Skip to main content

Browser controls

Browser controls are technical enforcement mechanisms that operate at the browser level. Unlike safeguards that respond to specific activities, browser controls apply persistent configurations to the browser itself.

Browser controls are available for policies in the Browser Control category.

Overview​

Browser controls provide:

  • HTTPS enforcement — Force secure connections
  • Copy redaction — Prevent copying sensitive content
  • Paste redaction — Block pasting into specific fields
  • Permission blocking — Block access to camera, mic, geolocation, notifications
  • Session controls — Manage browser sessions
  • Credential reuse prevention — Detect password reuse

Enforce HTTPS​

Force HTTPS connections to ensure encrypted communication.

Configuration​

SettingDescription
Main frameEnforce HTTPS for the main page
Sub frameEnforce HTTPS for embedded content (iframes)

Use cases​

  • Ensure all corporate resources use HTTPS
  • Block mixed content on sensitive pages
  • Enforce encryption for specific domains

Example configuration​

Domains: *.company.com
Main frame: Enabled
Sub frame: Enabled

Redact copy​

Prevent users from copying content from specific elements on a page. Uses data selectors to target content containing sensitive information.

Configuration​

SettingDescription
Data selectorsSelectors that identify sensitive data types to redact on copy

Data selector examples​

# Social security numbers
ssn

# Credit card numbers
credit_card

# Account numbers
account_number

# Multiple selectors
ssn, credit_card, phone_number

Use cases​

  • Prevent copying SSNs or account numbers
  • Protect PII on HR applications
  • Secure sensitive financial data

Redact paste​

Prevent users from pasting content into specific fields. Uses data selectors to identify fields that should block paste operations.

Configuration​

SettingDescription
Data selectorsSelectors that identify fields to block paste

Data selector examples​

# Password fields
password

# Credit card fields
credit_card

# Sensitive input fields
ssn, account_number

Use cases​

  • Block paste into password fields
  • Prevent pasting credit card numbers
  • Enforce manual entry for verification

Block permissions​

Block browser permission requests for specific capabilities.

Available permissions​

PermissionDescription
GeolocationBlock access to user location
CameraBlock access to camera
MicrophoneBlock access to microphone
NotificationsBlock notification requests

Use cases​

  • Prevent sites from requesting location data
  • Block camera/mic access on untrusted sites
  • Reduce notification spam

Example configuration​

Domains: *
Exclude: meet.google.com, teams.microsoft.com
Permissions: Camera, Microphone, Notifications

Session controls​

Manage browser session state for specific domains or locations.

Configuration​

SettingDescription
ValueSession token or identifier

Use cases​

  • Enforce session policies
  • Manage authentication tokens
  • Control session persistence

Credential reuse prevention​

Detect when users enter credentials that match known corporate passwords on untrusted sites. For the full feature explanation, including how Keep Aware handles password data, see Credential Reuse.

Configuration​

SettingDescription
Inclusion listHostnames Keep Aware learns credentials from
ActionsWhat to do when reuse is detected
MessageCustom message shown to the user

Actions​

  • Log — Record the event for reporting and investigation, without interrupting the user.
  • Pause — Disable form submission and display the message; the user can edit and retry.
  • Block — Disable form submission and the surrounding fields; the user cannot retry on this attempt.

Use cases​

  • Detect password reuse on phishing sites and lookalike domains.
  • Catch corporate password reuse on personal or unmanaged services.
  • Enforce password hygiene across the workforce.

Conditions​

Browser controls can be applied conditionally based on domains.

Include conditions​

Apply controls only to matching domains.

Include domains: *.financial.com, banking.corp.com

Exclude conditions​

Exempt specific domains from controls.

Exclude domains: trusted-partner.com, *.internal.corp.com

Condition logic​

  • Controls apply to included domains
  • Controls do NOT apply to excluded domains
  • Exclude takes precedence over include

Creating a browser control policy​

  1. Navigate to Policies in the console
  2. Click Create policy
  3. Set Category to Browser Control
  4. Set Conditions (include/exclude domains)
  5. Expand Browser Controls section
  6. Enable and configure desired controls:
    • Toggle Enforce HTTPS
    • Add Redact copy data selectors
    • Add Redact paste data selectors
    • Select Block permissions
    • Configure Session controls
    • Set up Credential reuse detection
  7. Assign to profiles
  8. Save

Example policies​

Enforce HTTPS on corporate sites​

Category: Browser Control
Include domains: *.company.com
Controls:
  - Enforce HTTPS: Main frame + Sub frame
Profiles: All Employees

Block permissions on all sites except trusted​

Category: Browser Control
Include domains: *
Exclude domains: meet.google.com, teams.microsoft.com, zoom.us
Controls:
  - Block permissions: Camera, Microphone, Geolocation, Notifications
Profiles: All Employees

Protect PII on HR applications​

Category: Browser Control
Include domains: hr.company.com, workday.com
Controls:
  - Redact copy: ssn, employee_id, salary
  - Redact paste: password
Profiles: HR Team

Credential reuse detection​

Category: Browser Control
Controls:
  - Credential reuse:
      Inclusion list: sso.company.com, okta.com
      Actions: Log, Pause
      Message: "You may be entering your corporate password on an external site."
Profiles: All Employees

Best practices​

  1. Start narrow — Apply controls to specific domains first, then expand

  2. Test data selectors — Verify selectors work before deploying widely

  3. Use exclusions wisely — Exclude trusted sites that need permissions

  4. Combine with safeguards — Use browser controls for technical enforcement and safeguards for user awareness

  5. Monitor impact — Review events to ensure controls aren't blocking legitimate activity

  6. Layer defenses — Use multiple control types for defense in depth

Table of Contents