TeacherMagic
for.it.admins // youshallnotpass

Students stop getting around the filter.

A free Chrome extension for managed student Chromebooks. It blocks the proxy frameworks, Google Sites embeds, and unblocked-games hubs kids use to slip past district filtering — and it runs entirely on-device. Build your district's policy config below.

Build a config How to deploy
731K+ Student accounts
34 Block rules
100% On-device
$0 Free forever
// what.it.blocks

The evasion stack, not a domain blocklist.

It targets how students get around filters — proxy infrastructure and the mechanics of unblocked-games hubs — instead of trying to name every bad site. Educational platforms (Khan, Quizlet, testing vendors, IEP tools) are explicitly allowlisted so they never get caught in the crossfire.

01

Web proxies

Ultraviolet, Scramjet, Rammerhead, Holy Unblocker, TitaniumNetwork, Wisp/Bare/Epoxy transports, CroxyProxy, corsproxy, 12ft, translate.goog full-page mode.

02

Google Sites hubs

Blob-URL games, embed-code launchers, Apps Script game catalogs, Cloudflare-Worker iframes — fingerprinted by behavior, with an optional strict default-deny mode.

03

Unblocked-games launchers

Game-engine signatures and brand-name catalogs inside Apps Script, plus games smuggled into about:blank and data: tabs.

04

Tab spam & exploits

Tab-flood limits, history-flood defense, and LTBEEF-style extension-removal GUIs.

// config.builder

Build your policy config.

Everything below runs in your browser. Adjust what you need, copy the JSON, and push it through Google Admin Console. Blank fields fall back to the extension's built-in defaults.

Tab limits
Content guard
Google Sites inspector
Apps Script inspector
Heartbeat
Domains (one per line, comma ok)
Block rules (1 disabled)

Rules are on by default unless their note says off by default. Untick to turn one off — useful if a rule causes a false positive at your district — or tick an off-by-default rule to turn it on.

Admin Console policy JSON 
{
  "config": {
    "Value": {
      "version": 1,
      "rules": {
        "1037": {
          "enabled": false
        }
      }
    }
  }
}
// deploy

Push it from Google Admin Console.

  1. Force-install the extension. Admin Console → Devices → Chrome → Apps & extensions → Users & browsers. Add You Shall Not Pass and set installation policy to Force install for your student OU.
  2. Open “Policy for extensions.” Select the extension and find the Policy for extensions text box (the managed-storage JSON).
  3. Paste the JSON above. Inline mode embeds the whole config; hosted mode points at a URL the extension refreshes hourly. The Value wrapper in the output is the Admin Console's own schema — Chrome strips it before the extension reads the setting.
  4. Scope it to the student OU. Apply to the right organizational unit and save. Devices pick it up on next policy sync, typically within 1–3 hours.
  5. Verify on one device. Open any HTTPS page, then DevTools → Console. [CONFIG] Loaded config from URL: means you're wired up. [CONFIG] Failed to fetch config URL: means the Chromebook can't reach it — check sharing before you walk away.

The extension reads configUrl and config from Chrome managed storage. If both are set, configUrl wins. No setting means the built-in defaults apply — the extension still works with an empty policy. A failed fetch falls back to the last good copy: fresh for 24 hours, still served up to 30 days, discarded after that. So a malformed edit doesn't take the fleet down, but it does quietly leave you on yesterday's policy — validate the JSON before you save it. Nothing here touches a TeacherMagic server: this builder is static, and the extension only ever talks to the config URL you control. Rule catalog and defaults on this page are generated from YSNP 3.2.5.