Abstract: A computing device in a network is protected from malware originating from Web sites, referred to as Web threats, by having only one domain reputation database check performed before a URL is sent to a target Web site. The computing device performs a URL check using an external reputation database and generates a pass token if the URL is considered safe. The pass token is inserted into the header of the HTTP request containing the URL. When the gateway device in the network (the device that receives HTTP requests in the network and transmits them over the Internet) receives the HTTP request, it validates the pass token and allows the request to proceed to the target Web site without having to perform its own URL check using the same reputation database. Instead, it can rely on the pass token and assume that the URL will not pose a potential Web threat.