The Great Firewall: What It Blocks and How to Cope

A block is loud. Somebody in the office notices, and it gets fixed. The failure that costs you money is the quiet one: the host answers, the first byte arrives in half a second, and then the request simply never finishes.

Wix returned a first byte in a median of 532ms and then finished 0 of 3 page loads inside 60 seconds, measured from an Alibaba Cloud (阿里云) instance in cn-zhangjiakou on 30 August 2026. Source: 21YunBox, Does Wix Work in China?, August 2026, page reviewed 7 October 2026. https://www.21cloudbox.com/support/wix-china.html

Put a widget that behaves this way on a page and the page around it renders normally. The widget stays empty, and nothing anywhere logs an error. So a team outside China can look at the site every morning for a year and see nothing wrong.

Underneath sits the machinery everyone writes about: poisoned DNS, blocked IP ranges, packet contents read in real time. The firewall hunts VPN signatures too, and a default WordPress install carries several dependencies that meet it. All of that is real. Almost none of it is what costs you enquiries. The open socket nobody is watching does that.

How the Great Firewall actually works

Five systems running in parallel. They catch different things at different levels.

DNS poisoning is the most basic layer. When someone in China requests a blocked domain, the firewall returns a wrong IP address. The request doesn’t time out. It goes somewhere it shouldn’t. The user sees an error or a blank and has no idea why.

IP blocking is cruder. Entire IP ranges tied to known foreign services get cut off at the network level. Get past DNS poisoning with an alternate resolver and you still can’t connect because the IP itself is blocked.

Deep Packet Inspection is the layer that matters most. The system reads what’s inside the packets, going past the destination header. If the content matches flagged patterns, the connection gets killed mid-transfer. This is what makes China’s firewall a different animal from simpler national filtering systems.

Deep Packet Inspection reads the contents of your traffic at the payload level. That’s the layer that makes the Great Firewall fundamentally harder to bypass than anything else out there.

URL filtering works at the page level. A domain might stay accessible, but specific URLs with certain keywords get filtered. Surgical filtering at the page level.

VPN detection is the newest addition. The firewall identifies VPN protocols by their traffic signatures and throttles or blocks them. A consumer VPN that worked reliably two years ago may not connect at all today. The system keeps getting better at recognising them.

What’s blocked (and why it breaks your website)

Foreign companies tend to focus on the political side of the Great Firewall. What actually matters for your website is the technical dependencies.

Google search, Gmail, Maps, YouTube and Google Ads do not work from a mainland connection. Google Analytics is the one that matters for a website, and it is in the table below with its test date, like everything else on this page. www.google-analytics.com last failed a GreatFire test on 24 July 2026. Fire the tag from a page in China and the beacon never arrives, so the data is lost whether or not the container script loaded.

Google Fonts is the exception, and people get it wrong in both directions, so it gets an extra paragraph.

From an Alibaba Cloud (阿里云) instance in cn-zhangjiakou on 28 August 2026, sampled every ten minutes for twelve hours, fonts.googleapis.com completed 72 of 72 requests at a median 111ms to first byte. From a Beijing China Mobile (中国移动) residential line on 30 August 2026, across 264 page loads, the same host answered 0 of 54. Source: 21YunBox, A Chinese Cloud Probe Is Not a Chinese Visitor: The Same Hosts, Opposite Answers, August 2026. https://www.21cloudbox.com/a-day-of-third-party-requests-from-inside-china.html

Neither flat version of that claim survives the pair. Google Fonts resolves from mainland datacentres and frequently does not resolve on consumer connections, which is the whole argument for self-hosting: you remove a variable that changes by network, by resolver and by hour. fonts.google.com, the browsing interface, is a separate host: GreatFire read it 100% disrupted on its last two conclusive tests, the latest on 30 September 2026.

Facebook, Instagram, WhatsApp, Messenger. All blocked. Twitter/X, Reddit, Pinterest. Blocked. Wikipedia’s Chinese edition. Blocked.

Workplace tools that Western companies depend on: Dropbox, Slack, Notion, Trello. All blocked. If your site integrates with any of these or loads resources from their domains, that integration is dead in China.

Netflix, Spotify, Twitch. All blocked. Most major Western news sites including the New York Times, Wall Street Journal, and BBC. Blocked.

The part that catches most companies off guard goes past the blocked services themselves. Every script, font, widget, and API call that touches a blocked domain breaks too. One forgotten Google Fonts link buried in your CSS can leave the page blank for every visitor whose network never answers it. One analytics tag can hold up your entire page render.

One forgotten Google Fonts link in your CSS can leave the page blank for every visitor whose network never answers it. The damage hides in your code, in the dependencies you forgot were even there.

Every dependency in the dataset, and when it was last tested

The pages that rank for these questions carry no evidence at all. Across every compatibility page we have read at Chinafy, AppInChina and the smaller agencies: no table, no test date, no named test location, no latency figure. The measurement vendors publish figures. The pages telling you what breaks don’t cite them. The table below is that citation, row by row.

Be clear about whose numbers these are. Every row below comes from GreatFire or from 21YunBox, cited and dated. On 7 October 2026 21YunBox withdrew most of its per-tool timings, so the rows that rested on them now carry GreatFire’s verdict, or read untested where GreatFire has none.

There are two kinds of evidence in it, and they answer different questions. A reachability verdict says whether a host can be connected to at all. A timed page load says how long the vendor’s own site took to finish from a named probe inside mainland China. The second is a proxy for the script endpoint your visitor’s browser calls; it is not that endpoint. Where the two disagree, both are printed and neither is averaged.

The verdict column uses six values. Slow down on two of them, intermittent and splits by vantage point. Those are where a host looks healthy to whoever last checked it.

Analytics

Forms and chat

Embeds

Maps

Platforms

Infrastructure

Payments

Not yet probed

The register has no dated evidence for Crisp, Tawk.to, Loom, Sanity, Netlify, Bootstrap CDN or js.stripe.com. The HTTPS HubSpot loader, Drift’s js.driftt.com and Matomo’s cdn.matomo.cloud also remain untested in this evidence set. A result for a vendor’s website cannot establish the behaviour of its widget host.

Adobe Fonts, Font Awesome and the LinkedIn Insight Tag have dated evidence and are excluded from that list.

GreatFire reports use.typekit.net and snap.licdn.com not blocked on 22 September 2026, one conclusive test each. It reports use.fontawesome.com not blocked on 11 October 2026 and kit.fontawesome.com not blocked on 13 September 2026, one conclusive test each. Source: GreatFire, September and October 2026. https://en.greatfire.org/https/use.typekit.net ; https://en.greatfire.org/https/snap.licdn.com ; https://en.greatfire.org/https/use.fontawesome.com ; https://en.greatfire.org/https/kit.fontawesome.com

The consumer observations add a different view. Adobe’s host did not answer on the home line, and the challenge-host result describes requests rather than completed challenges.

On Beijing China Mobile (中国移动) residential broadband on 30 August 2026, 21YunBox recorded no answers in 11 requests to use.typekit.net and 6 to static.hotjar.com. It recorded 6 failed requests out of 15 to fast.wistia.com, and 3 out of 12 to challenges.cloudflare.com. GreatFire separately reports Turnstile’s script URL not blocked, with 2 conclusive tests, last tested 11 October 2026. Source: 21YunBox, 30 August 2026. https://www.21cloudbox.com/a-day-of-third-party-requests-from-inside-china.html ; GreatFire, 11 October 2026. https://en.greatfire.org/https/challenges.cloudflare.com/turnstile/v0/api.js

Marketo’s munchkin.marketo.net has a historical reachable verdict dated 31 May 2026, older than 90 days. We checked the sources on 16 October 2026; that check does not move their test dates. The next editorial review is set for 15 November 2026.

Source: GreatFire, 31 May 2026. https://en.greatfire.org/https/munchkin.marketo.net

Why Stripe sits outside this table

Stripe is the entry people expect to find in a table like this one. It belongs to a different question. Whether js.stripe.com loads from Shanghai is beside the point, because the constraint is a licensing one.

Mainland China does not appear in Stripe’s own list of countries where a Stripe account can be opened. Hong Kong does. Source: Stripe, Global availability, read 22 September 2026. https://stripe.com/global

Domestic acquiring does not exist for a mainland entity regardless of whether the script reaches the browser, so tuning its delivery solves nothing. The question worth answering is how to take Alipay (支付宝), WeChat Pay (微信支付) and UnionPay (银联), and our guide to running a WooCommerce store in China is the nearest thing we have published on it.

The verdict above covers www.paypal.com. It does not establish that a checkout completes.

Strategies for foreign businesses

You can’t punch through the firewall. But you can build so your site doesn’t need to cross it.

Host in mainland China with an ICP filing. This is the cleanest path. Site lives inside the firewall instead of fighting through it. Requests stay in the country, Baiduspider crawls without crossing the border, and the site is compliant. If you’re committed to the Chinese market this is where you want to be.

Use a China CDN to cache content at edge nodes inside mainland China. Even with an origin server sitting outside the country, a CDN with mainland PoPs serves cached pages to Chinese users without every request having to fight through the firewall.

Replace every overseas dependency. This is the step companies miss the most. Google Fonts needs to swap to locally hosted fonts. Google Maps becomes Baidu Maps. Google Analytics becomes Baidu Tongji. Go through every external call your site makes. Every script tag, every font import, every API endpoint. If any of them hit a domain your visitors’ networks can’t reach, your Chinese users are getting a broken or degraded experience and you probably don’t even know it.

Google Fonts, Google Analytics, Google Maps. Swap them for locally hosted fonts, Baidu Tongji, and Baidu Maps. Audit every external call your site makes.

Then there’s Hong Kong hosting as a middle ground if you’re not ready for the ICP process. No licence needed, latency to mainland is manageable, most firewall interference is avoided. It’s a compromise, but a usable one for companies testing the waters.

VPNs are a grey area. Corporate VPNs that connect China offices to global networks are generally tolerated. Consumer VPNs used to bypass the firewall are technically illegal, though enforcement varies by region and by year. Foreign companies operating in China should understand the distinction clearly. Don’t assume your employees can freely use personal VPNs to access blocked services from the office.