If you have all IWSVA scanning, blocking, and filtering enabled, the general order
               of process is:
            
               - 
                  
                  URL (the URL is checked against Quota, blocking rules, and filtering policies) 
- 
                  
                  Size (files are checked against size limits set in HTTP > HTTP Malware Scan) 
- 
                  
                  Extension (file is evaluated based on extension) 
- 
                  
                  Type (file is evaluated based on file property rather than extension)