How to Block Proxy Sites in Schools
Proxy sites are the oldest way around a school filter, and still the most common. They change domains constantly, so blocking them is less about lists and more about categories, fresh data and closing whole families of routes at once.
What this guide covers
- The families of proxy routes
- Why manual lists fall behind
- A layered control matrix
- Google Admin, DNS and firewall steps
- Off-campus, logs, response and testing
- Talking to parents and staff
Why schools must block proxy sites
A proxy site fetches other websites on the student's behalf. The school filter sees only the proxy, so every other category rule stops working for that session.
CIPA protection
The technology protection measure only works when traffic passes through it. A proxy can hide adult content from the filter.
Malware and scams
Free proxy sites earn money from aggressive ads and redirects. Many carry malicious scripts or fake downloads.
Data exposure
Students may sign in to school accounts through a proxy, handing their passwords to an unknown operator.
Safety visibility
Alerts for self-harm or threats depend on seeing traffic. A proxy removes that visibility.
Close the proxy route in the same place you block everything else
Our hosted CIPA filter turns VPN / Proxy / Anonymizers on in its CIPA preset, and we run the DNS service behind it for your schools. A proxy address is refused at the lookup, before a student can type anything into its address box.
- Public encrypted DNS and browser settings that skip the filter are blocked by default.
- Staff can use a logged PIN for adult research, and the proxy category stays blocked even then.
- The rules follow a laptop through a private encrypted link, so home Wi-Fi is no escape.
Six families of proxy routes
You do not need to study each trick. You need to recognize the families, because each one is closed by a different control. This overview is for administrators, not a how-to.
Web proxy sites
Pages with an address box that load other sites inside them.
Closed by: VPN / Proxy / Anonymizers categoryMirror and copy sites
Copies of blocked sites, such as game or video sites, on new domains.
Closed by: new domain coverage plus content categoriesSelf-hosted proxies on free hosting
Proxy software deployed by students on free hosting or site builders.
Closed by: categorization of hosted subdomainsFetch-and-display services
Legitimate tools such as translators or page caches used to view blocked pages.
Closed by: log review and policy, not blanket blocksExtensions and apps
Browser extensions and Android apps that tunnel traffic.
Closed by: approved-only storesRemote access
Remote desktop tools that show a home computer's browser.
Closed by: Remote Access Tools categoryExtensions and apps have their own guide: how to block VPN extensions on school Chromebooks.
Known proxies and the public DNS names that look similar
Web proxies and VPN sites are labelled VPN / Proxy / Anonymizers. Public DNS names such as dns.google are not proxies and sit under Computers & Technology, so the filter treats them with its own default block for DNS that skips the school.
| Domain | Categories in our data |
|---|---|
| croxyproxy.com | VPN / Proxy / Anonymizers |
| proxysite.com | VPN / Proxy / Anonymizers |
| hide.me | VPN / Proxy / Anonymizers |
| protonvpn.com | VPN / Proxy / Anonymizers |
| torproject.org | VPN / Proxy / Anonymizers |
| dns.google | Computers & Technology |
The life of a proxy domain, and why lists fall behind
A typical proxy domain spreads through a school in days. A list maintained by hand reacts after the spread. Category data built for new domains reacts before it.
Manual list approach
- Starts from teacher reports and log spotting
- Always one step behind the next copy
- Takes staff time every week
- Misses proxies nobody has reported yet
Category data approach
- About 300,000 newly registered domains categorized daily
- Each one rechecked after a week and after a month
- Catches domains that launch empty and add proxy content later
- Daily delta updates reach your filter without manual edits
You do not chase the next proxy, the category does
Our hosted CIPA filter blocks by category, and the lists you keep are only the always-allow and always-block entries for each site. Changes you make there apply in seconds.
The layered control matrix
No single control closes every family. This matrix shows which control covers which route, so you can spot the gaps in your own setup.
| Route | Proxy category in filter | New domain coverage | Admin console stores | Network DNS or firewall | Log review |
|---|---|---|---|---|---|
| Web proxy sites | Yes | Yes | No | On campus | Helps |
| Mirror sites | Partly | Yes | No | On campus | Helps |
| Self-hosted proxies | Yes | Yes | No | On campus | Key |
| Fetch-and-display tools | No | No | No | Partly | Key |
| Extensions and apps | Download sites only | No | Yes | Partly | Helps |
| Remote access | Remote Access Tools | Partly | Yes | On campus | Helps |
Yes: closes the route. Partly: closes some cases. On campus: only while on the school network. Key: the main way to find it.
Proxy rules by group
| Group | Proxy and anonymizer category | Remote access tools | Parked domains | Notes |
|---|---|---|---|---|
| Elementary students | Block | Block | Block | Simplest, strictest policy |
| Secondary students | Block | Block | Block | Add weekly log review |
| Teachers | Block | Approved tools | Block | Teachers rarely need proxies |
| IT staff | Allow for testing | Allow | Allow | Separate OU and network |
| Guest Wi-Fi | Block | Block | Block | Students use it on phones |
IT staff who test filters need proxy access, but keep it on a separate OU and network segment so a staff exception never reaches students.
Configuration steps: filter, Google Admin, DNS and firewall
Apply these to student policies first. Labels in each console change over time, so search by keyword when a name differs.
- Block VPN / Proxy / Anonymizers for every student policy.
- Block Parked / For-Sale Domains, which are often turned into proxies.
- Block Remote Access Tools for students.
- Keep Malware / Phishing / Suspicious blocked for everyone.
- Turn on daily updates so new domains arrive automatically.
Full list: school web filtering categories.
- In
Devices > Chrome > Apps & extensions > Users & browsers, set the Chrome Web Store and Google Play to approved items only, and force-install the filter. - In
Devices > Chrome > Settings > Users & browsers, disallow Incognito, prevent guest logins and restrict sign-in to school accounts. - Set proxy mode so users cannot configure their own proxy.
- Set the DNS-over-HTTPS mode so the browser keeps your resolver.
- Add any proxy domains you see repeatedly to URL blocking as a backstop.
- Block the proxy, parked and remote access categories on student and guest networks
- Force DNS through your resolver: block outbound DNS to any other server
- Watch for blocked lookups on new domains in bursts
- Remember DNS sees host names, not paths, so proxies on shared hosting need care
Read the CIPA DNS filter for education.
- Block the proxy and anonymizer category in the URL filtering profile for student zones
- Use application control for known tunnelling and remote access apps where available
- Enable HTTPS inspection on student networks only where policy and law allow, so full URLs are visible
- Attach the profile to every student SSID and VLAN, plus guest Wi-Fi
Compare approaches: web filtering vs DNS filtering.
Getting fresh proxy data into the tools you already run
Many districts run a mix of firewall, DNS resolver and Chromebook filter. The proxy category is only useful if every one of them gets the same fresh data.
| Your tool | Format it accepts | How updates arrive |
|---|---|---|
| On-premise DNS resolver | DNS response policy zone (RPZ) or hosts-style list | Daily delta files loaded on a schedule |
| Firewall | External dynamic list (EDL) of domains | The firewall polls a list you host |
| Home-lab style DNS filters | AdGuard or Pi-hole style blocklist | List refresh on a timer |
| Proxy or browser config | PAC file rules | Regenerated with each update |
| Your own tools and scripts | CSV, Parquet or JSON, plus a lookup API | Daily delta files and on-demand lookups |
Export formats are available to licensed customers and run inside your own systems, including air-gapped networks. See the category database.
Questions to ask about any proxy category
How fresh is it?
Ask how quickly a newly registered domain receives a category, and whether it is rechecked later.
How is it measured?
Ask for validation reports that show measured accuracy for the categories you rely on.
Does it handle hosting?
Ask how proxies on shared hosting and site builder subdomains are labeled.
Can every tool use it?
Ask whether the same data can feed your DNS, firewall and Chromebook filter at once.
Proxy-like tools you will probably keep
Some useful services fetch and display other pages as part of their job. Blocking them outright hurts learning more than it helps. Watch them instead.
Translation tools
Essential for multilingual learners and families. Review logs for whole-site translation of blocked domains.
Search caches and previews
Part of normal search. SafeSearch enforcement limits explicit results.
Accessibility readers
Reader and text-to-speech tools fetch pages to present them differently. Approve vetted tools.
Remote support for IT
IT staff need remote access tools. Allow them for staff OUs, block them for students.
If misuse becomes common in one school, a short lesson on why the filter exists often works better than closing a tool that other students need. Digital citizenship lessons that explain the safety reasons behind the filter reduce attempts over time.
Off-campus: proxy blocking on take-home Chromebooks
At home, there is no school DNS or firewall. Only device-level controls and the filter on the Chromebook stand between a student and a proxy.
Keeps working at home
- Force-installed filter extension with the proxy category on
- Approved-only extension and app stores
- Proxy mode locked, Incognito and guest mode off
- Admin console URL blocklist for repeat offenders
- Device DNS or proxy settings pushed by the console
Stops at the school gate
- Firewall URL filtering and application control
- School DNS resolver policy
- HTTPS inspection on the campus network
- SSID and VLAN based rules
For a full plan, see enforcing CIPA on off-campus student devices and Chromebook 1:1 device filtering. If you have no off-campus filter yet, our hosted CIPA filter is one route to look at.
A weekly log routine that finds proxies early
Twenty minutes a week is usually enough. The goal is to see a new route while it is used by a few students, not a whole school.
Pull blocked hits on the VPN, proxy, parked and remote access categories for the week.
Group by school and grade. Look for a sudden rise in one group.
List uncategorized or very new domains with heavy student traffic.
Check them in the domain checker and report any that look wrong to your filter provider.
Note fixes and share them with school tech leads.
Many students, one new domain
Usually a link shared in a group chat. Check the domain at once and block it district-wide if it is a proxy.
One student, many new domains
Often someone testing routes one after another. A quiet conversation tends to work better than public discipline.
Steady traffic, no categories
May be a tunnel or self-hosted proxy. Look at the device and its installed extensions and apps.
Responding when a student uses a proxy
Close the route for everyone, then respond to the person. A calm, consistent response stops the cycle better than a harsh one.
Reminder and fix
Block the route district-wide. Remind the student of the device agreement and why the filter exists.
Conversation
A teacher or dean talks with the student. Inform families under your usual procedures.
Device agreement steps
Follow the agreed consequences, such as restricted device use. Keep it proportionate and documented.
Testing your proxy controls
Use a student test account on a managed Chromebook. Repeat on school Wi-Fi and on a home network or phone hotspot. Record the date and the OU.
- A well-known web proxy site shows your block page
- A proxy site not on any manual list is blocked by category
- A newly registered proxy domain is blocked within your update cycle
- A parked domain is blocked for students
- Remote access tool sites are blocked for students
- Proxy extensions cannot be installed from the store
- User proxy settings cannot be changed
- Incognito and guest mode are unavailable
- Translation tools work for normal pages
- Device results match on and off campus
For a full plan across all categories, use the school web filter test.
Communicating with parents and staff
Parents often hear about "unblocked" sites from their children. Explain the district's approach in plain words and invite them to help at home.
- School devices block proxy sites because they bypass the safety filter required for students
- Proxy sites often carry malware and scams, so the block also protects accounts and devices
- The block covers school devices at school and at home
- Families can ask the school what the filter covers and who to contact
- How to report a suspected proxy: the URL, time and class
- Why translation tools stay open and how misuse is reviewed
- What students are told about proxies in the device handbook
- Where the rule sits in the acceptable use policy
Proxy control: DIY layers against one hosted filter
The matrix above lists many layers, and this table shows where a hosted DNS filter takes work off them.
| Route | Doing it yourself | Hosted CIPA filter |
|---|---|---|
| A new web proxy site | Found in the logs, then added | Blocked by the proxy category once it is filed |
| Browser secure DNS to an outside resolver | Needs Chrome policy plus firewall rules | Blocked by default |
| Proxy used on a school phone or lab PC | Only the network layer reaches it | One DNS setting on the router or firewall |
| Staff who need a restricted page | Edit rules, then undo them | PIN bypass for 15, 30 or 60 minutes, logged, proxy still blocked |
| Chromebook at home | Account policy only | Private encrypted link keeps the filter on |
| Show a reviewer the policy | Several screens and exports | Policy record, activity reports and log export |
FAQ: proxy sites and school filters
Why do new proxy sites appear faster than we can block them?
Proxy sites are cheap to copy onto new domains and free hosting. A manually maintained list is always behind. Category blocking that covers newly registered domains and rechecks them over the following weeks is the practical answer.
Is blocking proxy sites required by CIPA?
CIPA requires a technology protection measure that blocks or filters certain visual depictions for minors. A proxy that bypasses the filter undermines that measure, so most districts block the VPN, proxy and anonymizer category for students as part of their compliance approach.
Will blocking proxies break translation or cached page services?
It can if you block those services entirely. Most districts keep translation tools available and watch logs for misuse rather than blocking them, because they are valuable for multilingual learners.
Can DNS filtering alone stop proxy sites?
DNS filtering blocks proxy domains it knows about, but cannot see full URLs or traffic inside encrypted tunnels. Combine it with device-level controls on Chromebooks and firewall rules on the campus network.
What should we do when a student is caught using a proxy?
Block the route first for all students, then respond under your device agreement in proportion to intent and history. If the student was reaching harmful content, involve counselors.
How often should we review proxy logs?
A short weekly review of blocked VPN and proxy category hits, grouped by school, catches most new routes early. Rerun a full test each term.
Related guides
- Stop Proxy and VPN Bypass in Schools: Every Route, Every Control
- Block VPN Extensions on School Chromebooks: Admin Guide
- SSL Inspection for Schools: When You Need It and When DNS Will Do
- Enforcing CIPA Web Filtering on Off-Campus Student Devices
- CIPA-Compliant DNS Filter for Education
- Web Filtering for School IT Directors: Duties, Vendor Questions
We quote on the number of schools and devices and answer within one business day. A pilot on one site would show you the proxy blocks and the activity reports before any wider rollout.
Catch the next proxy before it spreads
Our proxy and anonymizer category is fed by daily categorization of newly registered domains, with rechecks at one week and one month. Tell us how your district filters today.
Google, Chrome, Chromebook, Chrome Web Store and Google Play are trademarks of Google LLC. They are used here only to identify the products discussed. CIPA Web Filtering is not affiliated with, sponsored or endorsed by Google LLC.