

WCG provides a set of policy-driven features that work together to control what leaves the endpoint through the browser. Each feature is configured from the Moftgate panel and enforced by the agent - the proxy is the enforcement point, the panel is the control plane.

How WCG protects against data exfiltration

Data exfiltration through the web channel happens when sensitive information leaves the endpoint via browser uploads, form submissions, or unapproved cloud services. WCG closes these channels by inspecting the actual content of web traffic:

• Blocks uploads to unapproved cloud storage and file-sharing sites (Shadow IT Control).
• Detects sensitive data in web form submissions and uploads before it leaves the endpoint (Web DLP).
• Restricts SaaS access to approved tenants so data cannot be moved into unmanaged workspaces (Tenant Restriction).
• Blocks access to disallowed apps and websites with a clear policy block page (App/Web Block).
• All inspection happens on the decrypted content, so policies see the real payload - not just the URL.

WCG works as a local man-in-the-middle (MITM) proxy on the endpoint. It decrypts HTTPS traffic, inspects the content, enforces policy, and re-encrypts it before sending it to the destination. Here is the high-level flow:

1. 1
   A trusted certificate is installed

   When WCG starts, the agent generates a local root certificate and installs it into the operating system’s trust store. Firefox is also configured to trust the system certificates. This happens automatically - no manual import is needed.

2. 2
   Browser traffic is routed through the proxy

   The agent sets the system proxy so that all browser traffic flows through the local WCG proxy. On Windows this covers per-user settings; on macOS it covers all network services; on Linux it covers both desktop environment and system-wide settings.

3. 3
   HTTPS traffic is inspected

   Because the browser trusts the installed certificate, WCG can decrypt HTTPS traffic on the fly, inspect the plaintext content, and re-encrypt it before sending it to the destination.

4. 4
   Policies are enforced on the content

   WCG applies your web and DLP policies to the decrypted content - blocking, throttling, warning, or logging as configured. Policies are fetched from the panel and applied live, without restarting the proxy.

5. 5
   QUIC is blocked to keep traffic inspectable

   QUIC (HTTP/3) runs over UDP and bypasses the proxy. WCG blocks outbound UDP on ports 443 and 80 so browsers fall back to TCP-based HTTPS, which the proxy can inspect.

Trusted certificate installation

For the browser to accept the decrypted traffic without warnings, WCG installs a trusted root certificate into the operating system’s trust store. This is done automatically when WCG starts, and applies per user so that multiple users on the same device are isolated.

System proxy configuration

After the certificate is installed, WCG redirects browser traffic through the local proxy by setting the system proxy. The configuration is handled automatically per operating system and restored to the original settings when the proxy stops.