Those screenshots look correct, and chrome shouldn’t have web access. Can you post the rules page with everything collapsed, just so we can check for any other rule that may allow this?