Chapter 15 Unified Threat Management for FortiOS 5.0 : Web filter : Web content filter : How content is evaluated
  
How content is evaluated
Every time the web content filter detects banned content on a web page, it adds the score for that content to the sum of scores for that web page. You set this score when you create a new pattern to block the content. The score can be any number from zero to 99999. Higher scores indicate more offensive content. When the sum of scores equals or exceeds the threshold score, the web page is blocked. The default score for web content filter is 10 and the default threshold is 10. This means that by default a web page is blocked by a single match. Blocked pages are replaced with a message indicating that the page is not accessible according to the Internet usage policy.
Banned words or phrases are evaluated according to the following rules:
The score for each word or phrase is counted only once, even if that word or phrase appears many times in the web page.
The score for any word in a phrase without quotation marks is counted.
The score for a phrase in quotation marks is counted only if it appears exactly as written.
The following table describes how these rules are applied to the contents of a web page. Consider the following, a web page that contains only this sentence: “The score for each word or phrase is counted only once, even if that word or phrase appears many times in the web page.”
Table 95: Banned Pattern Rules  
Banned
pattern
Assigned
score
Score added to the sum for the entire page
Threshold score
Comment
word
20
20
20
Appears twice but only counted once. Web page is blocked.
word phrase
20
40
20
Each word appears twice but only counted once giving a total score of 40. Web page is blocked
word sentence
20
20
20
“word” appears twice, “sentence” does not appear, but since any word in a phrase without quotation marks is counted, the score for this pattern is 20. Web page is blocked.
“word sentence”
20
0
20
“This phrase does not appear exactly as written. Web page is allowed.
“word or phrase”
20
20
20
This phrase appears twice but is counted only once. Web page is blocked.