Category-Based Web Filtering for Managed Chromebooks
A URL list blocks the sites you name. Category filtering blocks the kinds of sites you choose, including ones that did not exist yesterday. Here is how it reaches student Chromebooks, how it follows them home and which categories fit each grade band.
Why category filtering matters on school Chromebooks
The Google Admin console URL list is capped at about 1,000 entries and only knows what you type. For the large, fast-changing parts of the web, categories do the heavy lifting.
Scale
Adult, gambling and proxy sites number in the millions. One category switch covers all of them, where a list would need endless typing.
Freshness
New domains appear every day, and some exist only to dodge school filters. Daily category updates reach them without anyone reporting them first.
Nuance
Categories let you allow News and Science for older students while still blocking Dating and Gambling for everyone, all from one policy.
Chromebook rules that live in DNS
The hosted filter keeps the category work out of your Chromebook management, because the rules sit on a DNS setting instead of an extension. We run it for you and keep the lists current.
- Nothing is installed on the Chromebooks, so there is no extension to push or break.
- Switch categories on and off per school, with always-allow and always-block lists on top.
- A private encrypted link carries the same rules to devices off the network.
Extensions vs DNS vs proxy filtering on Chromebooks
All three can enforce categories. They differ in what they can see, where they work and how much they ask of your network team.
Filtering extension
Force-installed to student accounts from the Admin console. It checks each page in the browser before it loads.
- Follows the student account anywhere
- Sees full URLs, not only domains
- Can identify the signed-in student for reports
- Only covers Chrome, not every app
- Must be kept installed and updated
DNS filtering
The device asks a filtering resolver for each domain. Blocked categories get a block page instead of the real address.
- Light and fast, nothing to install in the browser
- Covers apps as well as Chrome
- Simple to deploy on campus networks
- Sees only the domain, not the path
- Off campus only if the device is pointed at it
Proxy or cloud gateway
Traffic is routed through a filtering service, on campus or in the cloud, which decides per request.
- Sees full URLs when traffic is inspected
- Central logs across all devices
- Can enforce on any network if configured
- Inspection needs certificates on devices
- More moving parts to run well
| Question | Extension | DNS | Proxy / gateway |
|---|---|---|---|
| Can it block one page inside a site? | Yes | No, domain only | Yes, with inspection |
| Works on home Wi-Fi? | Yes | If configured on device | If configured on device |
| Covers Android apps on the Chromebook? | Usually not | Mostly | Depends on routing |
| Knows which student made the request? | Yes | Device or network level | Usually |
| Effort to deploy | Low to medium | Low | Medium to high |
| Uses category data? | Yes | Yes | Yes |
Chromebooks at home keep the same rules
Take-home devices are covered by a private encrypted link, so the school policy follows the laptop. Public encrypted DNS and browser settings that skip the filter are blocked by default.
Off-campus coverage: where the Chromebook actually goes
A take-home Chromebook spends more hours off the school network than on it. Coverage has to follow it to each of these places.
School network
Every approach works here. The campus firewall adds a second layer.
Home Wi-Fi
Only device or user level filters reach it. Network filters at school do not.
Public hotspots
Libraries and cafes may have their own filters, but you cannot rely on them.
Phone tethering
A student's own data plan bypasses home and school networks alike.
What to configure for take-home devices
- Force-install the filtering extension, or set device level DNS, for every student unit.
- Block guest mode and restrict sign-in to school accounts so the policy cannot be skipped.
- Turn off incognito for students if your filter cannot see incognito windows.
- Block the VPN / Proxy / Anonymizers category on every network, not only at school.
- Decide whether after-hours rules differ from school-day rules, and write it into policy.
Categories to block by grade band
A starting point, not a rule. Adjust with teachers and your board, and record the decision in your policy. Category names below are the ones in our 58-category set.
Elementary, K to 5
Tight focus, mostly approved toolsBlock
Review
Open
Many districts run allow-only lists here instead of category blocking.
Middle school, 6 to 8
Wider research, close supervisionBlock
Review
Open
Violence often stays under review because history and news topics touch it.
High school, 9 to 12
Open research, CIPA core held firmBlock
Review
Open
Older students research hard topics; review queues avoid over-blocking them.
Handling AI tools on student Chromebooks
AI chat and writing tools are now a category decision in most districts. A single domain list goes out of date within weeks, because new tools launch constantly.
Block for younger students
Many tools set their own age limits. Blocking the AI / LLM Tools category for elementary units keeps policy simple and consistent.
Time or class based for teens
Some districts allow approved AI tools during set classes and block the rest. That needs category data plus a short allow list.
Split by tool type
Our AI tools set covers 11,800+ domains in 18 categories, so a district can treat writing assistants differently from image generators.
How category data powers a Chromebook filter
Whatever enforcement you choose, every decision comes down to one question: what kind of site is this? The category database answers it in a fraction of a second.
Student opens a link
The Chromebook requests a page on some domain.
Filter checks the domain
The extension, resolver or proxy looks the domain up in its category data.
Categories come back
One or more categories, ranked by how much of the site they describe.
Policy decides
The student's unit rules say allow, block or warn for those categories.
Result is logged
The decision is recorded for safety reviews and reporting.
Illustrative example. Ranked categories let a filter act on the main category alone, or block a site if any listed category is blocked for that grade.
Where everyday Chromebook sites land
Teachers rarely ask about categories, they ask about sites, so here is how a few of them are labelled in our data.
| Site students open | Categories assigned |
|---|---|
| youtube.com | Streaming Media, Social Networking |
| khanacademy.org | Education/Reference |
| kahoot.it | Education/Reference, Gaming |
| roblox.com | Gaming |
| discord.com | Email and Messaging, Social Networking, Gaming |
| quizlet.com | Education/Reference, Webinars/E-learning |
Keeping teaching sites open while categories do the blocking
The opposite failure to a leaky filter is one that blocks lessons. Teachers lose trust quickly when a research page fails in front of a class, so plan for it from day one.
Mixed sites
Large platforms host lessons and distractions side by side. Domain-only filtering must pick one; full-URL filtering can allow the lesson path and block the rest.
Sensitive but educational
Health, history and current events pages can touch categories like Violence or Health & Medicine. Review queues for older grades prevent blanket blocks on research.
Teacher overrides
Give teachers a fast way to request a site, and decide who approves it. A request answered the same day protects the lesson and the policy.
| Symptom teachers report | Likely cause | Usual fix |
|---|---|---|
| A lesson page loads but its video is blank | The video host sits in a blocked category such as Streaming Media | Allow the specific player domain for that unit |
| A news article is blocked for high school | A secondary category on the site, such as Violence, is blocked | Act on the main category for that grade band, or move Violence to review |
| Sign-in to a learning tool loops forever | An authentication domain is in an unexpected category | Add the sign-in domain as a local exception |
| A brand new teaching tool is blocked | The domain was not yet categorized or sits in Parked / For-Sale Domains | Look it up, then allow it locally until the next update |
Questions to ask before choosing a Chromebook category filter
Every vendor will say it filters Chromebooks. These questions separate the details that matter for a school from the marketing.
| Ask this | Why it matters | A good answer sounds like |
|---|---|---|
| How many categories, and can I see the list? | Too few categories force blunt choices, such as blocking all video. | A published list with clear names you can map to your policy. |
| How fast are new domains categorized? | Proxy and lookalike sites are often days old when students find them. | New domains categorized daily, then checked again as they grow. |
| Can a domain have more than one category? | Mixed sites need nuance to avoid over-blocking. | Yes, with the categories ranked by how much of the site they describe. |
| Does it work off campus without the school network? | Take-home devices spend most hours away from school. | Enforcement on the device or user, not only at the firewall. |
| How is accuracy measured? | Wrong categories cause both leaks and blocked lessons. | Regular manual validation, with measured accuracy shared with customers. |
| Who sees the logs, and for how long? | Logs include student browsing, which is sensitive data. | Clear retention settings and role-based access. |
Using category reports in safety reviews
Category logs turn filtering from a silent wall into information a safety team can act on. Keep the reports simple and focused on patterns, not on catching individual students.
Top blocked categories
Shows where demand sits, such as Gaming after lunch or AI tools near deadlines.
Repeated proxy attempts
A student who keeps reaching for VPN / Proxy / Anonymizers may need a conversation, not only a block.
Safety categories
Hits on Violence or Hate/Discrimination can be routed to counselors under your safeguarding process.
Time patterns
After-hours activity on take-home devices helps decide whether evening rules should differ.
A rollout checklist for category filtering on Chromebooks
Most problems in the first week come from skipping one of these. Work through them with a pilot group before the whole district.
- Map each organizational unit to a grade band category profile.
- Choose the enforcement approach for on campus and off campus.
- Pilot with one class per band for at least a week.
- Collect teacher reports of over-blocking during the pilot.
- Set up a request route for teachers to unblock teaching sites.
- Confirm logs show the student, the category and the action.
- Check that Admin console URL lists do not contradict category rules.
- Brief families on what is filtered at home and why.
- Record the setup in your CIPA compliance checklist.
- Schedule a review each term as tools and curriculum change.
Extension or DNS filter
Choosing how a Chromebook gets filtered
| What matters | Filtering extension | Hosted DNS filter |
|---|---|---|
| Work on each device | An extension on every Chromebook | Nothing installed |
| Rule changes | Pushed out to devices | Applied in seconds |
| Bypass attempts | Another extension can undo it | VPN/Proxy stays blocked, even with a PIN |
| Policy by school | Depends on the setup | One console, separate settings per school |
| Audit trail | Varies | Reports, policy record and log export |
Common questions about Chromebook category filtering
What is the best way to filter school Chromebooks by category?
There is no single answer. An extension follows the student everywhere, DNS is light but sees only domains, and a proxy sees full URLs. Many districts combine an extension or DNS layer with the campus filter.
Does Chromebook category filtering work at home?
It does if the filter travels with the device or the user. Extensions and device level settings keep working on home Wi-Fi. A filter that lives only on the school firewall stops at the school door.
Which categories should elementary students have blocked?
Beyond the CIPA core, elementary units commonly block Social Networking, Gaming, Dating, Streaming Media, Forums, Email and Messaging, VPN and proxy sites and AI tools, or run an allow-only list.
Can a domain belong to more than one category?
Yes. In our database a domain can carry several categories, ranked by how much of the site each describes. A filter can act on the main category only or on any listed category.
How quickly do new websites get a category?
About 300,000 newly registered domains are categorized daily and delivered as delta files. Each is checked again after a week and after a month, since many sites add content after launch.
We build a Chromebook filtering product. Can we license the categories?
Yes. The data ships as CSV, Parquet or JSON for your own systems, with a lookup API, under internal use or OEM licences. See the category database or try a domain lookup.
The quote is built from how many schools and devices you run, and it reaches you within one business day. A one-site pilot lets you see real blocks and reports ahead of any commitment.
Bring category filtering to your Chromebooks
Whether you run a district or build the filter that districts install, we can help you put current, school-ready categories behind every Chromebook request.
Talk to us about your district License the category databaseGoogle, Chrome, ChromeOS, Chromebook and Android are trademarks of Google LLC. They are used here only to identify the products discussed. CIPAWebFiltering.com is not affiliated with, sponsored or endorsed by Google LLC.