How to Block Online Games on School Networks and Chromebooks
Game sites are the most requested block in K-12 and the hardest to keep closed. This guide covers browser games, "unblocked games" mirrors and cloud gaming, with methods that hold up at school and at home.
What "online games" means on a school network today
Ten years ago blocking games meant blocking a few flash portals. Now games arrive through five different routes, and each one needs its own control.
Game portals
Large sites hosting hundreds of free browser games.
Control: gaming category"Unblocked" mirrors
Copies of popular games on new domains and free site builders.
Control: new domain coverageCloud gaming
Full console and PC games streamed into a browser tab.
Control: domain and category blockAndroid apps
Game apps installed from Google Play on Chromebooks.
Control: app store policyOffline files
Games saved as HTML files and opened from the device.
Control: local file blockingLet the Gaming category absorb every new portal
Our hosted CIPA filter is run by us as a DNS filter in front of your schools, so a game site is refused as soon as its domain is filed under Gaming. You do not wait for a student to report the next mirror.
- Portals, cloud gaming and mirror domains fall under the same school setting.
- The learning games your teachers rely on go on the always-allow list for that school.
- Changes reach every school in seconds, with nothing to install on the devices.
Why schools block game sites
Game blocking is not a CIPA requirement. Districts do it under their acceptable use policy, and these are the reasons that usually win the argument with staff and parents.
Classroom focus
Teachers report games as the top off-task activity on 1:1 devices. A tab switch takes a second.
Bandwidth
Cloud gaming streams continuous high-resolution video. A handful of streams can slow a building during testing.
Security
Free game mirrors are often ad-heavy and carry malicious redirects. See malware and phishing protection for schools.
Chat with strangers
Many multiplayer games include open text or voice chat with unknown adults.
In-game spending
Loot boxes and in-game currencies blur into gambling-like mechanics for younger students.
Fairness
When some students game and others work, teachers spend time policing instead of teaching.
Unvetted content
Portals mix harmless puzzles with violent or mature titles. Students reach both with one click, with no age rating shown.
Device wear and battery
Heavy 3D games drain Chromebook batteries before the afternoon. Students then arrive at class with a dead device.
Game portals and a math site that straddles two labels
Most game portals are plain Gaming. Coolmathgames is filed under Education/Reference as well, which is why you decide the category and the exceptions together. Cloud gaming is not always labelled the same way: GeForce NOW sits under Computers & Technology, so check it by name.
| Domain | Category labels |
|---|---|
| poki.com | Gaming |
| crazygames.com | Gaming |
| miniclip.com | Gaming |
| now.gg | Gaming |
| coolmathgames.com | Education/Reference, Gaming |
| geforcenow.com | Computers & Technology |
The four-ring model for blocking games
Think of game blocking as rings around the student. Each ring catches what the outer one misses. Most failures happen because a district relies on only one ring.
account
- Ring 1: network DNS and firewall
Blocks the gaming category for every device on school Wi-Fi, managed or not. Stops at the school gate.
- Ring 2: category filter on the device
A force-installed filter extension or device DNS setting that applies categories wherever the Chromebook goes.
- Ring 3: Google Admin policy
URL blocklist, app store rules, local file blocking and closed side doors such as guest mode.
- Ring 4: the student account
Restricting sign-in to school accounts so every rule above actually applies to the person at the keyboard.
Ring 1: category blocking on the school network
The Gaming category is the core of every game block. A domain often carries more than one category, so a game portal is still caught when it also looks like an entertainment or blog site.
Categories to block for student policies
- Gaming: game portals, game publishers, cloud gaming, game news with play features
- VPN / Proxy / Anonymizers: the first thing students try after a game block
- Parked / For-Sale Domains: often recycled into mirror sites
- Malware / Phishing / Suspicious: catches ad-laden mirrors that redirect
- Gambling: for casino-style games and skin betting
Why new domain coverage matters
Mirror sites move when they are blocked. A list that is refreshed monthly will always be behind.
Our category data covers about 300,000 newly registered domains a day and checks each again after a week and after a month, because many sites add their game content after launch.
See the full web filtering categories taxonomy.
Rings 2 to 4: Google Admin console settings for game blocking
Apply these to student organizational units only. Staff and IT accounts usually need fewer restrictions. Search the settings page by keyword if a label has moved.
URL blocking and local files
- Open
Devices > Chrome > Settings > Users & browsers. - Pick the student OU in the left panel.
- In URL blocking, add the game portals and cloud gaming domains students use most.
- Consider adding
file://*to the blocklist to stop locally saved HTML games. Test first, since it also blocks other local files. - Add any approved learning game domains to the exceptions list.
Apps, extensions and side doors
- Open
Devices > Chrome > Apps & extensions > Users & browsers. - Set Chrome Web Store and Google Play to approved items only.
- Set any installed game app to Block, which also removes it.
- Force-install your filter extension so it cannot be removed.
- Back in Users & browsers, disallow Incognito, prevent guest browser logins and restrict developer tools.
Cloud gaming: the block most districts miss
Cloud gaming services stream full console and PC titles into a Chrome tab. Nothing is installed, so app rules do not help. They need their own entries.
| Service type | Where it runs | How to block |
|---|---|---|
| Console cloud gaming | A play section of a console maker's website, for example xbox.com/play | Block the path or host in URL blocking and rely on the gaming category in your filter |
| PC cloud gaming | A dedicated web player, for example play.geforcenow.com | Block the player host; categorize as gaming in your filter |
| Mobile game streaming sites | Sites that run Android games in the browser | Gaming category plus new domain coverage |
| Remote desktop to a home PC | Remote access tools used to reach a gaming PC | Block the Remote Access Tools category for students |
Time-based rules: lunch, clubs and after school
A total ban is simple, but many schools find a schedule more sustainable. It reduces bypass attempts and supports esports clubs and game design classes.
| Time window | Gaming category | Cloud gaming | Learning games |
|---|---|---|---|
| Class periods | Blocked | Blocked | Allowed |
| Lunch (secondary) | Optional, approved list only | Blocked | Allowed |
| Esports club (staff-led) | Club titles only | Per club policy | Allowed |
| Evenings at home | District decision | Blocked on school devices | Allowed |
| Testing windows | Blocked | Blocked | Blocked |
Schedules only work if your filter supports time rules. Keep the schedule visible to teachers so nobody is surprised when a game opens at lunch.
Running a learning games allowlist that teachers trust
A gaming block only survives if teachers can get real learning games approved quickly. Without a clear process, exceptions pile up in emails and nobody remembers why a site was opened.
Approval criteria
- Tied to a named course, unit or learning goal
- No open chat with strangers, or chat that can be switched off
- No in-game purchases or loot box mechanics for students
- Ads limited or absent, and no redirects to other game sites
- Privacy terms reviewed under your student data agreement process
- Works with student accounts, without personal sign-ups
Request workflow
- Teacher submits the site, course and grade through one form
- IT checks the domain category and the hosts the game loads
- Approved domains go into the exceptions list for named OUs only
- Each exception gets an owner and a review date
- At term end, unused exceptions are removed
Short notes for common network setups
The exact screens differ by product, but the logic is the same everywhere. Use these notes as a checklist when you open your own console.
| Setup | Where the game block lives | Common gap |
|---|---|---|
| Next-generation firewall | Web or URL filtering profile attached to student zones or VLANs | Profile attached to the wrong zone, so guest Wi-Fi stays open |
| Cloud DNS filter | Policy for the student network or device group, gaming category set to block | Devices using their own encrypted DNS, which bypasses the resolver |
| On-premise DNS resolver | Response policy zone or blocklist fed from your category data | Outbound DNS to outside resolvers not blocked at the firewall |
| Wireless controller | Application control or content rules per SSID | Rules only on one SSID; students join another |
| Hosted filter for Chromebooks | Category policy per OU, pushed by extension or device settings | Extension not force-installed on new devices |
Off-campus coverage for take-home devices
Network rules end at the school gate. Rings 2 to 4 are what keep the block on a Chromebook at a kitchen table or in a coffee shop.
What follows the device
- Google Admin URL blocklist and exceptions
- App and extension store restrictions
- A force-installed category filter extension
- Device DNS or proxy settings pushed from the console
What stays at school
- Firewall web filtering profiles
- The school DNS resolver policy
- SSID and VLAN based rules
- Bandwidth shaping for cloud gaming
For a full plan, read how to enforce CIPA on off-campus student devices and our page on Chromebook 1:1 device filtering.
Handling bypass attempts
Searches for "games not blocked at school" are constant. Expect attempts and plan a calm response. This section is for administrators: it describes what to watch for, not how to do it.
Signals in your logs
- Many blocked hits on new, unfamiliar domains in a short time
- Traffic to free site builders with game-like page names
- Requests to proxy and VPN categories after a game block
- Extension install attempts that the store policy rejected
Fixes that last
- Rely on categories and new domain coverage, not a hand list
- Block the VPN and proxy category, see blocking proxy sites in schools
- Keep extensions on an approved-only list
- Block local files if offline game copies spread
Keep the unblocker route closed too
Students who lose a portal usually reach for a proxy next, so VPN / Proxy / Anonymizers is switched on in the CIPA preset. Public encrypted DNS and browser settings that skip the filter are blocked by default as well.
Testing your game block
Test from a real student account on a managed Chromebook. Do it on school Wi-Fi, then again on a home network or phone hotspot.
- A major game portal shows your block page
- Two mirror sites not on your manual list are blocked by category
- Cloud gaming players are blocked
- Game apps cannot be found in the Play Store
- A locally saved HTML file does not open, if you block file URLs
- Incognito and guest mode are unavailable
- Approved learning games still load
- Time rules switch at the right minute
- The same results appear off campus
- Results are recorded with date and OU
Use the school web filter test for a repeatable plan, and the domain checker to see how any game domain is categorized.
Talking to parents and teachers about game blocking
Parents usually support a game block on school devices. What they want is clarity on what is blocked, when, and what that means at home.
Points for a parent letter
- Game sites and cloud gaming are blocked on school Chromebooks and networks
- Learning games chosen by teachers stay available
- The block follows school devices home; personal devices are the family's choice
- Students who need a site for schoolwork can ask their teacher
- The reason: focus in class, safety and network capacity
Points for teachers
- How to request a learning game for the allowlist
- Expected turnaround for a request, set by your IT team
- What to do when a student shows a game that got through
- Esports and game design classes: how their exceptions work
- Where the rule sits in the acceptable use policy
Four rings by hand or a hosted DNS filter for the network ring
The network ring is the one that costs the most upkeep, so this table compares just that part.
| Need | Own firewall profile | Hosted CIPA filter |
|---|---|---|
| Unblocked-games mirrors on new domains | Waits for a profile update or your edit | Blocked once the domain is filed as Gaming |
| Cloud gaming hosts | Hand-typed entries | Category switch plus entries on the per-school lists |
| Learning games to keep open | Exceptions in every profile | Always-allow list for each school |
| Clubs and lunch hours | A separate profile to schedule | Settings kept per school, changes applied in seconds |
| Chromebook away from the building | School firewall is out of reach | Private encrypted link keeps the rules |
| Report on blocked game attempts | Parsed from raw logs | Activity reports and log export |
FAQ: blocking games in schools
Why do "unblocked games" sites keep getting through the school filter?
They are copied onto new domains and free site builders constantly. A manual list cannot keep up. Category blocking with coverage of newly registered domains, plus blocking local HTML files and unapproved extensions, closes most of the gap.
Can we block cloud gaming without blocking all video?
Yes. Cloud gaming services run on their own domains and are categorized as gaming. Block those domains and the gaming category for students while keeping your streaming media rules separate.
Should schools block every game?
Most districts block the gaming category for students during the school day and allowlist learning games teachers have requested. Some open a small set of games at lunch or in after-school clubs using time-based policies.
Do game blocks follow Chromebooks home?
Network blocks do not. Google Admin URL blocking, app store restrictions and a device-based filter do follow the device. Many districts apply a lighter after-hours policy at home but keep the gaming block on school-owned devices.
Is blocking games a CIPA requirement?
No. CIPA covers obscene images, child sexual abuse material and content harmful to minors. Games are blocked for focus, bandwidth and security reasons under the district's own acceptable use policy.
How do we keep learning games working?
Keep an allowlist of approved learning game domains that overrides the gaming category block. Review it each term with teachers, and test each game after filter changes.
Pricing depends on how many schools and devices you have, and a quote follows within one business day. Piloting the game block in a single building lets you check the blocks and reports first.
Stop chasing game mirrors one domain at a time
Our gaming category is refreshed daily with newly registered domains, so mirrors are caught without manual list edits. Tell us how your district filters today and we will show you where it fits.
Talk to us about your districtXbox is a trademark of Microsoft Corporation. GeForce NOW is a trademark of NVIDIA Corporation. Google, Chrome, Chromebook and Google Play are trademarks of Google LLC. These names are used here only to identify the products discussed. CIPA Web Filtering is not affiliated with, sponsored or endorsed by these companies.