"Which websites are banned in Turkey?" has been one of the most-searched legal-technical questions in the country for years. The answer isn't a simple list, because the concept of a blocked site doesn't come from a single authority, a single law, or a single justification. Law No. 5651, court rulings, administrative measures by the Information and Communication Technologies Authority (BTK), the National Computer Emergency Response Team (USOM) malicious-link list, decisions by the Access Providers Association (ESB), and protective-measure rulings from chief public prosecutors all overlap to produce the list of blocked websites in Turkey.

This guide brings together, in one editorial source: concrete examples for users searching the Turkey blocked sites list, categories for researchers looking for names of banned sites, official tools for webmasters running an access-block lookup, and the legal framework for end users wondering "is there a penalty for visiting banned sites?" Nothing here teaches any blocking-circumvention method; this is explicitly vendor-neutral informational content.

Related guides: What is DNS and how to change settings · HTTPS and TLS 1.3 guide · DDoS Protection Guide · OWASP Top 10 2026 · VPS Security Hardening · Domain names and WHOIS lookup

The backbone of internet regulation in Turkey is Law No. 5651 on Regulating Publications on the Internet and Combating Crimes Committed by Means of Such Publications, which entered into force in 2007. Originally relatively narrow in scope, the law's 2014 amendments and subsequent additional articles (especially 8/A and 9/A) granted very broad administrative blocking powers to the BTK Presidency and the Presidency of the Republic.

Under Law No. 5651, blocking a domain or URL happens via three different paths: an automatic administrative measure for catalog offenses (Article 8), a judge's order for violations of personal rights (Article 9), and a direct measure issued by the BTK President on grounds of "protection of national security and public order" (Article 8/A). The third path is the fastest and most broadly interpreted form of blocking; once the order is issued, the gap between ESB instructing ISPs is usually only minutes.

Catalog Offenses (Article 8)

The categories of content subject to automatic blocking under Article 8 are enumerated as a closed list. A justification not on this list is not enough for an Article 8 block; another article would be required.

  • Inducement to suicide (Turkish Penal Code Article 84)
  • Sexual abuse of children (TCK 103/1)
  • Facilitating the use of narcotic or stimulant substances (TCK 190)
  • Supplying substances dangerous to health (TCK 194)
  • Obscenity (TCK 226)
  • Prostitution (TCK 227)
  • Providing a place or means for gambling (TCK 228)
  • Crimes against Atatürk (Law No. 5816)
  • Fixed-odds and mutual betting on sports events (Law No. 7258)

When content falling into any of these categories is identified, the BTK Presidency may impose a content-removal and/or access-blocking measure on its own initiative or on a complaint. The decision is submitted to a criminal court of peace within 24 hours for approval. In practice the measure is generally implemented first; the objection mechanism plays out afterward.

Violation of Personal Rights (Article 9) and Privacy of Private Life (9/A)

For content that violates the personal rights of a real or legal person, an application is made directly to a criminal judgeship of peace. The judge reviews the application within 24 hours and, if necessary, may issue content-based or URL-based blocking. Under Article 9/A, titled privacy of private life, the competent authority may simultaneously request a court order and ask the BTK President for a measure on grounds of "a situation in which delay would be inadvisable."

National Security and Public Order (Article 8/A)

The most controversial blocking path is Article 8/A, added in 2015. On grounds of "threat to the right to life," "public order," "national security," or "general health," the relevant ministries or the BTK President may issue a measure to be enforced within 4 hours. The decision must be approved by a criminal court of peace within the following 24 hours. The Freedom of Expression Association's EngelliWeb project reports that 8/A blocks have made up more than half of all administrative blocks in recent years.

Who Issues a Blocking Order, and Who Enforces It?

Understanding the chain of decisions correctly is critical to interpreting the lists. Internet blocking in Turkey is a four-actor mechanism:

  • Decision-issuing authorities: Criminal judgeship of peace, public prosecutor's office, BTK Presidency, the Presidency of the Republic, the relevant ministries (Interior, Health, Treasury), the Advertising Board, the Radio and Television Supreme Council (RTÜK), and the Banking Regulation and Supervision Agency (BDDK).
  • Notifying/relaying authority: BTK Access Providers Association (ESB) — relays the decision to operators.
  • Enforcers: Access providers (Türk Telekom, Türksat, Vodafone, Turkcell Superonline, cable TV service providers), hosting providers, content providers.
  • Reviewers: Objections at the criminal judgeship of peace, regional courts of justice, individual applications to the Constitutional Court, and the European Court of Human Rights.

USOM and BTK: The Relationship

USOM (the National Computer Emergency Response Team) is a unit operating within BTK that responds to cybersecurity incidents. The malicious-link list (USOM blocklist) it publishes contains URLs/IPs involved in phishing, malware distribution, fraud, and data exfiltration. The list feeds both ISPs (via ESB) and enterprise security products; technically it's applied as DNS RPZ, IP blacklists, and URL filters.

The USOM list differs from the administrative blocking path under Law 5651; it isn't political content or violations of personal rights — it covers active cyber threats. Fake banking sites, phishing domains impersonating e-Devlet, and pages stealing crypto-wallet credentials are typical examples. Compared with OWASP Top 10 2026, the USOM list is a practical, case-based source updated daily.

Which Sites Are Banned? Category-Based List

The answer to "which websites are banned" keeps shifting — as of 2026 the EngelliWeb archive contains roughly 1 million blocked domains/URLs. Below are the main categories whose decisions remain in force and that users frequently search for, with examples. Important note: Whether an individual user circumventing a block to visit these sites is itself a separate legal debate — this article lists them for informational purposes only.

Social Media and Communication Platforms

  • Discord: Access closed in March 2024 on grounds of "child abuse" and "inducement to suicide."
  • OnlyFans: Access closed under obscenity rules; blocked at both app and domain level.
  • Wattpad: Blocked in 2023 under obscenity (Article 8).
  • Eksisozluk: Restricted in the aftermath of the February 2023 earthquake, later reopened following technical adjustments.
  • Deutsche Welle Türkçe (dw.com/tr): Blocked since 2022 under RTÜK licensing requirements.

Betting, Lottery, and Gambling Sites

Under Law No. 7258, the legal betting monopoly in Turkey belongs to the state (Spor Toto, İddaa). All foreign-based betting sites (Bet365, Bwin, 1xbet, Pinnacle, Betway, Betsson, etc.) are automatically blocked by BTK. Because these sites change domains daily, BTK adds hundreds of new domains to the blocking list every day — betting sites form the single largest blocking category in Turkey.

Adult Content (Obscenity) Sites

  • Pornhub, Xvideos, Xnxx, RedTube, YouPorn: All blocked from 2007 onward under TCK 226.
  • Brazzers, Bangbros, Reality Kings: Studio-level domains blocked.
  • OnlyFans, Fansly: Both the main domain and member-content URLs are blocked.

File-Sharing and Piracy Sites

  • The Pirate Bay (thepiratebay.org): Copyright infringement — also blocked in 30+ countries outside Turkey.
  • 1337x, RARBG mirrors, Limetorrents: Same justification.
  • 4shared: Mixed copyright + obscenity grounds.
  • Pastebin.com: Periodic/permanent blocking since 2016 due to the spread of leak content.

Crypto Exchange and Trading Sites

Following the MASAK regulation of April 30, 2021, the domains of platforms providing crypto-fiat conversion without authorization in Turkey were progressively blocked. While the home pages of major exchanges like Binance, KuCoin, and Bybit have remained accessible, sub-domains and payment pages have intermittently been caught up in blocks. For an accurate current status, a query at usom.gov.tr/adres is recommended.

News Sites and Independent Media

  • Bianet, Gazeteduvar, Diken, T24, Birgun, Cumhuriyet: Individual articles blocked under Article 9 — at the URL level, not site-wide.
  • Deutsche Welle Türkçe, VOA Türkçe: Under the 2022 RTÜK licensing notification.
  • Sendika.org: One of the sites that has continually changed domains and been blocked repeatedly.

Gaming and Entertainment Platforms

  • Roblox: Access blocked in 2024 on child-safety grounds.
  • WikiLeaks: Long-blocked under state-secret and national-security grounds.
  • Anabolic Video, Shane's World, and other niche adult content: Under the obscenity category.

Sites Blocked Historically That Are Now Open

Turkey's blocking history offers textbook examples:

  • YouTube: Long blocks between 2007 and 2010, short blocks in 2014-2015. Open today.
  • Twitter (X): Multiple blocks in 2014, 2015, 2016, 2023 (earthquake), and 2024 (general restrictions) — currently open, though bandwidth throttling has been used.
  • Wikipedia: Blocked on April 29, 2017, reopened on January 15, 2020 following the Constitutional Court's December 26, 2019 decision — a turning point in Turkey's internet-law history.
  • GitHub, Google Drive, OneDrive, Dropbox: Blocked for one week after the October 2016 email-leak incident.
  • WordPress.com: Content-based block in 2016.
  • SoundCloud, Last.fm, MySpace: Past blocks on copyright grounds.

Checking Whether a Site Is Blocked

There are three official ways to find out whether a domain or URL is access-blocked in Turkey. Each shows decisions from a different authority; no single source captures every decision.

BTK Site Lookup (internet.btk.gov.tr/sitesorgu)

At internet.btk.gov.tr/sitesorgu you can enter a domain or IP and see basic administrative status alongside WHOIS information. The BTK page transparently states that it shows open-source data; blocking-decision information is not complete for every case.

e-Devlet ESB Lookup

The turkiye.gov.tr/esb-web-sitesi-erisim-engeli-sorgulama service requires e-Devlet identity login. It shows decisions relayed via ESB and is the main gateway, especially for personal decisions and access-block applications/objections.

USOM Address Lookup

usom.gov.tr/adres queries whether a URL or domain is on the malicious-link list. On the enterprise security side, this is the most reliable source for confirming a "blocked due to cyber-threat indexing" decision.

EngelliWeb Civil Archive

ifade.org.tr/engelliweb is a civil archive maintained by the Freedom of Expression Association. The justification, issuing authority, date, and link to the decision text are documented case by case. It is the most comprehensive resource for academic research, journalism, and preparation of legal objections.

Detecting Blocks from the Command Line

A webmaster or sysadmin may need to detect whether their site is reachable from Turkey before user complaints arrive. DNS-based blocking, IP blocking, and SNI filtering each leave different traces. The commands below run in a standard Linux/macOS terminal.

When DNS blocking is detected, the typical result is either an empty answer or a "sinkhole" IP (often 195.175.254.2). After redirection to the sinkhole, Türk Telekom's "access to this site has been blocked" page is served. If SNI-based blocking is in play, you'll see "connection reset by peer" during the handshake — this is more sophisticated and requires deep packet inspection (DPI).

Is There a Penalty for Visiting Banned Sites?

This is the most-asked question. The answer depends on who is accessing what content, by what method, and for what purpose. The general rule can be summarized as follows:

  • No direct penalty for the end user: Law No. 5651 places obligations on content providers, hosting providers, and access providers. There is no administrative fine or prison sentence prescribed simply for "having visited this site."
  • Content-based offenses are separate: Whether or not a site is blocked, if the material and mental elements of crimes such as obscenity (TCK 226), gambling (TCK 228), terrorism propaganda (Anti-Terror Law 7/2), or child abuse (TCK 103) are realized, the perpetrator is prosecuted regardless.
  • Penalties exist for institutions/administrators that violate the blocking order: If an access provider or hosting provider fails to enforce a BTK decision, a (high-value) administrative fine is prescribed.
  • VPN use is not banned per se: There is no explicit provision in Turkey banning the use of a VPN. However, crimes committed via VPN are prosecuted because of the underlying crime, not because of the VPN.

This article does not constitute legal advice. For a specific case you should consult a lawyer registered with the Union of Turkish Bar Associations. The content here is informational only.

The Social Media Law and Bandwidth Throttling

The Social Media Law, which entered into force in July 2020 and amended Law No. 5651 with additional articles, imposed new obligations on platforms that have over 1 million daily visitors from Turkey:

  • Mandatory appointment of a legal-entity representative in Turkey
  • 48-hour window for notifications and replies
  • Hosting Turkish user data domestically
  • Publishing an annual transparency report
  • Tiered sanctions for violations: ad ban, 50% bandwidth throttling, 90% bandwidth throttling

Bandwidth throttling is the most critical sanction: at the BTK President's request, ESB can technically slow traffic to a platform by 50% or 90%. In practice this makes pages appear "loaded but with no images." Throttling examples on Twitter, Facebook, and Instagram occurred between 2022 and 2024. For the technical side, our page speed and Core Web Vitals article explains throttling's effect on LCP/INP.

Types of Access Blocks: Technical Anatomy

There are four technical implementations of blocking in Turkey. Which one is applied depends on where the site is hosted, the urgency of the decision, and the operator's infrastructure:

1. DNS Blocking

The simplest and most common method. The ISP's DNS server returns either an empty answer or a sinkhole IP for the blocked domain. When users switch to alternative resolvers like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare), they bypass the block, which is why this method alone is insufficient. Our change DNS settings article explains the mechanism in detail.

2. IP Blocking

A more aggressive method: the destination site's IP address is made unreachable at the BGP or operator route-table level. For sites using shared IPs like Cloudflare, AWS, or Google Cloud, this method causes major collateral damage, since thousands of sites may share the same IP. That's why IP-based blocking has been increasingly replaced by SNI-based blocking in recent years.

3. SNI / DPI Blocking

The server_name field (SNI extension) in the TLS handshake's ClientHello message is plaintext. DPI equipment on the Türk Telekom backbone reads this field and, when it sees a blocked domain, sends an RST packet to tear down the connection. Encrypted Client Hello (ECH, RFC 9460) encrypts this field, but it isn't yet the default across all browser/server combinations. Our HTTPS and TLS 1.3 guide covers the technical details of SNI and ECH.

4. Hosting Provider and Content Removal

The most permanent solution: a hosting provider in Turkey, served with a notice, removes the content, and the content disappears entirely. For overseas hosting platforms like WordPress, Medium, and YouTube, the notice instead tells them to "make the content unreachable from Turkey," at which point the platform's geo-blocking feature kicks in.

For Webmasters: What to Do If Your Site Is Blocked

If your visitors from Turkey have suddenly dropped and your analytics dashboard shows near 0% Turkey traffic, one of three scenarios may be playing out: (a) you were directly blocked by a BTK decision, (b) your hosting provider's IP was blocked for a different reason and you were affected indirectly, or (c) a CDN configuration error. Let's go step by step:

  • 1. Look up your domain via the e-Devlet ESB lookup.
  • 2. Check the malicious-list status via the USOM address lookup — your site may have been hacked and used to distribute phishing.
  • 3. Check whether your domain is in the EngelliWeb archive and on what grounds.
  • 4. Test access to the site from a VPS in Turkey using curl, dig, and traceroute (see: VPS guide).
  • 5. If the decision originates from BTK, file an objection with the issuing authority within 15 days, or apply to a criminal court of peace through a lawyer.

Objection Process and Constitutional Court Individual Application

The right to object to an access-block decision runs for 15 days from the date of notification. The objection is filed with a criminal judgeship of peace ranking above the issuing one. For administrative decisions (BTK 8/A), the objection is filed against the docket opened after the judge's approval of the 24-hour confirmation step. A judge other than the one who approved it reviews the objection.

If the first-instance objection is rejected, two further paths are open: (a) an individual application to the Constitutional Court (the alleged violation is grounded in freedom of expression and the right to communication), and (b) once domestic remedies are exhausted, an application to the European Court of Human Rights (ECtHR). The Wikipedia decision (Wikimedia Foundation v. Turkey) and the Twitter decision (Yıldırım v. Turkey, 2012) are major access-freedom rulings the ECtHR has issued against Turkey.

Blocking Numbers and Statistics

There is no single official source for blocking statistics; three different data sets exist:

  • BTK annual reports: Publish the number of administrative blocking decisions issued under 8/A.
  • EngelliWeb: Has documented close to 1 million blocked URLs/domains in total since 2008 (2024 report).
  • USOM: The annual malicious-link list size averages 50,000-80,000 URLs.
  • EFD/Freedom House Turkey reports: Independent civil-society assessments.

For comparison: the People's Republic of China's Great Firewall blocks millions of domains, while EU countries average 1,000-5,000 URLs blocked per year. Compared with countries of similar income group and internet penetration, Turkey ranks near the top.

Hosting Provider Liability

In Turkey, providers of hosting services ("hosting providers") have two principal obligations under Article 5 of Law 5651:

  • Removing unlawful content once they have knowledge — apply the measure within 24 hours of notification.
  • Retaining user records — log retention periods of 1 year + 2 years.

Hosting providers that violate these obligations may be fined up to TRY 100,000 in administrative penalties under Law 5651 (penalties rise each year by the revaluation rate). For this reason, takedown notifications served on Turkey-based hosting providers tend to resolve quickly. For hosting selection criteria, see our hosting types guide.

Using a VPN is not illegal in Turkey. No law or regulation directly criminalizes establishing a VPN connection. However, in 2016 BTK blocked the main websites of major paid VPN services (NordVPN, ExpressVPN, TunnelBear, etc.), making it harder to purchase a VPN subscription. In addition, some operators may use DPI to throttle the ports used by popular VPN protocols (OpenVPN UDP, WireGuard, IKEv2).

Committing a crime via VPN does not eliminate the penalty for that crime; it only makes detection harder. Through payment records, IP correlation, and browser fingerprinting, judicial authorities have identified crimes committed via VPN in many cases. Our VPS security hardening article is a complementary resource from an operational-security perspective.

DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and Encrypted SNI

Two standards that naturally render DNS blocking ineffective have become defaults in browsers in recent years: DoH (RFC 8484) and DoT (RFC 7858). Chrome, Firefox, and Safari send DNS queries from the user's machine encrypted over HTTPS to Cloudflare 1.1.1.1 or Google 8.8.8.8 — observing DNS at the operator level is no longer as easy as it once was.

Encrypted SNI (ECH): Encrypts the server_name field inside ClientHello on TLS 1.3, making operator-level DPI blocking harder. Cloudflare, Mozilla, and Google are pushing ECH adoption. For ECH to be effective, however, support is needed on both the CDN side and the browser side; Turkish operators' SNI-based blocking statistics will reshape themselves as ECH becomes more widespread.

This guide is informational; it does not teach circumvention methods. Two important points within the bounds of technical reality: (a) using DoH/DoT or establishing a VPN connection is not a direct crime under Turkish law, and (b) offering tools for bypassing blocks (proxy as a service, VPN reseller, anti-block app distribution) has, in some decisions, been brought within the scope of Article 8/A of Law 5651. As vendor-neutral information: the Tor Project lists Turkey among the high-volume countries for users searching the term "VPN."

Client Side: Browser and Operating-System Hygiene

Apart from blocking debates, there are also sites end users would never want to reach: phishing, malware distribution, fraud, and sites that steal card data. The USOM list comes into play in this category, complemented by modern browsers' Google Safe Browsing / Microsoft SmartScreen integrations.

  • Chrome / Edge / Brave: Google Safe Browsing on by default. Users see a full-screen red warning when visiting a known bad site.
  • Firefox: Connects to the same API plus Mozilla's own blocklist.
  • Operating system: Windows Defender SmartScreen, macOS XProtect, and antivirus solutions add another layer.
  • Pi-hole, AdGuard Home: DNS-level filtering of ads and malicious content on a home network.

Access Policy on Corporate Networks

On a corporate network, "sites that must not be visited" can be a wider set than just BTK blocks — categories prohibited by the company's internal security policy are also included. A typical corporate policy restricts social media, personal email, file-sharing services, and bandwidth-hungry video services.

On corporate networks, log retention of 1 year internal + 2 years archive is mandatory under Law 5651. The log format must include IP-time-MAC-port mappings. Products such as Squid, pfSense, FortiGate, and Palo Alto NGFW meet this obligation; our log analysis with the ELK stack guide covers long-term archival and querying.

Schools, Municipalities, and Public Networks

Law No. 5809 on Electronic Communications and Law 5651 add further filtering obligations for public networks. In schools, libraries, municipal Wi-Fi, KSM networks, and similar settings, content categories are filtered by default. Türk Telekom's "Family Profile"–style services block adult content, gambling, and abuse categories at the DNS level.

Economic Impact: Blocking and the Digital Economy

Blocking has direct economic effects too. During the 2017 Wikipedia block, academics' research processes slowed and SMEs lost a verification source. According to OECD reports, the GDP impact of internet restrictions ranges from 0.2% to 1.0% per year. In Turkish-Lira terms, on days of social-media bandwidth throttling, sales at small e-commerce businesses dropped 30-50% (Turkish Informatics Foundation report).

Brands that diversify across digital marketing channels are less affected by a single platform being blocked. Email marketing, push notifications, SMS, and owned media (your own blog and app) help spread the dependency.

Frequently Asked Questions

Can the "list of blocked sites" be obtained from a single source?

No. Officially, BTK, ESB, and USOM each keep separate records; civil-society documentation comes from EngelliWeb. There is no unified, publicly available list. EngelliWeb's archive is the most comprehensive civil source.

If I visit a blocked site, how does my ISP know?

DNS query logs, NetFlow records, and TLS SNI metadata are temporarily visible on the operator side. Under Law 5651, this information is retained for 1+2 years and shared on request from judicial authorities. Every access by an ordinary user is not actively monitored; however, retrospective queries can be made when a criminal investigation is opened.

When social media is throttled, why don't images load?

Throttling reduces the throughput of the traffic flow. Small HTML/CSS files coming from a CDN can still load, but 50KB+ images and video time out at the TCP level. The page renders, but img elements cannot load. For technical detail, see our Core Web Vitals and Nginx configuration articles.

A domain was blocked — what if I publish the same content on a new domain?

The final paragraph of Article 8/A of Law 5651 states that new domains "that re-publish in a manner that frustrates the purpose of the decision" are automatically covered by the same decision. In practice, BTK constantly updates the "mirror domains" list; this is why betting sites change domains several times a day and are re-blocked within minutes.

Can my site, hosted abroad, be reported and removed from Turkey?

Content can be made unreachable from Turkey (i.e., blocked); but if the hosting provider is overseas, physical removal is usually difficult. CDN providers (Cloudflare, Akamai) comply with some decisions and apply geo-restriction for Turkey. Cloudflare's transparency reports publish that compliance rate annually.

Reliable Information Sources and Continuous Monitoring

Blocked-site lists are constantly changing — by the time you read this article, some category examples may be partially out of date. Periodic monitoring of the sources below will keep your information fresh:

Webmaster Action Checklist

If you want your site to remain reliably accessible from Turkey and to reduce unnecessary blocking risk:

  • 1. Know the legal content boundaries — don't produce content covered by the catalog offenses in TCK and Law 5651.
  • 2. Moderate user-generated content (UGC) — comment, forum, and profile sections require a 24-hour response window.
  • 3. Appoint a legal-entity representative in Turkey — mandatory if you have over 1M daily TR visitors.
  • 4. Keep notification email channels open — abuse@, legal@, and dmca@ addresses must be accurately listed in WHOIS.
  • 5. Log retention — 1 year internal + 2 years archive. See: ELK stack guide.
  • 6. CDN and geo-restriction flexibility — set up rule-based geofencing with a CDN like Cloudflare/Bunny/Fastly.
  • 7. Quick objection if blocked — the 15-day objection window is critical.
  • 8. Backup domain — to avoid being confused with betting/casino sites, trademark registration and protection across multiple TLDs (.com.tr,.net.tr) are recommended.

Verification Checklist

To get a definitive answer to "is this blocked?" for a domain or URL, run these steps in order:

Observations from the past two years:

  • Increased use of bandwidth throttling — gradual slowdowns are preferred over outright blocking.
  • VPN blocking has expanded — main sites and app-download pages of major paid VPN providers are blocked.
  • SNI-based blocking has become widespread — selective domain-based blocking instead of IP-based.
  • USOM malicious-list cadence has accelerated — thousands of new phishing domains added daily.
  • Content-removal requests have risen — particularly the volume of formal requests sent to X (Twitter), Meta, and YouTube.
  • EU DSA effect — large platforms' Turkey compliance policies are aligning with the EU Digital Services Act.

References

Professional support for access bans, domain names, and hosting

For keeping your site accessible from Turkey, hosting selection, log-retention compliance, domain management, and technical infrastructure setup, get in touch with our team contact us

WhatsApp