The two are filtered by different means — an unencrypted request by the address and keywords it carries in the clear, an encrypted one by the server name in its TLS handshake — so one working while the other does not is normal.