topic Re: Custom URL Category Path Matching Behavior (Prefix vs Exact Match) in Next-Generation Firewall Discussions

Custom URL Category Path Matching Behavior (Prefix vs Exact Match)

T.Shimada291937 — Mon, 16 Mar 2026 06:34:34 GMT

Attention: Global TPM team

When aaa.bbb.com/ddd is added to a Custom URL Category,

will aaa.bbb.com/dddxxx also be allowed as a prefix match?

Or is aaa.bbb.com/ddd treated as a specific web page and therefore matched by exact match only?

Best Regards,

Re: Custom URL Category Path Matching Behavior (Prefix vs Exact Match)

abayoumi21 — Sun, 29 Mar 2026 08:53:09 GMT

The URL aaa.bbb.com/ddd is treated as an exact match in a Custom URL Category and does not automatically match prefixes such as aaa.bbb.com/dddxxx.

Explanation

In Palo Alto Custom URL Categories, URL entries are matched based on how they are defined:

• When you configure aaa.bbb.com/ddd, it is treated as a specific path.
• It will match only that exact URL (or very close variants depending on normalization), but not arbitrary prefixes like dddxxx.

How to Allow Subpaths / Prefix Matching

If you want to allow all subdirectories or variations under that path, you should use a wildcard:

Example:

aaa.bbb.com/*

This will match:

• aaa.bbb.com/ddd
• aaa.bbb.com/dddxxx
• aaa.bbb.com/anything

Best Practice

• Use specific paths when you want tight control
• Use wildcards (*) when you want broader matching

Summary

aaa.bbb.com/ddd is treated as a specific match, not a prefix. To allow subpaths or variations, you should use a wildcard such as aaa.bbb.com/*.

Re: Custom URL Category Path Matching Behavior (Prefix vs Exact Match)

ozheng — Mon, 30 Mar 2026 03:24:19 GMT

Hello @T.Shimada291937 ,

As per https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering/url-category-exceptions/guidelines-for-url-category-exceptions , I would assume it is exact match.

Olivier