Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

YouTube Shorts Category Does Not Reliably Block Shorts

The YouTube Control feature relies on metadata provided by YouTube’s official APIs to categorize and enforce controls on video content. However, YouTube Shorts traffic is not consistently delivered through the standard video API endpoints that this categorization depends on.

Technical Explanation

YouTube Shorts uses multiple backend endpoints as part of YouTube’s newer API architecture, including:

  • youtube.com/youtubei/v1/reel
  • youtube.com/shorts

    When a user attempts to view a Short, YouTube may alternate between these endpoints. If one endpoint is unavailable or blocked, YouTube automatically retries using the other.

As a result, blocking only one of these endpoints is insufficient, and Shorts content may still load.

These endpoints:

  • Are part of YouTube’s newer, internal API framework
  • Do not always expose reliable metadata for the Shorts category
  • Are not consistently classified under the Shorts category received by Skyhigh from YouTube’s official APIs

Impact

Due to these architectural changes on YouTube’s side, the Block YouTube Shorts category may not reliably trigger enforcement, even when:

  • YouTube Control is enabled
  • HTTPS decryption is active
  • The Shorts category is explicitly selected for blocking

Recommended Workaround

To ensure Shorts are fully blocked, both endpoints must be explicitly blocked using Global Block Lists.

Configuration Steps

  1. Navigate to:
    Global Block → Global Block Lists → Domain Blocklist

  2. Add the following domains:

  • youtube.com/youtubei/v1/reel
  • youtube.com/shorts
  1. Save and publish the policy.

Result

By blocking both endpoints, YouTube Shorts traffic is consistently prevented, regardless of which backend API endpoint YouTube uses.

  • Was this article helpful?