Chromebook Hardening Playbook for K-12: Stop Filter Evasion (You Shall Not Pass)

Jim’s 10 Quick Hits

Ten settings that take minutes and close the bypasses students use most. Most are Chrome or Admin console defaults nobody revisited. Each has a full card later in the handout.

1. Force-install YSNP and your filter


Do this	Force-install both for the Students OU so students can’t disable them.
Why	Force-install is the only thing that closes the “just turn it off” bypass.
Where	Devices › Chrome › Apps & extensions › Users & browsers
Effort	10 minutes
License	CEU

2. Block local webpage files


Do this	URL blocklist `file:///.html`, `.htm`, `.xhtml`, `.xht`, `.shtml`, `.shtm`, `.svg`, `.xml`, `.mhtml`, `.mht`. Test an all-caps name and a file with no extension.
Why	A downloaded games hub opens from the Downloads folder where no filter sees a request.
Where	Users & browsers › Content › URL blocking
Effort	15 minutes plus a device test
License	CEU

3. Developer tools off, chrome:// pages blocked


Do this	Developer tools = Never allow; block `chrome://flags`, `chrome://policy`, `chrome://extensions`.
Why	Dev tools and flags are how students disable extensions and rewrite pages.
Where	Users & browsers › User experience; Content › URL blocking
Effort	5 minutes
License	CEU


Do this	Block users from signing in to or out of secondary Google Accounts.
Why	A personal Gmail added inside the session bypasses every OU setting.
Where	Users & browsers › Sign-in settings
Effort	2 minutes
License	CEU

5. Turn off Linux and the Play Store


Do this	Linux virtual machines blocked; Android apps (Play Store) off for students.
Why	A Linux shell or an Android VPN defeats every browser policy you set.
Where	Users & browsers › Virtual machines; Apps & extensions › Play Store
Effort	5 minutes
License	CEU

6. Block Translate’s proxy, not Translate


Do this	Blocklist `*.translate.goog` and `translate.googleusercontent.com`. Keep `translate.google.com` and the translate bar on.
Why	The website-translation feature is a free proxy on a Google domain. The app is not, and ELL students need it.
Where	Users & browsers › Content › URL blocking
Effort	2 minutes
License	CEU

7. Turn off all five Google Lens policies


Do this	Lens Overlay, region search, camera assisted search, Gallery integration, New Tab button: all off; blocklist `lens.google.com`.
Why	Lens turns any page or image into a search box the filter can’t see, the fastest cheating tool on a Chromebook.
Where	Users & browsers › search “Lens”
Effort	10 minutes
License	CEU

8. Stop students killing the filter


Do this	Task manager: block users from ending processes.
Why	Ending the filter extension’s process turns it off.
Where	Users & browsers › Apps and extensions › Task manager
Effort	2 minutes
License	CEU

9. Turn off Apps Script for students


Do this	Service status Off at the Students OU.
Why	Apps Script web apps serve games and proxies from a Google domain your filter trusts. Removing the service beats any detector.
Where	Apps › Google Workspace › Google Apps Script
Effort	5 minutes
License	FREE

10. Block newly registered domains


Do this	Turn on the newly registered and newly observed domain categories, set to Block, on the student policy of your firewall or filter.
Why	Proxies live on domains a few days old that no blocklist has seen. Age is the signal.
Where	Your firewall or filter categories (slide 17)
Effort	10 minutes
License	FILTER

The problem

Filters block domains. Students borrow trusted ones.

The filter knows bad domains. iBoss, Lightspeed, Securly, and GoGuardian block what they recognize.
Students route around them through tools the filter can’t see, often hosted on Google’s own services.
Everyone loses time. Teachers police screens. IT plays whack-a-mole with new domains every week.

“sucks blocks every fun game and feel like someones watching my stuff”
Student, Chrome Web Store review, May 2026 (89 found this helpful)

Six ways around the filter

#	Technique	How it works	Who
1	Games hubs on Google Sites	A copied Google Site full of game embeds rides in on sites.google.com. Games load in cross-origin iframes, blob: and data: URLs, srcdoc iframes, about:blank tabs, and javascript: iframes.	Copy-paste
2	Apps Script launchers	A Google Apps Script web app serves the catalog or a proxy from script.googleusercontent.com.	Copy-paste
3	Web proxies	Ultraviolet, Scramjet, and Rammerhead rewrite every page through one host. Newer kits tunnel over a WebSocket with Wisp, Bare-Mux, and Epoxy, self-hosted on free serverless platforms.	Copy-paste
4	Attacks on the filter	Tab spam, Point-Blank history floods (pushState hundreds of times a second), and kits that try to disable or crash the filtering extension.	Copy-paste
5	Local HTML files	A downloaded .html opens from file://. No request, no URL, no domain to match.	Copy-paste
6	Obfuscated, self-hosted	Scrambled code on a brand-new domain. Nothing to match.	The 5%

How YSNP works

Four layers, one gate.

Layer	What it does	Strength
1 · Network blocklist	Hostname and URL rules Chrome enforces before a page loads. 48 static rules in 3.2.4 (41 in 3.2.3). 262 educational domains allowlisted on every rule. Obfuscation has no effect on a hostname block.	Holds firm
2 · Content-script inspectors	Runs on every page, plus sites.google.com and Apps Script frames. Fingerprints game launchers, proxy shells, and hub layouts, then replaces the page with a neutral notice.	Speed bump: stops the 95%, not the 5%
3 · Strict Sites mode (opt-in)	Default-deny for Google Sites embeds. Only allowlisted sources load (YouTube, Docs, Slides, Forms, your teachers’ tools).	Holds firm
4 · Managed configuration	A district-hosted JSON file, pointed to from Workspace Admin. Disable any detector, raise any threshold, allowlist or blocklist domains. Devices pick it up within about an hour.	Your kill switch

State testing, student information systems, assistive technology, and your filter’s own block pages are never touched. The tab-spam limit (14 tabs) is adjustable in managed config.

New in 3.2.4 (in testing)

Known hub hosts. Blocked by hostname, including the path a hub loads its SDK from.
Build fingerprints. Asset names pinned by integrity hashes match every mirror of one build. Expires with the next build.
S3 static sites. Blocks .html pages served from raw S3 buckets, with allowlist exclusions and its own toggle. Curriculum PDFs pass.
Inline signatures. Read at page start, even on a blank page: ad-fraud popunder calls, service-worker reload code, known hub globals.
Transport files (rule 1055). Scripts named like the Epoxy and libcurl transports proxies ship.
Tailscale Funnel (rule 1056). Blocks ts.net pages, scripts, and WebSocket tunnels. tailscale.com is untouched.

The new rules were checked in an offline simulation and for valid JSON, not yet in Chrome. Reload the extension and check for rule errors before you trust them.

What it does not stop

Obfuscated, self-hosted proxies on a brand-new domain
Games spawned from blob: or file: on arbitrary domains with novel payloads
A proxy that simply avoids flooding history
A local .html file, if webpage files under file:// aren’t blocked
A student disabling the extension. Only force-install prevents it.

What 3.2.4 still can’t block: the next build of the same hub; a host nobody has reported yet; a bare hub shell (blank page, service worker, forced reload); hubs on Bunny CDN or GitHub’s CDN; an S3 hub that isn’t an .html page; anything outside managed Chrome (phones, other browsers, home computers).

Heuristics are speed bumps for the 95%, not a wall against the 5%. What holds: the network blocklist, Strict Sites mode, and Workspace policy.

Brand-new domains: block them at the firewall

A proxy on a domain registered last Tuesday is on nobody’s blocklist, YSNP’s included. Its age is the signal. Your firewall or DNS filter can block every domain too new to have a reputation.

Newly registered. Anything registered in the last few weeks.
Newly observed or newly seen. The first time the vendor’s network sees the domain resolve.
Blocked until it ages out. Real sites graduate into normal categories; burner proxies are usually abandoned first.

Vendor	Category
Palo Alto Networks	`newly-registered-domain` URL category
Fortinet FortiGuard	Newly Registered Domain · Newly Observed Domain
Cisco Umbrella	Newly Seen Domains security category
Others	Search the category list for “new,” “newly seen,” or “domain age.”

Set it to Block on the student policy, not just Log.
Allowlist brand-new real sites (a teacher’s class site, a vendor launch) by hostname.
Add the same rule to your cloud or agent filter for take-home devices.

Recommended deployment

Force-install through Workspace Admin. Students can’t disable it.
Turn off Apps Script for students. Apps › Google Workspace › Drive and Docs › Google Apps Script › Service status Off for the Students OU.
Enable Strict Sites mode. Allowlist the embeds teachers actually use.
Set up managed config first. Kill switches ready before rollout.
Block local HTML. Webpage file types under file:// on the URL blocklist.
Stage the rollout. 5%, then 25%, then 100%. Watch for false positives at each step.
Keep your network filter. YSNP is one layer, not a replacement.

Settings A · Close the doors around the browser

Users & browsers, Students OU unless noted. YSNP assumes the Chromebook is already locked down. Items marked as password items apply only if your district sets student passwords.

Block local webpage files


Set to	Blocklist .html, .htm, .xhtml, .xht, .shtml, .shtm, .svg, .xml, .mhtml, .mht under file:// (test on a device)
Why	Each of these opens from the Downloads folder as a webpage, where no filter sees a request. Matching only webpage types leaves PDFs and images working.
Where	`Devices › Chrome › Settings › Users & browsers › Content › URL blocking`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: The pattern may be case-sensitive (GAME.HTML), and a file with no extension may still open as a webpage. Test both; if either gets through, block file://* instead. Exempt CS classes.

Extensions: allowlist only


Set to	Allow only listed extensions; block installs from outside the list
Why	VPN and proxy extensions are the #1 filter bypass.
Where	`Devices › Chrome › Apps & extensions › Users & browsers › Additional settings`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Accessibility tools for IEP and 504 students (text-to-speech, PDF annotation, dyslexia fonts) must be on the list first. Every new classroom tool becomes a request, so set up a fast approval form.

Chrome Sync on, extensions synced


Set to	Allow Chrome Sync · Remove Extensions from the excluded sync types
Why	Filter vendors install and re-arm their extension through sync. With Extensions excluded, Securly, GoGuardian or YSNP can fail to appear on a fresh profile or after a Powerwash.
Where	`Devices › Chrome › Settings › Users & browsers › Other settings › Chrome Sync (ChromeOS)`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: This is in Securly’s install steps and applies to every force-installed extension. If you excluded Extensions to stop students carrying personal ones, the allowlist on the previous slide already does that job. Save, then confirm on a test device after a sign-out.


Set to	Google online login frequency: 0 days · Google unlock frequency: 0 days
Why	Offline sign-in is a bypass: sign in with Wi-Fi off, spam-click the pinned filter extension before it loads, Wi-Fi back on, extension crashed. Google won’t let you disable pinning; an online sign-in removes the window.
Where	`Devices › Chrome › Settings › Users & browsers › Security › Google online login frequency · Google unlock frequency`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: 0 days means no sign-in without Wi-Fi. A cart in a dead spot or a field-trip bus becomes a ticket, so pilot on one building. GoGuardian and Securly admins report this as the fix; it protects any pinned extension, YSNP included.

Incognito off, history kept


Set to	Incognito: Disallow · Browser history: Always save · Clear browser history: Do not allow
Why	No activity should be invisible to monitoring. Two history policies: one saves the record, the other stops students wiping it.
Where	`Devices › Chrome › Settings › Users & browsers › Security › Incognito · Browser history · Clear history`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Kills the help desk’s “try it in an Incognito window” fix for sign-in and cache problems. Saved history is student data too, so cover it in your records and privacy policy.


Set to	Sign-in to secondary accounts: Block
Why	A personal Google account added inside the session bypasses every OU setting.
Where	`Devices › Chrome › Settings › Users & browsers › Sign-in settings › Sign-in to secondary accounts`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Dual-enrollment and early-college students need their college Google account, and some CTE certification programs need a vendor account. Give them a sub-OU where it’s allowed, or a college-issued device.


Set to	Device setting · Sign-in restriction: your district domain pattern
Why	Keeps personal Gmail off district hardware. The user-level pattern policy is for Chrome on Windows, Mac, and Linux, not Chromebooks.
Where	`Devices › Chrome › Settings › Device › Sign-in restriction`
Applies to	Device OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Blocks college accounts for dual-enrollment students on the device too, plus guest speakers and parents at conferences. Add the college’s domain for that OU; keep loaners for visitors.

One device at a time per student


Set to	Automatic sign-out across devices: On
Why	Stops one account being signed in on several Chromebooks at once, so students use their own accounts, not a shared one.
Where	`Devices › Chrome › Settings › Users & browsers › Search “automatic sign-out”`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: A student moving from a cart Chromebook to a loaner gets signed out of the first. Shared test or demo accounts will fight too; keep those in another OU.

Dev tools off, chrome:// blocked


Set to	Dev tools: Never allow · Blocklist chrome://flags, policy, extensions, settings/*, diagnostics
Why	Dev tools and flags are how students disable extensions and rewrite page content. chrome://diagnostics runs memory tests that appear to kill service workers, the filter’s included.
Where	Developer tools: `Devices › Chrome › Settings › Users & browsers › User experience › Developer tools` chrome:// pages: `Devices › Chrome › Settings › Users & browsers › Content › URL blocking`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: AP Computer Science, web design, and CTE programming classes need DevTools. Make a CS OU that allows it. Blocking chrome://settings also hides accessibility settings, so push those by policy.

Network prediction off


Set to	Network prediction: Do not predict network actions
Why	Prediction fetches pages before anyone navigates to them, ahead of the filter’s view of the tab. Admins running GoGuardian report students using it, and there is no instructional cost to turning it off.
Where	`Devices › Chrome › Settings › Users & browsers › Network › Network prediction`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: First loads are a touch slower; nobody notices on a Chromebook. The same admins call out side panel search and chrome://diagnostics; both are handled in this deck (Settings C, and the chrome:// blocklist two slides back).

Task manager can’t end processes


Set to	Block users from ending processes with the Chrome task manager
Why	Killing the filter extension’s process disables it. Students can still open the task manager; End process is dimmed.
Where	`Devices › Chrome › Settings › Users & browsers › Apps and extensions › Task manager`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: When a tab freezes mid-test, students can’t end it themselves and will have to restart the Chromebook. Tell proctors and teachers before testing season.

Safe Browsing: Enhanced


Set to	Enhanced protection; users can’t override warnings
Why	Blocks known-bad sites before the filter even sees them.
Where	`Devices › Chrome › Settings › Users & browsers › Security › Safe Browsing`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Enhanced mode sends URLs to Google for real-time checks, so mention it in your privacy notice. With no override, a false warning on a teacher’s or vendor’s site blocks students until IT allowlists it.

SafeSearch and YouTube Restricted


Set to	Force SafeSearch · YouTube Restricted Mode: Strict for K-8, Moderate for 9-12
Why	Baseline content filtering that still works if the extension filter fails.
Where	`Devices › Chrome › Settings › Users & browsers › Content › SafeSearch and Restricted Mode`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Strict Restricted Mode hides many legitimate videos on health, history, and current events. Teachers can approve videos, but only if they know how, so train them before the complaints start.

Block Translate’s proxy, not Translate


Set to	Blocklist translate.goog and translate.googleusercontent.com · Leave translate.google.com and the translate bar on
Why	Pasting a blocked URL into Translate’s Websites tab serves the page from a *.translate.goog address. That’s the proxy. The app on translate.google.com never proxies anything.
Where	`Devices › Chrome › Settings › Users & browsers › Content › URL blocking`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Don’t block translate.google.com or turn off the translate bar: ELL students and world-language classes rely on them, and neither is a bypass. For graded work, Forms locked mode turns translation off for that quiz.

Internet Archive and caches blocked


Set to	Blocklist archive.org (covers web.archive.org), webcache.googleusercontent.com, *.ampproject.org
Why	Archived copies of blocked pages slip past the filter, and archive.org itself hosts playable games and user-uploaded adult content.
Where	`Devices › Chrome › Settings › Users & browsers › Content › URL blocking`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Teachers and research classes use the Wayback Machine. Keep archive.org open for staff, and have teachers request specific pages for students.

Chrome Remote Desktop off


Set to	Service: Off · Remote support connections: Prevent · Firewall traversal: Disable
Why	Lets anyone with the account remote-control a district device from anywhere, bypassing every device and location check.
Where	Service: `Apps › Additional Google services › Chrome Remote Desktop` Remote support: `Devices › Chrome › Settings › Users & browsers › Remote access`
Applies to	All OUs
License	FREE + CEU Service switch is free. Host blocking on Chromebooks needs CEU.

Watch out: Leave Enterprise remote support connections allowed: that’s IT’s own path into a Chromebook from the Admin console. Keep an IT OU exception for the service too.

Block the password-change page


Set to	Blocklist two myaccount.google.com pages: /signinoptions and /smartlink/password
Why	Google has no admin switch that stops users changing their own password. Blocking the page does. /signinoptions also covers the passkey and 2-Step pages.
Where	`Devices › Chrome › Settings › Users & browsers › Content › URL blocking`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Only if your district sets student passwords (e.g., synced to PowerSchool). If students own their passwords by policy, skip this. It only works in managed Chrome.

Passkeys can’t replace the password


Set to	Allow users to skip their password and authenticate with a passkey: Off
Why	Students can still add a passkey, but it can’t stand in for the password. The password your district set stays required at sign-in.
Where	`Security › Authentication › Passwordless › Skip passwords`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: Passkeys resist phishing better than passwords, and some districts want them for students. Skip this if passkeys are part of your student sign-in plan.

Self-service recovery off


Set to	Allow users and non-super admins to recover their account: Off
Why	Stops students resetting their own password through Forgot password, the path the URL block can’t reach without breaking sign-in.
Where	`Security › Authentication › Account recovery`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: Every forgotten password becomes a teacher or help-desk reset, so have a fast reset path ready. This setting doesn’t apply if you use SSO or Password Sync.

Settings B · Lock the device itself

Device settings on the device OU unless noted. A Linux shell or an Android VPN defeats every browser policy, so close these first.

Play Store off for students


Set to	Android apps (Play Store): Off
Why	Sideloaded and Play Store VPNs, browsers, and games.
Where	`Devices › Chrome › Apps & extensions › Users & browsers › Play Store`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Some curricula, assistive technology, and CTE simulators ship as Android apps. If you need them, use a separate OU with a curated, force-installed app list and no store access.

Linux environment disabled


Set to	Linux development environment: Disabled
Why	A full Linux shell on a Chromebook defeats every browser policy.
Where	`Devices › Chrome › Settings › Users & browsers › Virtual machines › Linux`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: CS, robotics, and CTE programming classes often use Linux for Python or the Arduino IDE. Give them a supervised OU, or move them to cloud-based editors.

External storage read-only or off


Set to	External storage devices: Read-only or disallowed
Why	Stops files moving on and off the Chromebook by USB stick or SD card. It’s a user policy, so it follows the student.
Where	`Devices › Chrome › Settings › Users & browsers › Hardware › External storage devices`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Read-only blocks saving to a USB stick or SD card, which 3D printers, CNC machines, and cameras in CTE shops expect. Allow read-write for a CTE or makerspace OU.

Camera off for middle school


Set to	Video input: disable camera input for websites and apps. Leave Audio input (mic) as inherited.
Why	Middle schoolers reached proxies and landed on Omegle-style random video chat sites. No camera means no face-to-face with strangers, even when a proxy slips through.
Where	`Devices › Chrome › Settings › Users & browsers › Hardware › Video input`
Applies to	Middle school OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: This breaks Google Meet video and Clever Badge logins (badge scanning uses the camera). Add exceptions in Video input allowed URLs, e.g. meet.google.com and clever.com. External webcams are blocked too.


Set to	Screen video capture: Do not allow sites to prompt the user to share a video stream of their screen
Why	A shared screen streams a test, or a whole class period, to someone outside the room. It also closes the screen-share half of random video chat that the camera setting leaves open.
Where	`Devices › Chrome › Settings › Users & browsers › Search “Screen video capture”`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Students can’t present in Google Meet or record screencasts for projects (Screencastify, Loom, WeVideo). Add meet.google.com and your approved recorder to the “capture allowed by sites” lists on the same page, and test recorder extensions.

Powerwash disabled for users


Set to	Powerwash: Do not allow powerwash to be triggered
Why	Powerwash then developer mode is the classic unenroll attempt. Forced re-enrollment catches it, but blocking is cleaner.
Where	`Devices › Chrome › Settings › Device › Powerwash`
Applies to	Device OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: When a profile gets corrupted, teachers and students can’t reset the device themselves, so every fix becomes an IT ticket. Plan for that, or allow powerwash on staff devices.

Forced re-enrollment and verified access


Set to	Forced re-enrollment: On · Verified access: On
Why	Prevents un-enrolling or wiping the device to escape policy. It also disables developer mode; there’s no separate switch.
Where	`Devices › Chrome › Settings › Device`
Applies to	Device OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Devices you sell, donate, or return at the end of a lease must be deprovisioned first, or the next owner gets a locked brick. Put it on your disposal checklist.

Guest mode off, developer mode blocked


Set to	Guest mode: Disable · Developer mode: blocked by forced re-enrollment
Why	Guest sessions skip the student’s OU policy. K-12 domains default to Disable, but confirm it. Developer mode has no switch of its own.
Where	`Devices › Chrome › Settings › Device`
Applies to	Device OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: With guest mode off, substitutes, visitors, and new students whose accounts aren’t ready yet can’t use a device. Keep a few loaners in a separate OU, or create accounts the same day.

Screenshots off in assessment OUs


Set to	Screenshots: Disabled for assessment OUs; consider for all
Why	Students screenshot a test to share, or to feed to an AI on a phone.
Where	`Devices › Chrome › Settings › Users & browsers › Content › Screenshot`
Applies to	Assessment OUs
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Screenshots are also a study and accessibility tool, and how students report bullying. Keep them off only in assessment OUs; students with phones can still take a photo.

Sign out on lid close (shared carts)


Set to	Shorter sessions for cart and shared Chromebooks; sign out on lid close
Why	The next student shouldn’t inherit the last one’s session.
Where	`Devices › Chrome › Settings › Device`
Applies to	Cart / shared device OUs
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: A student who closes the lid to walk to another room loses unsaved work in apps that don’t autosave. Docs saves itself; many other tools don’t, so warn teachers.

Settings C · Cheating surfaces and AI

Set every AI item explicitly at the Students OU. The under-18 age label helps but doesn’t cover them all.

Google Lens off: all five policies


Set to	All five Lens policies off · Blocklist lens.google.com and images.google.com/searchbyimage
Why	Five separate settings: Overlay, region search, camera assisted search, Gallery app integration, and the New Tab Lens button. Miss one and a way in stays open.
Where	Lens settings (5): `Devices › Chrome › Settings › Users & browsers › Search “Lens”` Lens website: `Devices › Chrome › Settings › Users & browsers › Content › URL blocking`
Applies to	Students OU (all, not just assessment)
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Lens also reads text aloud from images and helps with research, so some IEP students may need an approved alternative. Staff keep Lens; apply the block to student OUs only.

Quick Answers off


Set to	Quick Answers: Disabled
Why	Highlighting a word pops up definitions, translations, and conversions without opening a tab. Same surface as Lens, smaller.
Where	`Devices › Chrome › Settings › Users & browsers › Content › Quick Answers`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Quick dictionary lookups help English learners and struggling readers. Where that matters, provide an approved dictionary or reading-support extension.

Side search and side panel off


Set to	Side search / Google side panel: Disabled
Why	Lets a student search without leaving the assessment tab.
Where	`Devices › Chrome › Settings › Users & browsers › User experience › Side search`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Honest students lose a quick research shortcut and will just open a new tab. It’s a speed bump; the real protection during tests is Forms locked mode.


Set to	Default search provider context menu: Disabled
Why	Highlight a question, right-click, get the answer.
Where	`Devices › Chrome › Settings › Users & browsers › Content › Default search provider context menu`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Also removes a research habit for honest students, and they can still copy and paste into a new tab. Treat it as a speed bump, not a lock.

Forms locked mode for quizzes


Set to	Locked mode: On for quizzes on managed Chromebooks
Why	Locks the quiz to one tab, blocks extensions, and turns off Lens, Translate, and side panel for that session.
Where	`Google Forms (teacher) › Settings › Quizzes › Locked mode on Chromebooks`
Applies to	Teacher setting, per quiz
License	FREE + CEU Free teacher setting. Only works on enrolled (CEU) Chromebooks.

Watch out: Only works on managed Chromebooks, so students on personal devices or iPads can’t take a locked quiz. It blocks accessibility extensions too; plan accommodations for IEP and 504 students.

Camera app blocked in assessment OUs


Set to	Block the ChromeOS Camera app during assessments; leave it on otherwise
Why	The Camera app can scan text and QR codes. Teachers use it for projects, so only block it in an assessment or locked-mode OU.
Where	`Devices › Chrome › Settings › Users & browsers › Assessment or kiosk / locked-mode OU`
Applies to	Assessment / kiosk OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Teachers put QR codes on worksheets and students photograph labs and projects. Block it only in assessment OUs, and remember moving students between OUs takes time to apply.

Filter: Generative AI, Academic dishonesty


Set to	Block the “Generative AI” and “Academic dishonesty” categories
Why	Photo-solver apps, answer aggregators, and third-party AI sites are the same threat outside Google.
Where	`Your web filter console › Categories`
Applies to	Student policy in your filter
License	FILTER VENDOR Not a Google license. Set in your web filter’s console.

Watch out: Broad AI categories also catch AI features inside tools you’ve approved, like design, writing-support, and tutoring apps. Allowlist district-approved AI tools explicitly.

Gemini app off


Set to	Gemini app: Off
Why	One of several AI switches the under-18 label doesn’t fully cover. Set it explicitly; don’t rely on inheritance.
Where	`Generative AI › Gemini app`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: If your district later approves Gemini for students, this is the switch to revisit. Tell teachers who plan AI lessons that it’s off, so they don’t build around it.


Set to	Conversation sharing: off · Gem sharing: “Allow people to share Gems from the Gemini app” off
Why	Shared chats and Gems leave the student’s account. A student-built Gem that does homework spreads to a whole grade in one link.
Where	`Generative AI › Gemini app › Sharing`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: Set it even if the Gemini app is off for students; the moment someone turns Gemini on for a grade, sharing is already closed. Staff can keep Gem sharing for collaboration.

Gemini history kept: no temporary chats, no deleting


Set to	Temporary chats: “Allow temporary chats” off · Conversation deletion: “Allow users to delete conversations” off
Why	Temporary chats skip Gemini Apps Activity, and deletion lets a student erase a chat after a cheating or safety incident. Keep the record.
Where	`Generative AI › Gemini app › Gemini conversation management`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: Students lose the ability to clear their own history, so say so in your AI guidance. For records you can actually produce, add a Vault retention rule for Gemini; Vault keeps data regardless of user deletions.

Gemini in Workspace off, per app


Set to	Off in Docs, Slides, Sheets, Forms, Gmail, Meet, and Vids
Why	Removes the Gemini side panel from every Workspace app. Education Plus lets you control each app separately.
Where	`Generative AI › Gemini in Workspace`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: New Gemini features appear in apps without much notice. Controlling each app separately needs Education Plus; on lower editions it’s closer to all or nothing.

NotebookLM off


Set to	Gemini Notebook / NotebookLM: Off
Why	An AI surface controlled separately from Gemini that can default to on.
Where	`Generative AI › Gemini Notebook`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: High school teachers may want NotebookLM for research projects. Consider allowing it for 9-12 after the district reviews it, rather than leaving it off by default forever.


Set to	Sharing outside of Students: OFF · Public Sharing: unchecked
Why	Notebooks hold student sources, questions, and AI output. If shared with consumer accounts, Google says that feedback can be used for model training.
Where	`Generative AI › Gemini Notebook › Sharing › Sharing outside of Students`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: Set it even while NotebookLM is off, so it’s ready when 9-12 gets access. If a class must share with a partner school, use ALLOWLISTED DOMAINS, never ON.

Workspace Studio off


Set to	Workspace Studio (AI agents): Off
Why	AI agents that act across Workspace have no place in a student account.
Where	`Newer consoles` `Agents menu` Otherwise: `Apps › Google Workspace › Workspace Studio`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: Mostly a staff tool. Check after Google’s releases that it hasn’t come back on for student OUs through inheritance.

Google Vids off


Set to	Off, unless a teacher requests it for a specific OU
Why	Vids is built around AI generation. Turn it on per class when there’s an instructional reason.
Where	`Apps › Google Workspace › Vids`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: CTE media and video-production classes may want Vids. Turn it on per OU for those classes, with its AI features reviewed first.

Meet AI notes and summaries off


Set to	“Take notes for me” and AI summaries: Off
Why	Students shouldn’t get AI-written notes of a class they didn’t attend to.
Where	`Apps › Google Workspace › Google Meet › Gemini features`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: Students with note-taking accommodations may need AI notes, or an alternative. Live captions are a separate setting and should stay on.

Gemini in Classroom: staff only


Set to	Keep On for staff; verify Off for students
Why	Teachers use it for planning. Check that it didn’t inherit On for the student OUs.
Where	`Apps › Google Workspace › Classroom › Gemini`
Applies to	Staff and Students OUs
License	FREE Education Fundamentals or any edition.

Watch out: Set it at the wrong OU level and teachers lose it too. This only works cleanly if staff and student OUs are separate.


Set to	Unconfigured apps blocked, no basic sign-in exception; never trust AI apps for students
Why	Sign in with Google is the front door to outside AI tools. Under-18 OUs block unconfigured apps already; the one choice left is the basic sign-in exception.
Where	`Security › Access and data control › API controls`
Applies to	Students OU
License	FREE Education Fundamentals or any edition.

Watch out: Blocking unconfigured apps also blocks legitimate ones that use Sign in with Google, like quiz, design, and learning apps. Review and trust approved apps before you flip the block.

Chrome generative AI features off


Set to	Everything in the Generative AI section: Disabled, including AI Mode and Gemini integrations
Why	Help me write, Compose, tab organizer, DevTools AI, Smart tab sharing, and more. Chrome policy, separate from Workspace.
Where	`Devices › Chrome › Settings › Users & browsers › Generative AI`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: “Help me write” also helps struggling writers. If a student’s IEP calls for writing support, provide an approved tool instead.

Gemini in Chrome off


Set to	Gemini in Chrome (side panel): Disabled
Why	An AI assistant beside every page, including the quiz.
Where	`Devices › Chrome › Settings › Users & browsers › Generative AI › Gemini integrations`
Applies to	Students OU
License	CEU Chrome Enterprise Upgrade: paid per device, bought with the Chromebook.

Watch out: Chrome releases add AI entry points and sometimes rename policies. Recheck this setting after each Chrome release.

Search AI Mode blocked


Set to	Blocklist google.com/aimode; web filter blocks the query-param variant
Why	The under-18 age label also restricts AI Mode, but the URL block and filter close the gaps.
Where	`Devices › Chrome › Settings › Users & browsers › Content › URL blocking`
Applies to	Students OU
License	CEU + FILTER Chrome policy needs CEU (paid, per device); the rest is your web filter.

Watch out: URL blocks are brittle: Google changes AI Mode’s address and parameters. Recheck after Search updates, and let your filter’s AI category be the backstop.

Test as a student every release


Set to	Sign in as a test student on an enrolled Chromebook and check every AI entry point
Why	No Gemini star in Docs or Gmail, no Lens on right-click, no AI Mode tab, gemini.google.com and notebooklm.google.com blocked, no Help me write. AI entry points arrive monthly.
Where	`Test student account › Enrolled Chromebook › Docs, Gmail, Search, Chrome`
Applies to	Test student account
License	FREE Nothing to buy: a test student account.

Watch out: Put the test account in the same OU as real students and test on an actual Chromebook. Some Workspace changes take up to 24 hours to reach everyone.

Workspace-side controls

Google Sites: creation Off. Viewing still works, hence Strict Sites mode. Apps > Additional Google services
Groups, Blogger, Photos, Maps sharing: Off.
Chat: Off K-5; internal-only, no external spaces 6-12.
Meet: students can’t create or join external meetings; host management on.
YouTube: set explicitly, not inherited. Sign-in required; approved-content mode K-8.
Drive: domain-only sharing, no link sharing, Drive for desktop off, offline off for carts.
Gmail: internal-only plus approved domains; no delegation. Contacts: no external directory sharing.
Review Chrome policy quarterly. Lens, AI, and Translate all shipped as bypasses.
Verify as a test student after every Chrome and Workspace release.

Additional Google services

“Inherited” means the root setting reaches students: override at the Students OU. Path: Apps › Additional Google services

Turn off now

Google Apps Script: Off. Now a core service; likely On and inherited. Apps > Google Workspace > Drive and Docs > Google Apps Script
Google Cloud Platform: the big one. Free-tier VMs and Cloud Run host proxies.
Colab: runs any code with network access. Off unless a CS OU needs it.
AI Studio: the Gemini API playground.
Chrome Web Store: removes browsing and requests. Force-installed extensions still update.
Messages by Google: texting from the Chromebook.
Google Play and Managed Google Play, to match the Chrome policy.
Photos, Blogger, Groups: still On at the root.
Early Access Apps: new Google products reach students before you review them.
Question Hub, Scholar Profiles, Third-party app backups. Scholar Profiles makes a public page under the student’s name.
Web & App Activity, Location History: data collection, not features.
No student use: Pay, Fi, Brand Accounts, Domains, Business Profile Manager, Ads, Ad Manager, Campaign Manager, Merchant Center, Search Console, Programmable Search Engine, Play Console, Play Books Partner Center, Partner Dash, FeedBurner, Analytics, Tag Manager, Search Ads 360, Developers, Material Gallery, Pinpoint, Alerts, Bookmarks.

Already Off: keep it

Search and Assistant (overridden): Search still works signed out; no Assistant, account AI Mode, or search history.
Socratic, Studio, Tables, Timeline. Timeline is Maps location history.

Keep On, or set explicitly

Keep On: Maps, My Maps, Earth, Arts and Culture, Books, News, Public Data, Translate, Chrome Canvas, Chrome Cursive, Applied Digital Skills, CS First. Scholar for high school.
YouTube: set explicitly to your Restricted Mode setup, not inherited.
Judgment call: Looker Studio for data or business classes.
Reconfirm yearly: Google requires re-reviewing Additional Services for under-18 users, or students lose access.

Filter by domain

Cheap domains are the proxy supply chain

96–100% of registrations in .xin .bond .cfd .today .lol were malicious (Interisle Consulting, 2025).
.top .cfd .bond .sbs lead the phishing counts; .cfd has the highest concentration of any generic TLD (Cybercrime Information Center, Feb–Apr 2026).

These rankings measure phishing and spam, not student proxies. But proxy operators chase the same thing scammers do: domains that cost under a dollar and get burned and re-registered constantly.

Four tiers

Tier	Action	What’s in it
1	Block outright	The “garbage” gTLDs. Near-zero collateral.
2	Block, then allowlist	Heavy proxy and unblocked-games use, but some real sites.
3	Block as a group	Foreign ccTLDs with no plausible instructional need.
4	Don’t block	Too much legitimate collateral. Handle these by hostname.

Tier 1 · Block outright (52)

.cfd .sbs .bond .xin .top .icu .cyou .qpon .bid .lol .click .win .party .review .download .loan .work .men .date .racing .stream .trade .science .monster .rest .bar .buzz .support .help .world .today .vip .pro .zip .mov .quest .cam .beauty .hair .skin .makeup .autos .boats .motorcycles .yachts .homes .lat .ink .wiki .army .navy .airforce

Watch out: a few real sites live on .pro, .help, .support, .world, and .wiki. Allowlist those by hostname. .zip and .mov are here because they look like file names in a link.

Tier 2 · Block, then allowlist (27)

.xyz .site .online .space .live .fun .shop .store .website .tech .one .club .life .ltd .link .pw .ws .cc .nu .to .ly .fm .gg .me .cx .ru .su

Known collateral	Allowlist
.ly	bit.ly short links in teacher slides and handouts
.gg	discord.gg invites and esports club sites
.me	student and teacher portfolio sites
.fm	podcasts and school radio streams
.tech .online .site	small edtech startups

Tier 3 · Block as a group. Essentially every ccTLD outside the US, minus the handful students legitimately hit.

Freenom five (about 99% of their domains were gone by March 2024; block anyway):

.tk .ml .ga .cf .gq

High-churn ccTLDs:

.cn .ru .su .ir .pk .ng .id .vn .in .br .mx .ar .cl .ve .ua .by .kz .uz .ke .tz .ug .za .eg .ma .sa .ae .tr .my .th .ph .bd .lk .np

Watch out: world language classes read news and media from .mx, .ar, .cl, .br and others. Allowlist those sites for the teachers who ask.

Tier 4 · Don’t block

.com .net .org .edu .gov .mil .us .io .ai .app .dev .co .info .tv .uk .ca .de .fr .es .it .nl .se .no .dk .fi .ie .au .nz .jp .kr .eu .ch .at .be

Blocking .io .ai .app .dev breaks developer tools, AI sites teachers use, and web apps. Handle those by hostname.

The catch: today’s proxies live on free hosts

Most 2026 proxy forks (Ultraviolet, Interstellar, Rammerhead) sit on free hosting subdomains under Tier 4 TLDs, so TLD rules never catch them. Block by hostname pattern; the full list is in the next section.

Free hosting: GitHub Pages, Vercel, Netlify, Cloudflare Pages and Workers, Replit, Render, Fly, Heroku, Firebase, Wix, Weebly, Neocities, and more.
Cloud and PaaS: Hugging Face Spaces, Cloud Run, App Engine, AWS Amplify, Azure, Codespaces, Streamlit, Gradio.
AI site builders: Lovable, Bolt, v0, Base44. Students spin up a proxy in minutes from a prompt.
Tunnels: ngrok, trycloudflare, loca.lt, serveo. They expose a proxy running on a laptop or a home box.
Free web hosting: the InfinityFree, Byet, and iFastNet family. They rotate brands constantly.
Free subdomains and dynamic DNS: DigitalPlat FreeDomain (us.kg, dpdns.org, qzz.io, xx.kg) filled the hole Freenom left. Also No-IP, DuckDNS, afraid.org, ClouDNS.
Google Sites: YSNP’s Strict Sites mode covers it without blocking every Site.

Watch out: real class work lives on these hosts too: CS projects on github.io and CodeSandbox, teacher sites on Wix and Weebly, apps on web.app. Allowlist by full hostname, never the whole pattern. Run .cloudfront.net, .squarespace.com, .run.app, and .azurewebsites.net in monitor-only mode first. Skip docs.google.com path entries unless your filter matches paths.

You can’t block a registrar. You can block a young domain.

NameSilo, Namecheap, Dynadot, Sav, Spaceship, Porkbun, Gname, NiceNIC, Dominet, Alibaba, and Key-Systems show up often in abuse reports, but the registrar is never in the URL. Filters with WHOIS or RDAP enrichment (Palo Alto, Cisco Umbrella, Zscaler, some Lightspeed tiers) can act on domain age instead.

The one rule to set: registered < 30 days → block (student policy).
No domain-age data? Use the firewall’s newly registered and newly observed categories instead.

Hostname blocklist

Student policy, by hostname pattern. Wildcard syntax varies by vendor; check whether yours wants *.example.com, .example.com, or example.com to cover subdomains. If your filter rejects *.byethost*.com, list each byethost host instead.

Free hosting (25)

*.github.io
*.vercel.app
*.netlify.app
*.pages.dev
*.workers.dev
*.replit.app
*.repl.co
*.glitch.me
*.onrender.com
*.koyeb.app
*.fly.dev
*.herokuapp.com
*.railway.app
*.surge.sh
*.firebaseapp.com
*.web.app
*.gitlab.io
*.codesandbox.io
*.stackblitz.io
*.deno.dev
*.cyclic.app
*.000webhostapp.com
*.weeblysite.com
*.wixsite.com
*.neocities.org

Cloud and PaaS (25)

*.hf.space
*.huggingface.co
*.run.app
*.appspot.com
*.amplifyapp.com
*.azurewebsites.net
*.azurestaticapps.net
*.cloudfront.net
*.app.github.dev
*.gitpod.io
*.val.run
*.deno.net
*.nf.app
*.netlify.com
*.zeabur.app
*.leapcell.app
*.bytebase.app
*.back4app.io
*.adaptable.app
*.replit.dev
*.bitbucket.io
*.sourceforge.io
*.pythonanywhere.com
*.streamlit.app
*.gradio.live

AI site builders (4)

*.lovable.app
*.bolt.host
*.v0.dev
*.base44.app

Tunnels (9)

*.ngrok.io
*.ngrok-free.app
*.ngrok.app
*.trycloudflare.com
*.loca.lt
*.serveo.net
*.pinggy.link
*.tunnelmole.com
*.bore.pub

Site builders (14)

*.carrd.co
*.tiiny.site
*.static.app
*.strikingly.com
*.webflow.io
*.framer.app
*.framer.website
*.editorx.io
*.squarespace.com
*.godaddysites.com
*.yolasite.com
*.webnode.page
*.jimdosite.com
*.mystrikingly.com

Free web hosting (24)

*.infinityfreeapp.com
*.rf.gd
*.great-site.net
*.epizy.com
*.42web.io
*.wuaze.com
*.unaux.com
*.lovestoblog.com
*.byethost.com
*.byethost*.com
*.awardspace.com
*.freehostia.com
*.x10host.com
*.x10.mx
*.freewebhostingarea.com
*.ueuo.com
*.orgfree.com
*.6te.net
*.atwebpages.com
*.000webhost.com
*.freesite.online
*.ezyro.com
*.kesug.com
*.hostingersite.com

DigitalPlat FreeDomain (4)

*.us.kg
*.dpdns.org
*.qzz.io
*.xx.kg

Other free subdomains (7)

*.is-a.dev
*.js.org
*.pp.ua
*.eu.org
*.cu.ma
*.co.nf
*.c1.biz

Dynamic DNS (39)

*.ddns.net
*.ddns.org
*.no-ip.org
*.no-ip.com
*.no-ip.biz
*.no-ip.info
*.hopto.org
*.zapto.org
*.sytes.net
*.myftp.org
*.myftp.biz
*.serveftp.com
*.servehttp.com
*.redirectme.net
*.myvnc.com
*.duckdns.org
*.dynu.net
*.dynu.com
*.dynv6.net
*.freeddns.org
*.mooo.com
*.chickenkiller.com
*.crabdance.com
*.strangled.net
*.ignorelist.com
*.jumpingcrab.com
*.twilightparadox.com
*.afraid.org
*.nsupdate.info
*.spdns.de
*.dyndns.org
*.dnsalias.com
*.cloudns.cl
*.cloudns.net
*.cloudns.ch
*.cloudns.nz
*.cloudns.be
*.freeboxos.fr
*.ydns.eu

Why we block Coolmath Games

A district policy decision, from what Coolmath says about itself (coolmathgames.com/parents):


Multiplayer games	Yes, with random players online
Free typing	Never: emojis and pre-screened phrases
Usernames	Random, no personal info
Ads	Behavioral; under-13s sent to Coolmath4Kids

Despite the name, the catalog is almost all games, and it shows up on “games not blocked at school” lists.

Add coolmathgames.com to your web filter or the Chrome URL blocklist for student OUs. If a school uses it for indoor recess, allow it for that OU only.

Project posture and the ask

Free, forever. No paid tier, no upsell.
No data collection. Nothing about students leaves the device.
Three permissions: storage, webNavigation, declarativeNetRequest.
Idle pages cost nothing. Event-driven scanning, not polling.
Every detector can be turned off, individually, from managed config.
A public changelog that documents its own bugs, too.

Try it this month: pilot it on one classroom’s OU. Force-install it there, turn on Strict Sites, set up managed config, and watch it for a week. Get it free at TeacherMagic.org or from the Chrome Web Store: https://chromewebstore.google.com/detail/you-shall-not-pass-by-tea/efggnkbeomjjanjmghbadggegjemogee

“If a Chrome extension has a bunch of 1-star ratings from angry students who are blocked from playing games on their school devices, that should act as all the testimonial you need.”
Admin, Chrome Web Store review, Aug 2026

Jim Tyler · MAEDS 2026 · An independent project, written and published on my own time. Free to use and share. Admin console paths, Group Policy paths and scanner rule names move between releases; if one is wrong, tell me.