Website filtering can be enforced at four points in a request’s lifecycle. What each layer sees, what routes around it, and why network filters miss traffic.