Strengthening Highlights and preventing student loopholes Follow

This article helps Hāpara administrators strengthen Chrome and ChromeOS settings so students cannot bypass Highlights using Incognito mode, Guest mode, multiple accounts, DevTools, bookmarks, Chrome internal URLs, Google Lens or virtual desktops.

In this article:

• Diagnostic table
• Force-install Hāpara Highlights
• Disallow incognito mode
• Disable guest browsing (browser and device)
• Force Chrome browser sign-in
• Block multiple account sign-in on ChromeOS 
• Prevent students from ending Chrome processes
• Limit developer tools
• Reduce bookmark and bookmarklet loopholes
• Block sensitive internal Chrome URLs 
• Disable Google Lens for student OUs
• Review multiple desktops or virtual desks
• Use ephemeral mode on shared devices
• Troubleshooting 
• Related articles

Summary

To prevent students from bypassing Hāpara Highlights, apply the recommended Google Admin Console policies to student organizational units, force-install the Highlights extension and verify that each policy is active on a managed student device. Start with the diagnostic table below to identify the likely loophole, then apply the matching prevention setting.

Before you begin

You need:

1. Google Admin Console access.
2. Student organizational units set up in Google Admin.
3. The Hāpara Highlights extension force-installed for student users.
4. A managed student Chromebook or managed Chrome browser for testing.
5. A test student account in the same OU as your students.

Apply these settings to student OUs first. Keep staff OUs separate so teachers and IT staff can retain tools such as DevTools or Incognito where needed.

Diagnostic table: identify and close common Highlights loopholes

Prevention playbook

1. Force-install Hāpara Highlights

Force-installing Highlights helps ensure the extension is present and cannot be removed by students.

1. In Google Admin Console, go to Devices > Chrome > Apps & extensions.
2. Select the student OU.
3. Add or select Hāpara Highlights.
4. Set the installation policy to Force install.
5. Pin the extension to the browser toolbar if that option is available.
6. Click Save.

2. Disallow Incognito mode

Incognito mode can prevent required extensions and policies from applying as expected.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Security > Incognito mode.
4. Select Disallow incognito mode.

1. Click Save.

3. Disable Guest browsing

Guest browsing allows students to use Chrome without their managed school profile.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Security > Browser guest mode.
4. Select Prevent guest browser logins
   
   
5. Then go to Device settings > Sign-in settings > Guest mode.
6. Select Disallow guest mode.
7. Click Save.

4. Force Chrome browser sign-in

Forcing browser sign-in helps ensure students are using a managed browser profile where district policies apply.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Sign-in settings > Browser sign-in settings.

4. Select Force users to sign in to use the browser.
   
   

    

5. In Restrict sign-in to pattern, enter your school domain pattern.

Example:

.*@district\.org

       6. Click Save.

5. Block multiple Google account sign-in

Students may try to add a personal or secondary Google account to avoid school policies.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to User experience > Multiple sign-in access.

4. Select Block multiple sign-in access for users in this organization.

   
   

5. Click Save.

6. Prevent students from ending Chrome processes

Students may try to use Chrome Task Manager to end the Highlights process.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Task manager.
4. Select Block users from ending processes with the Chrome task manager.
   
   
    
5. Click Save.

7. Limit Developer Tools

Developer Tools can be used to inspect or interfere with extensions.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Developer tools.
4. Choose one of the following:
   • Allow use of built-in developer tools except for force-installed extensions — recommended if students need DevTools for coding classes.
   • Don’t allow use of built-in developer tools — recommended if students do not need DevTools.
     
     
      
5. Click Save.

8. Reduce bookmark and bookmarklet loopholes

Bookmarklets are browser bookmarks that contain JavaScript. Students may use them to interfere with browser behavior or classroom sessions.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Bookmark bar.
4. Select Disable Bookmark bar.
5. Go to Bookmark editing.
6. Select Disable Bookmark editing.
7. Optional: Use Managed bookmarks to provide approved learning resources.
8. Click Save.

9. Block sensitive internal Chrome URLs

Chrome internal URLs can expose settings or tools students should not access.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Go to Content > URL blocking.
4. Enable Block sensitive internal Chrome URLs.
5. Add only additional URLs your district has confirmed as a risk.
   
6. Click Save.

Use caution before manually blocking Chrome URLs. Blocking the wrong internal URL may interfere with normal Chrome or ChromeOS functionality.
 

10. Block unwanted content hosted on trusted or allowlisted domains

Some websites, proxies or web apps can be hosted on shared services such as Amazon Web Services (AWS), Google Cloud Storage or other content delivery platforms.

Your school may already allow the main hosting domain because a legitimate learning tool, SSO provider or other school-approved service uses it. Students may then find unapproved content hosted under a different path or bucket on the same trusted domain.

If this happens, avoid blocking the entire shared hosting service unless you have confirmed that your school does not need it. Instead, block the specific host, bucket or path being used.

1. Identify the full URL the student is accessing.
2. In Google Admin Console, go to Devices > Chrome > Settings > Users & browsers.
3. Select the student organizational unit.
4. Go to Content > URL blocking.
5. Under Blocked URLs, add the specific host or path that students should not access.

For example:

shared-host.example.com/unapproved-content

Some shared hosting services may also make the same content available through a host-specific URL, such as:

unapproved-content.shared-host.example.com

If you identify both URL formats being used, block both.

6. Click Save.
7. On a managed student device, open chrome://policy.
8. Click Reload policies.
9. Confirm the URL blocking policy shows OK.
10. Sign in with a test student account and confirm the unwanted URL is blocked.

Important: Do not block an entire shared hosting domain without testing first. SSO providers, digital curriculum tools and other school-approved applications may depend on the same hosting service.

If your school has broadly allowlisted a shared hosting domain, periodically review whether the entire domain is still required or whether access can be narrowed to specific services.

11. Disable Google Lens for student OUs

Google Lens may allow students to search screen content, images or assessment questions.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the student OU.
3. Search for Google Lens.
4. Set the available Google Lens options to disabled or hidden, including:
   • New tab page Google Lens button: Do not show
   • Google Lens camera-assisted search: Disabled
   • Google Lens region search: Disabled
   • Google Lens overlay: Disabled
5. Click Save.

For high-stakes assessments, remind staff that browser controls cannot prevent students from using a separate personal device.

12. Review multiple desktops or virtual desks

ChromeOS virtual desks may allow students to move activity out of immediate view during in-person supervision.

1. Test virtual desk behavior using a student account.
2. Confirm whether teachers can still see the active screen in Highlights.
3. Set classroom expectations for virtual desk use.
4. Consider pairing this with Focus or Filter sessions during assessments.
5. Escalate to Hāpara Support if student activity appears hidden even when policies are applied correctly.

13. Use ephemeral mode on shared devices

Ephemeral mode clears local user data when the student signs out. This can reduce cached profile issues on shared carts, labs or library devices.

1. Go to Devices > Chrome > Settings > Users & browsers.
2. Select the shared-device student OU.
3. Go to Security > Force ephemeral mode.
4. Select Erase all local user data.
   
5. Click Save.

Use this carefully. Do not apply it to staff OUs or users who need persistent local profiles.

Troubleshooting

The policy is set, but students can still access the setting

Check that the student is in the correct OU. Then open chrome://policy, reload policies and confirm the policy status is OK.

The student is using a personal device

These settings apply only to managed Chrome browsers or managed ChromeOS devices where the student signs in with a school account. For unmanaged personal devices, use your district’s device policy, network filtering and classroom procedures.

Teachers still see students as Offline or missing

This may not be a loophole issue. Check extension installation, student sign-in status, network access and Highlights connectivity.

A setting affects a class that needs coding tools

Apply the stricter policy to most student OUs, then create a separate OU or group for approved coding classes. For those students, allow DevTools except for force-installed extensions.

Students are accessing unapproved websites through an allowlisted domain

A domain on your school’s allow list may host content for many different organizations.

1. Identify the full URL the student is accessing.
2. Check whether the parent domain is intentionally allowlisted by your school.
3. If the parent domain is required, do not automatically block the entire domain.
4. Block the specific unwanted host, bucket or path instead.
5. Check whether the content is available through another URL format on the same hosting service.
6. Reload policies at chrome://policy.
7. Test the blocked URL using a student account.

If the unwanted website continues to work after the policy is applied, contact Hāpara Support with the URL and your relevant Chrome policy information.