Technical Tip: Implications of having 'Allow websites when a rating error occurs' enabled or disabled on the FortiGate

FortiGate finds the hostname of the website during the SSL/TLS handshake phase and queries FortiGuard to identify the website category to take appropriate action as configured under the Web Filter profile configuration.

The 'Allow websites when a rating error occurs' option in the web filter profile determines how FortiGate handles web requests when it cannot retrieve a site’s category rating from FortiGuard servers.
This setting directly impacts the balance between security and availability during network, licensing, or FortiGuard service interruptions.

When this option is enabled, and the FortiGate fails to retrieve a web category rating from FortiGuard (due to network, licensing, or service interruption issues), the traffic will be permitted instead of being blocked. The setting is disabled by default in the default Web Filter profile and while creating a new Web Filter profile.

When disabled, if the FortiGate cannot retrieve a rating from FortiGuard, the website request is blocked by default.

Implications of having the option enabled:

1. The FortiGate effectively goes into a 'fail-open' state, temporarily bypassing web filtering controls. Traffic that would normally be blocked (e.g., adult, gambling, or malicious sites) may be allowed. However, all other UTM and security inspection features, such as IPS, Antivirus, Anti-Botnet, and Application Control, continue to operate normally. The rating error event is still recorded in the FortiGate web filter logs; refer to FortiGuard web filter error logs.
2. Newly registered or unknown domains could be accessed, potentially leading to threats such as phishing or malware.
3. May violate organizational or regulatory compliance if unrated or high-risk categories are not filtered.
4. These options help maintain the user connectivity. The legitimate websites will remain accessible during a FortiGuard outage or temporary disruption.

5. This option helps maintain connectivity in scenarios where FortiGuard-based services are enabled without a valid license.

Implication of having the option disabled:

1. It provides stronger protection by preventing access to potentially malicious or unknown sites. 
2. The rating lookup failures cannot be exploited to bypass the policy.
3. Provides continuous compliance for environments with stringent security policies.
4. There may be a service disruption, and legitimate websites may be blocked during temporary FortiGuard connectivity issues.

Note: In the newest FortiGate firmware versions, this option will look like the following:

To view the configuration options of a Web Filter profile, refer to Configuring Web Filtering on FortiGate: Web filter.

In Webfilter logs, the action will change to passthrough.

date=2026-02-19 time=15:42:01 eventtime=1771472521257936693 logid="0318012800" type="utm" subtype="webfilter" eventtype="ftgd_err" level="error" vd="root" policyid=22 poluuid="c9a8317c-dfc7-51f0-ff01-c9f5492ae286" policytype="policy" sessionid=7895432 srcip=10.202.x.x srcport=61252 srccountry="Reserved" srcintf="port3" srcintfrole="undefined" srcuuid="cc28d636-984b-51f0-fc8b-fc84df058009" dstip=163.70.132.35 dstport=80 dstcountry="Malaysia" dstintf="port1" dstintfrole="wan" dstuuid="cc28d636-984b-51f0-fc8b-fc84df058009" proto=6 httpmethod="GET" service="HTTP" hostname="facebook.com" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0" profile="g-default" action="passthrough" reqtype="direct" url="http://facebook.com/" sentbyte=341 rcvdbyte=0 direction="outgoing" msg="A rating error occurs" error="all Fortiguard servers failed to respond"

Webfilter logs with the default action will show as 'block'. 

date=2026-02-19 time=15:41:39 eventtime=1771472498386699520 logid="0318012800" type="utm" subtype="webfilter" eventtype="ftgd_err" level="error" vd="root" policyid=22 poluuid="c9a8317c-dfc7-51f0-ff01-c9f5492ae286" policytype="policy" sessionid=7894608 srcip=10.202.x.x srcport=61200 srccountry="Reserved" srcintf="port3" srcintfrole="undefined" srcuuid="cc28d636-984b-51f0-fc8b-fc84df058009" dstip=163.70.132.35 dstport=80 dstcountry="Malaysia" dstintf="port1" dstintfrole="wan" dstuuid="cc28d636-984b-51f0-fc8b-fc84df058009" proto=6 httpmethod="GET" service="HTTP" hostname="facebook.com" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0" profile="g-default" action="blocked" reqtype="referral" url="http://facebook.com/favicon.ico" referralurl="http://facebook.com/" sentbyte=293 rcvdbyte=0 direction="outgoing" msg="A rating error occurs" error="all Fortiguard servers failed to respond"