That is a useful refinement, but its limits are as important as its convenience. Surfshark describes the feature as a category-based filtering control rather than a complete parental-controls suite or a measured anti-phishing system. The available material also leaves open important technical questions about classification accuracy, bypass resistance, synchronization mechanics, and the privacy architecture behind traffic matching.
What Surfshark says the Windows allowlist does
According to Surfshark’s September 14, 2026 announcement, the Windows update adds an allowed-websites list. A site placed on that list remains reachable even while the category to which Surfshark assigns it stays blocked for other websites.
This is an exception mechanism, not a general-purpose custom block list. Its value is in preserving a broad policy while resolving an individual false positive. A household might, for example, keep a category enabled while allowing a site needed for schoolwork. An individual user might similarly want scam- or phishing-related filtering left on without losing access to a legitimate site that appears to have been classified too broadly.
Surfshark’s Windows documentation describes two ways to create the exception:
- Go to Settings > Web content blocker > Allowed websites > Add, then enter a website URL.
- Select Unblock from a block notification when a site has already been stopped by the filter.
The second route should make the feature approachable: users can respond to a block as it happens rather than searching through settings. It also means the allowlist deserves the same care as any other account-level browsing policy. The reviewed material does not independently test the precise behavior of permission changes, including how an exception added through a Windows notification interacts with Surfshark’s account and security controls.
Windows-only applies to the new exception list
The Windows limitation is easy to misread. Surfshark says the newly announced allowed-websites list is for Windows users, but that does not mean web content filtering itself is exclusive to Windows.
Surfshark currently says its web content blocker works on unlimited Windows, macOS, iOS, and Android devices associated with an account. The company also says category filtering can function whether or not the Surfshark VPN is connected. Independent reporting corroborated that the original October 20, 2025 rollout began on Android and iOS, while Surfshark’s current materials describe support for Windows and macOS as well.
For people using several operating systems, the practical distinction is this: Surfshark claims category-level filtering coverage across those four platforms, while the site-specific allowlist announced in September 2026 is a Windows feature. No rollout date for an equivalent allowlist on macOS, iOS, or Android is established in the reviewed material.
Surfshark’s Windows support documentation says settings may take up to one hour to synchronize with Surfshark’s web application. That is the documented synchronization boundary. It does not establish that an allowlist entry made on Windows will propagate to another operating system, or that every device will apply the same exception in the same way. Anyone relying on a shared policy should test the Windows PC and each intended device rather than assume cross-platform parity.
Category filtering remains inherently imperfect
Surfshark’s announcement describes seven blocked categories. Its Windows support material, however, gives a broader, explicitly non-exhaustive description of blocked site types, including malicious, scam, phishing, adult, drug and tobacco, gambling, hate and profanity, and weapon-related websites.
Those descriptions do not prove one definitive current set of category labels or a precise number of selectable options in the Windows interface. The difference may reflect how categories are grouped, an evolution in the taxonomy, or a difference between product labels and examples. Until Surfshark supplies a more granular specification or the current app interface is checked directly, prospective users should treat this as category-based filtering rather than buy on the assumption of exactly seven controls.
More importantly, categories are not a guarantee of perfect classification. Surfshark’s stated coverage tells users what types of material it intends to restrict; it does not provide a published false-positive rate, detection rate, or bypass-resistance result. No independent technical test was located or published in the reviewed material for the blocker’s classification accuracy, malware or phishing detection performance, resistance to circumvention, or rate of incorrectly blocked legitimate sites.
That does not make the feature valueless. Broad filtering can reduce accidental exposure and stop obvious unwanted destinations without demanding a judgment call for every URL. But the reason an allowlist is useful is also the reason category filters need cautious expectations: legitimate sites can be swept into a broad classification, while undesirable sites may evade it.
For Windows users, the sound approach is to view the feature as one layer. It may complement browser protections, careful account security, safe-download habits, and age-appropriate household controls. It should not be described as a replacement for them.
Compatibility constraints can decide whether it works
The feature’s usefulness also depends on the network setup. Surfshark says another active VPN can prevent the web content blocker from working on Windows and macOS. That is especially relevant to people who use a work VPN, another consumer VPN service, or security software that creates a VPN-like network connection.
A Windows user whose expected blocks are not occurring should therefore check for a competing VPN connection before assuming the category settings themselves have failed. This limitation is material for work-from-home households: a filter that works during personal browsing may not behave the same way when a corporate tunnel is active.
Surfshark also says that Windows needs an internet connection to switch the feature on or off. In routine use, that may be inconsequential, but it matters during troubleshooting, travel, or an outage. The company’s stated synchronization delay—up to one hour with its web application—also argues against treating a changed switch in the interface as instant proof that every relevant setting has settled.
Android has a related but distinct constraint in Surfshark’s documentation. The company says the blocker can operate without an active VPN, but users who run the Surfshark VPN alongside it on Android must use WireGuard for the blocker to function. This is not a Windows configuration requirement. It is, however, relevant to families and individuals expecting broadly similar behavior on a Windows computer and Android devices.
Before relying on the feature for a child-access, school, or safety policy, it is sensible to perform a practical test: enable the relevant category, attempt to reach a site expected to be restricted, add a narrowly justified exception, and repeat the test under normal network conditions. People using work or third-party VPNs should include those connections in the test.
Privacy promises are not a technical audit of this feature
Filtering a website request requires some decision about the destination being requested. Surfshark’s Windows support page says the blocker automatically monitors traffic to determine when a website is restricted. Separately, Surfshark’s privacy policy says the company does not collect browsing history, visited IP addresses, network traffic, session information, connection timestamps, bandwidth, or similar online-activity information.
Those company statements are not necessarily inconsistent. A filtering product could inspect requests locally, or use a system that does not retain browsing records. But the reviewed public material does not explain enough of the implementation to establish that matching happens entirely on-device, identify whether any metadata is transmitted, or show how exceptions are stored and synchronized.
The correct boundary is therefore narrow. Surfshark makes a no-collection policy claim, but the reviewed material does not independently verify the privacy behavior or technical architecture of the September 2026 Windows allowlist.
Surfshark’s no-logs policy has received an independent reasonable-assurance engagement, completed in June 2025. Yet that engagement concerned VPN systems and supporting operations at that time. It did not provide assurance for later periods and excluded most web and API infrastructure. It cannot be treated as independent validation of a feature announced more than a year later.
This is not evidence that the blocker collects or mishandles browsing data. It is a reason not to turn a general privacy-policy promise or a prior VPN-focused audit into a stronger claim about the new filtering control than the evidence supports.
Eligibility and the promotional-price trap
Surfshark says web content blocker is included in its One and One+ bundles, rather than the Starter tier. That plan distinction is important because the company’s displayed US pricing can make the upgrade appear modest at first glance.
As displayed on September 15, 2026, Surfshark advertised Starter at an effective $2.49 per month and One at an effective $2.79 per month. These were not durable standard monthly prices: both were tied to an initial 27-month promotional term with three extra months. Surfshark also says VAT may apply and that prices can vary by currency and applied coupons. Renewal pricing, location, tax, offer availability, and subscription length can materially change the real comparison.
Potential subscribers should consequently compare the full checkout terms and renewal terms, not merely the 30-cent difference between two advertised effective rates. For an existing One or One+ subscriber, the new Windows exception list is a straightforward feature to try. For a Starter subscriber, the decision is whether a category filter—with Windows-only site exceptions, known VPN compatibility constraints, and no independent effectiveness testing located in the reviewed material—justifies the broader bundle and promotional commitment.
A helpful exception, not a complete control system
The allowed-websites list addresses a genuine weakness of broad web filters. It lets a Windows user keep a category active instead of abandoning the policy because one legitimate site was caught in it. That can make Surfshark’s blocker more usable for ordinary browsing and shared-PC scenarios.
The feature should nevertheless be evaluated for what it is: Surfshark’s category-based filtering service with individual Windows exceptions. Its platform coverage, category descriptions, plan eligibility, operating constraints, and privacy commitments are primarily company assertions, while independent news coverage corroborates the announcements rather than providing independent technical validation.
A careful Windows deployment means enabling only relevant categories, adding exceptions sparingly, allowing time for documented settings synchronization, and verifying that another VPN is not disrupting enforcement. Those steps can make the tool more useful. They do not eliminate the unresolved questions around classification quality, cross-platform exception behavior, or the technical handling of browsing data.