Your company blocks file transfer sites. Here is what is actually happening

You try to upload a file at work and the page will not load, or it loads and the upload fails at 0%. This is not a glitch and it is not the site being down. Three different systems could be doing it, and which one it is changes what you should do next.

What is blocking you

Category-based web filtering. The simplest layer. A proxy or firewall matches the domain against a commercial category list — "File Sharing and Storage" is a standard category — and refuses the connection. You get a block page, often with the category named on it. This one is honest about itself.

Data Loss Prevention (DLP). More selective and much less visible. The page loads normally, you pick your file, and the upload fails or silently truncates. DLP inspects what is leaving and blocks by content: card numbers, national ID patterns, documents with a confidentiality label, anything matching a fingerprint of internal material. The block is on the file, not the site — which is why the same site worked yesterday with a different file.

TLS inspection. The corporate proxy terminates HTTPS, examines the plaintext, and re-encrypts with an internal certificate the managed device trusts. This is what makes the two layers above possible on encrypted traffic. It also means "it is HTTPS so nobody can see it" is not true on a managed network: your employer can see it, by design and usually by policy you agreed to.

Why it exists

It is worth understanding rather than resenting, because it changes what a reasonable request looks like. Three drivers, roughly in order of weight:

• Exfiltration. Consumer transfer sites are the most common route for data to leave a company, whether deliberately or through carelessness. Blocking the category is the cheapest control that addresses it.
• Compliance. In regulated sectors the organisation must be able to demonstrate where data went. A file sent through a personal account is a hole in that record, regardless of intent.
• Inbound malware. Files arriving through unmanaged channels bypass the mail gateway that scans everything else.

What not to do

Personal hotspot, VPN, a different port, a site that is not on the list yet — these work often enough to be tempting and are close to always the wrong move. Two reasons, and the second is the one that matters.

The first is that the attempt is logged. DLP and proxy systems record blocked and circumvented attempts, and deliberate circumvention reads very differently in a review than an honest failed upload. In many organisations it is a disciplinary matter in its own right, independent of what the file was.

The second is that the control is usually right. If a file is significant enough that you need it out of the building today, it is significant enough that the company has an opinion about how it leaves. Routing around the control does not make you wrong about the urgency; it makes you the person who moved company data through an unlogged channel.

What to do instead

1. Use the sanctioned system. Nearly every organisation with a block has a paid alternative — SharePoint or OneDrive with external sharing, Box, Egnyte, a managed SFTP. It is usually already licensed and usually nobody told you.
2. Email it if it fits. The mail gateway is a monitored, approved channel. Under about 20 MB this is the path of least resistance — see attachment size limits.
3. Ask IT to allowlist the specific destination. A concrete request — this domain, this recipient, this business reason — is a normal ticket and often turned around the same day. "The internet is blocked" is not.
4. Ask the recipient to send you a link instead. Inbound is frequently permitted where outbound is not, because the risk is asymmetric. Reversing the direction solves a surprising number of these.
5. Shrink the file so email works. Often the fastest fix of all — re-encoding a video or compressing what actually compresses can put it under the limit.

If you are on the other side of it

When a partner or client cannot receive from you because their employer blocks it, the same logic applies in reverse and the fix is the same: send to their sanctioned system, or let them pull rather than you push. Sending a personal-account link to someone in a regulated organisation frequently puts them in an awkward position even when it arrives.

More guides