diff --git a/daemon/face/face-system.cpp b/daemon/face/face-system.cpp
index 6ce6afe..e5b5175 100644
--- a/daemon/face/face-system.cpp
+++ b/daemon/face/face-system.cpp
@@ -59,6 +59,10 @@
 #ifdef HAVE_UNIX_SOCKETS
   m_factories["unix"] = make_shared<UnixStreamFactory>();
 #endif // HAVE_UNIX_SOCKETS
+
+#ifdef HAVE_WEBSOCKET
+  m_factories["websocket"] = make_shared<WebSocketFactory>();
+#endif // HAVE_WEBSOCKET
 }
 
 std::set<const ProtocolFactory*>
@@ -138,9 +142,6 @@
     if (sectionName == "udp") {
       processSectionUdp(subSection, isDryRun, context.m_netifs);
     }
-    else if (sectionName == "websocket") {
-      processSectionWebSocket(subSection, isDryRun);
-    }
     else {
       BOOST_THROW_EXCEPTION(ConfigFile::Error("Unrecognized option face_system." + sectionName));
     }
@@ -302,86 +303,5 @@
   }
 }
 
-void
-FaceSystem::processSectionWebSocket(const ConfigSection& configSection, bool isDryRun)
-{
-  // ; the websocket section contains settings of WebSocket faces and channels
-  // websocket
-  // {
-  //   listen yes ; set to 'no' to disable WebSocket listener, default 'yes'
-  //   port 9696 ; WebSocket listener port number
-  //   enable_v4 yes ; set to 'no' to disable listening on IPv4 socket, default 'yes'
-  //   enable_v6 yes ; set to 'no' to disable listening on IPv6 socket, default 'yes'
-  // }
-
-#if defined(HAVE_WEBSOCKET)
-  uint16_t port = 9696;
-  bool needToListen = true;
-  bool enableV4 = true;
-  bool enableV6 = true;
-
-  for (const auto& i : configSection) {
-    if (i.first == "port") {
-      port = ConfigFile::parseNumber<uint16_t>(i, "websocket");
-      NFD_LOG_TRACE("WebSocket port set to " << port);
-    }
-    else if (i.first == "listen") {
-      needToListen = ConfigFile::parseYesNo(i, "websocket");
-    }
-    else if (i.first == "enable_v4") {
-      enableV4 = ConfigFile::parseYesNo(i, "websocket");
-    }
-    else if (i.first == "enable_v6") {
-      enableV6 = ConfigFile::parseYesNo(i, "websocket");
-    }
-    else {
-      BOOST_THROW_EXCEPTION(ConfigFile::Error("Unrecognized option \"" +
-                                              i.first + "\" in \"websocket\" section"));
-    }
-  }
-
-  if (!enableV4 && !enableV6) {
-    BOOST_THROW_EXCEPTION(ConfigFile::Error("IPv4 and IPv6 WebSocket channels have been disabled."
-                                            " Remove \"websocket\" section to disable WebSocket channels or"
-                                            " re-enable at least one channel type."));
-  }
-
-  if (!enableV4 && enableV6) {
-    BOOST_THROW_EXCEPTION(ConfigFile::Error("NFD does not allow pure IPv6 WebSocket channel."));
-  }
-
-  if (!isDryRun) {
-    if (m_factoryByScheme.count("websocket") > 0) {
-      return;
-    }
-
-    auto factory = make_shared<WebSocketFactory>();
-    m_factoryByScheme.emplace("websocket", factory);
-
-    shared_ptr<WebSocketChannel> channel;
-
-    if (enableV6 && enableV4) {
-      websocket::Endpoint endpoint(boost::asio::ip::address_v6::any(), port);
-      channel = factory->createChannel(endpoint);
-
-      m_factoryByScheme.emplace("websocket46", factory);
-    }
-    else if (enableV4) {
-      websocket::Endpoint endpoint(boost::asio::ip::address_v4::any(), port);
-      channel = factory->createChannel(endpoint);
-
-      m_factoryByScheme.emplace("websocket4", factory);
-    }
-
-    if (channel && needToListen) {
-      channel->listen(bind(&FaceTable::add, &m_faceTable, _1));
-    }
-  }
-#else
-  BOOST_THROW_EXCEPTION(ConfigFile::Error("NFD was compiled without WebSocket, "
-                                          "cannot process \"websocket\" section"));
-#endif // HAVE_WEBSOCKET
-}
-
 } // namespace face
 } // namespace nfd
diff --git a/daemon/face/face-system.hpp b/daemon/face/face-system.hpp
index 5696aa7..4d374c7 100644
--- a/daemon/face/face-system.hpp
+++ b/daemon/face/face-system.hpp
@@ -102,9 +102,6 @@
   processSectionUdp(const ConfigSection& configSection, bool isDryRun,
                     const std::vector<NetworkInterfaceInfo>& nicList);
 
-  void
-  processSectionWebSocket(const ConfigSection& configSection, bool isDryRun);
-
 PUBLIC_WITH_TESTS_ELSE_PRIVATE:
   /** \brief config section name => protocol factory
    *
diff --git a/daemon/face/websocket-factory.cpp b/daemon/face/websocket-factory.cpp
index a92d93e..1898993 100644
--- a/daemon/face/websocket-factory.cpp
+++ b/daemon/face/websocket-factory.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2016,  Regents of the University of California,
+ * Copyright (c) 2014-2017,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -24,11 +24,97 @@
  */
 
 #include "websocket-factory.hpp"
+#include "core/logger.hpp"
 
 namespace nfd {
+namespace face {
 
 namespace ip = boost::asio::ip;
 
+NFD_LOG_INIT("WebSocketFactory");
+
+void
+WebSocketFactory::processConfig(OptionalConfigSection configSection,
+                                FaceSystem::ConfigContext& context)
+{
+  // websocket
+  // {
+  //   listen yes
+  //   port 9696
+  //   enable_v4 yes
+  //   enable_v6 yes
+  // }
+
+  bool wantListen = false;
+  uint16_t port = 9696;
+  bool enableV4 = true;
+  bool enableV6 = true;
+
+  if (configSection) {
+    wantListen = true;
+    for (const auto& pair : *configSection) {
+      const std::string& key = pair.first;
+
+      if (key == "listen") {
+        wantListen = ConfigFile::parseYesNo(pair, "face_system.websocket");
+      }
+      else if (key == "port") {
+        port = ConfigFile::parseNumber<uint16_t>(pair, "face_system.websocket");
+      }
+      else if (key == "enable_v4") {
+        enableV4 = ConfigFile::parseYesNo(pair, "face_system.websocket");
+      }
+      else if (key == "enable_v6") {
+        enableV6 = ConfigFile::parseYesNo(pair, "face_system.websocket");
+      }
+      else {
+        BOOST_THROW_EXCEPTION(ConfigFile::Error("Unrecognized option face_system.websocket." + key));
+      }
+    }
+  }
+
+  if (!enableV4 && !enableV6) {
+    BOOST_THROW_EXCEPTION(ConfigFile::Error(
+      "IPv4 and IPv6 WebSocket channels have been disabled. Remove face_system.websocket section "
+      "to disable WebSocket channels or enable at least one channel type."));
+  }
+
+  if (!enableV4 && enableV6) {
+    // websocketpp's IPv6 socket always accepts IPv4 connections.
+    BOOST_THROW_EXCEPTION(ConfigFile::Error("NFD does not allow pure IPv6 WebSocket channel."));
+  }
+
+  if (!context.isDryRun) {
+    if (!wantListen) {
+      if (!m_channels.empty()) {
+        NFD_LOG_WARN("Cannot close WebSocket channel after initialization");
+      }
+      return;
+    }
+
+    BOOST_ASSERT(enableV4);
+    websocket::Endpoint endpoint(enableV6 ? ip::tcp::v6() : ip::tcp::v4(), port);
+
+    auto channel = this->createChannel(endpoint);
+    if (!channel->isListening()) {
+      channel->listen(context.addFace);
+      if (m_channels.size() > 1) {
+        NFD_LOG_WARN("Adding WebSocket channel for new endpoint; cannot close existing channels");
+      }
+    }
+  }
+}
+
+void
+WebSocketFactory::createFace(const FaceUri& uri,
+                             ndn::nfd::FacePersistency persistency,
+                             bool wantLocalFieldsEnabled,
+                             const FaceCreatedCallback& onCreated,
+                             const FaceCreationFailedCallback& onFailure)
+{
+  onFailure(406, "Unsupported protocol");
+}
+
 shared_ptr<WebSocketChannel>
 WebSocketFactory::createChannel(const websocket::Endpoint& endpoint)
 {
@@ -50,26 +136,10 @@
   return createChannel(endpoint);
 }
 
-void
-WebSocketFactory::createFace(const FaceUri& uri,
-                             ndn::nfd::FacePersistency persistency,
-                             bool wantLocalFieldsEnabled,
-                             const FaceCreatedCallback& onCreated,
-                             const FaceCreationFailedCallback& onFailure)
-{
-  onFailure(406, "Unsupported protocol");
-}
-
 std::vector<shared_ptr<const Channel>>
 WebSocketFactory::getChannels() const
 {
-  std::vector<shared_ptr<const Channel>> channels;
-  channels.reserve(m_channels.size());
-
-  for (const auto& i : m_channels)
-    channels.push_back(i.second);
-
-  return channels;
+  return getChannelsFromMap(m_channels);
 }
 
 shared_ptr<WebSocketChannel>
@@ -82,4 +152,5 @@
     return nullptr;
 }
 
+} // namespace face
 } // namespace nfd
diff --git a/daemon/face/websocket-factory.hpp b/daemon/face/websocket-factory.hpp
index 1f784b7..a31c7cd 100644
--- a/daemon/face/websocket-factory.hpp
+++ b/daemon/face/websocket-factory.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2016,  Regents of the University of California,
+ * Copyright (c) 2014-2017,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -30,10 +30,28 @@
 #include "websocket-channel.hpp"
 
 namespace nfd {
+namespace face {
 
+/** \brief protocol factory for WebSocket
+ */
 class WebSocketFactory : public ProtocolFactory
 {
 public:
+  /** \brief process face_system.websocket config section
+   */
+  void
+  processConfig(OptionalConfigSection configSection,
+                FaceSystem::ConfigContext& context) override;
+
+  /** \brief unicast face creation is not supported and will always fail
+   */
+  void
+  createFace(const FaceUri& uri,
+             ndn::nfd::FacePersistency persistency,
+             bool wantLocalFieldsEnabled,
+             const FaceCreatedCallback& onCreated,
+             const FaceCreationFailedCallback& onFailure) override;
+
   /**
    * \brief Create WebSocket-based channel using websocket::Endpoint
    *
@@ -58,15 +76,7 @@
   shared_ptr<WebSocketChannel>
   createChannel(const std::string& localIp, const std::string& localPort);
 
-public: // from ProtocolFactory
-  virtual void
-  createFace(const FaceUri& uri,
-             ndn::nfd::FacePersistency persistency,
-             bool wantLocalFieldsEnabled,
-             const FaceCreatedCallback& onCreated,
-             const FaceCreationFailedCallback& onFailure) override;
-
-  virtual std::vector<shared_ptr<const Channel>>
+  std::vector<shared_ptr<const Channel>>
   getChannels() const override;
 
 private:
@@ -83,6 +93,7 @@
   std::map<websocket::Endpoint, shared_ptr<WebSocketChannel>> m_channels;
 };
 
+} // namespace face
 } // namespace nfd
 
 #endif // NFD_DAEMON_FACE_WEBSOCKET_FACTORY_HPP
diff --git a/tests/daemon/face/face-system.t.cpp b/tests/daemon/face/face-system.t.cpp
index 826ebc4..cd90078 100644
--- a/tests/daemon/face/face-system.t.cpp
+++ b/tests/daemon/face/face-system.t.cpp
@@ -28,9 +28,6 @@
 
 // ProtocolFactory includes, sorted alphabetically
 #include "face/udp-factory.hpp"
-#ifdef HAVE_WEBSOCKET
-#include "face/websocket-factory.hpp"
-#endif // HAVE_WEBSOCKET
 
 #include "tests/test-common.hpp"
 
@@ -403,72 +400,6 @@
 }
 BOOST_AUTO_TEST_SUITE_END() // ConfigUdp
 
-#ifdef HAVE_WEBSOCKET
-BOOST_AUTO_TEST_SUITE(ConfigWebSocket)
-
-BOOST_AUTO_TEST_CASE(Normal)
-{
-  const std::string CONFIG = R"CONFIG(
-    face_system
-    {
-      websocket
-      {
-        listen yes
-        port 9696
-        enable_v4 yes
-        enable_v6 yes
-      }
-    }
-  )CONFIG";
-
-  BOOST_CHECK_NO_THROW(parseConfig(CONFIG, true));
-  BOOST_CHECK_NO_THROW(parseConfig(CONFIG, false));
-
-  auto& factory = this->getFactoryByScheme<WebSocketFactory>("websocket");
-  BOOST_CHECK_EQUAL(factory.getChannels().size(), 1);
-}
-
-BOOST_AUTO_TEST_CASE(ChannelsDisabled)
-{
-  const std::string CONFIG = R"CONFIG(
-    face_system
-    {
-      websocket
-      {
-        listen yes
-        port 9696
-        enable_v4 no
-        enable_v6 no
-      }
-    }
-  )CONFIG";
-
-  BOOST_CHECK_THROW(parseConfig(CONFIG, true), ConfigFile::Error);
-  BOOST_CHECK_THROW(parseConfig(CONFIG, false), ConfigFile::Error);
-}
-
-BOOST_AUTO_TEST_CASE(Ipv4ChannelDisabled)
-{
-  const std::string CONFIG = R"CONFIG(
-    face_system
-    {
-      websocket
-      {
-        listen yes
-        port 9696
-        enable_v4 no
-        enable_v6 yes
-      }
-    }
-  )CONFIG";
-
-  BOOST_CHECK_THROW(parseConfig(CONFIG, true), ConfigFile::Error);
-  BOOST_CHECK_THROW(parseConfig(CONFIG, false), ConfigFile::Error);
-}
-
-BOOST_AUTO_TEST_SUITE_END() // ConfigWebSocket
-#endif // HAVE_WEBSOCKET
-
 BOOST_AUTO_TEST_SUITE_END() // TestFaceSystem
 BOOST_AUTO_TEST_SUITE_END() // Mgmt
 
diff --git a/tests/daemon/face/factory-test-common.hpp b/tests/daemon/face/factory-test-common.hpp
index f7d9535..0c67586 100644
--- a/tests/daemon/face/factory-test-common.hpp
+++ b/tests/daemon/face/factory-test-common.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2016,  Regents of the University of California,
+ * Copyright (c) 2014-2017,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -58,6 +58,23 @@
                      });
 }
 
+/** \brief check that channels in a factory equal given channel URIs
+ */
+inline void
+checkChannelListEqual(const ProtocolFactory& factory, const std::set<std::string>& channelUris)
+{
+  std::set<std::string> expected(channelUris); // make a copy so we can erase as we go
+  for (const auto& channel : factory.getChannels()) {
+    std::string uri = channel->getUri().toString();
+    if (expected.erase(uri) == 0) {
+      BOOST_ERROR("Unexpected channel " << uri);
+    }
+  }
+  for (const auto& uri : expected) {
+    BOOST_ERROR("Missing channel " << uri);
+  }
+}
+
 } // namespace tests
 } // namespace nfd
 
diff --git a/tests/daemon/face/websocket-factory.t.cpp b/tests/daemon/face/websocket-factory.t.cpp
index e7abef2..d4a6d5e 100644
--- a/tests/daemon/face/websocket-factory.t.cpp
+++ b/tests/daemon/face/websocket-factory.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2016,  Regents of the University of California,
+ * Copyright (c) 2014-2017,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -26,15 +26,153 @@
 #include "face/websocket-factory.hpp"
 
 #include "factory-test-common.hpp"
+#include "face-system-fixture.hpp"
 #include "tests/limited-io.hpp"
 
 namespace nfd {
+namespace face {
 namespace tests {
 
+using namespace nfd::tests;
+namespace ip = boost::asio::ip;
+
 BOOST_AUTO_TEST_SUITE(Face)
 BOOST_FIXTURE_TEST_SUITE(TestWebSocketFactory, BaseFixture)
 
-using nfd::Face;
+BOOST_FIXTURE_TEST_SUITE(ProcessConfig, FaceSystemFixture)
+
+BOOST_AUTO_TEST_CASE(Normal)
+{
+  const std::string CONFIG = R"CONFIG(
+    face_system
+    {
+      websocket
+      {
+        listen yes
+        port 9696
+        enable_v4 yes
+        enable_v6 yes
+      }
+    }
+  )CONFIG";
+
+  BOOST_CHECK_NO_THROW(parseConfig(CONFIG, true));
+  BOOST_CHECK_NO_THROW(parseConfig(CONFIG, false));
+
+  auto& factory = this->getFactoryById<WebSocketFactory>("websocket");
+  checkChannelListEqual(factory, {"ws://[::]:9696"});
+}
+
+BOOST_AUTO_TEST_CASE(EnableIpv4Only)
+{
+  const std::string CONFIG = R"CONFIG(
+    face_system
+    {
+      websocket
+      {
+        listen yes
+        port 9696
+        enable_v4 yes
+        enable_v6 no
+      }
+    }
+  )CONFIG";
+
+  BOOST_CHECK_NO_THROW(parseConfig(CONFIG, true));
+  BOOST_CHECK_NO_THROW(parseConfig(CONFIG, false));
+
+  auto& factory = this->getFactoryById<WebSocketFactory>("websocket");
+  checkChannelListEqual(factory, {"ws://0.0.0.0:9696"});
+}
+
+BOOST_AUTO_TEST_CASE(UnsupportedIpv6Only)
+{
+  const std::string CONFIG = R"CONFIG(
+    face_system
+    {
+      websocket
+      {
+        listen yes
+        port 9696
+        enable_v4 no
+        enable_v6 yes
+      }
+    }
+  )CONFIG";
+
+  BOOST_CHECK_THROW(parseConfig(CONFIG, true), ConfigFile::Error);
+  BOOST_CHECK_THROW(parseConfig(CONFIG, false), ConfigFile::Error);
+}
+
+BOOST_AUTO_TEST_CASE(ChannelsDisabled)
+{
+  const std::string CONFIG = R"CONFIG(
+    face_system
+    {
+      websocket
+      {
+        listen yes
+        port 9696
+        enable_v4 no
+        enable_v6 no
+      }
+    }
+  )CONFIG";
+
+  BOOST_CHECK_THROW(parseConfig(CONFIG, true), ConfigFile::Error);
+  BOOST_CHECK_THROW(parseConfig(CONFIG, false), ConfigFile::Error);
+}
+
+BOOST_AUTO_TEST_CASE(NoListen)
+{
+  const std::string CONFIG = R"CONFIG(
+    face_system
+    {
+      websocket
+      {
+        listen no
+        port 9696
+        enable_v4 yes
+        enable_v6 yes
+      }
+    }
+  )CONFIG";
+
+  auto& factory = this->getFactoryById<WebSocketFactory>("websocket");
+  BOOST_CHECK_EQUAL(factory.getChannels().size(), 0);
+}
+
+BOOST_AUTO_TEST_CASE(ChangeEndpoint)
+{
+  const std::string CONFIG1 = R"CONFIG(
+    face_system
+    {
+      websocket
+      {
+        port 9001
+      }
+    }
+  )CONFIG";
+
+  BOOST_CHECK_NO_THROW(parseConfig(CONFIG1, false));
+  auto& factory = this->getFactoryById<WebSocketFactory>("websocket");
+  checkChannelListEqual(factory, {"ws://[::]:9001"});
+
+  const std::string CONFIG2 = R"CONFIG(
+    face_system
+    {
+      websocket
+      {
+        port 9002
+      }
+    }
+  )CONFIG";
+
+  BOOST_CHECK_NO_THROW(parseConfig(CONFIG2, false));
+  checkChannelListEqual(factory, {"ws://[::]:9001", "ws://[::]:9002"});
+}
+
+BOOST_AUTO_TEST_SUITE_END() // ProcessConfig
 
 BOOST_AUTO_TEST_CASE(GetChannels)
 {
@@ -82,4 +220,5 @@
 BOOST_AUTO_TEST_SUITE_END() // Face
 
 } // namespace tests
+} // namespace face
 } // namespace nfd