Clients can access blocked websites

Hello,

First I blocked websites like (facebook, youtube, 4shared) but I discovered that client can access the websites normally 

the rule was ..

block rule- from -> internal  , To category URL (online communities & P2P/File sharing) ,User --> All Users 

then I add a custom URL & add  ...

www.facebook.com,www.youtube.com ...etc 

and it works but then I discovered that users can still access the websites using https instead of http even if I meantion that in the custom URL

the Client type are SecurNat & TMG Client  

why the block role are not working with category URL ?? what can I do to block the website with its sub names ????

thanks