Skie for Enterprise · Problem

Unsafe websites, other browsers and VPN workarounds

How do I keep children off adult and harmful sites when they can install another browser or a VPN?

A filter on one browser does nothing if there is a second browser, a VPN or a private DNS setting a click away. Safe browsing has to cover the whole device, not one app.

34 questions on this problem

Why does Skie block the Private DNS setting on managed devices?Skie locks filtering DNS on the device, so it travels on any Wi-Fi or mobile data. Blocking the Private DNS setting, on by default, stops a student replacing it with their own server....
Can students set up a VPN on a managed tablet?VPN setup is blocked by a default-on switch, so Settings will not let a student add a profile. Skie also keeps VPN apps, proxy apps and DNS changer apps on an always-blocked list, whatever...
Why does Skie block installing certificates on managed devices?Skie blocks installing certificates by default. That stops a student adding a certificate that would let a proxy or VPN-style tool read or reroute encrypted traffic past the filter. The...
Does Skie block hotspot and tethering on school devices?Hotspot and tethering are blocked in the default policy. A student cannot share the tablet's connection, or use another phone's unfiltered data to bypass school rules, from the managed...
How do DNS and filter settings work at organisation level?Skie locks a filtering DNS on each device, so the filter follows it onto any Wi-Fi or mobile data. The default is CleanBrowsing Family, and an organisation or group filter can override it....
How are blocked websites and the web filter set in a policy?The policy picks the web filter, which blocks site categories such as adult content. The filtering DNS is locked on the device, so it applies on any Wi-Fi or mobile data, and Private DNS...
What if the school Wi-Fi blocks the Skie web filter?Some school networks block the port that encrypted DNS needs. Skie then uses the network's own DNS and the dashboard flags the problem, so nothing fails silently. The network check wizard...
Can students use their own SIM data in a hostel, and does the filter still apply?The filtering DNS is set on the device itself, so it follows the phone onto hostel Wi-Fi, a student's own SIM data or a hotspot. App lists, the Chrome rules and the blocked VPN and browser...
How do I force SafeSearch on Chrome on managed school devices?SafeSearch is one of the Chrome rules Skie enforces as the Android device owner, so there is nothing to configure in each browser. It is on by default and applies to Chrome stable, beta...
Can YouTube Restricted Mode be forced on for every student device?Restricted Mode is part of the Chrome rule set Skie enforces on the device, and it is on by default. Set it per group in the policy and the device applies it to YouTube in Chrome. For...
What is the safe-sites filter in Chrome and does Skie turn it on?The safe-sites filter is switched on by Skie as a device owner Chrome rule, with no setup per device. It works alongside the filtering DNS: the DNS decides which domains resolve, and the...
Does Skie keep Chrome Safe Browsing on for managed devices?Skie keeps Safe Browsing switched on as one of its enforced Chrome rules, so Google's warnings about phishing and malware pages reach students and cannot be dismissed at policy level. It is...
Why does Skie turn off Chrome's own secure DNS?This rule is part of how the school filter stays in the path. Skie turns off Chrome's own secure DNS as a device owner rule, so Chrome falls back to the system DNS that Skie locks to the...
Is incognito mode blocked on managed school devices?Incognito is blocked by a device owner Chrome rule that is on by default, so students never get a private window to work in. Every tab stays under the same SafeSearch, safe-sites and...
Can students change the Chrome search engine on a managed device?Skie locks Chrome's search engine to Google as a device owner rule, which is the reason forced SafeSearch cannot be sidestepped by swapping the default. It is on by default and needs no...
Why is Chrome sign-in blocked on managed devices?Chrome sign-in is blocked by a device owner rule that is on by default, so a personal Google profile cannot be attached to the managed browser. That keeps the school's SafeSearch, filtering...
Does Skie block pop-ups in Chrome on managed devices?Pop-up blocking is one of the Chrome rules Skie enforces as device owner, and it is on by default. Admins do not need to touch each tablet. It works with the filtering DNS and the...
Which Chrome rules does Skie enforce on managed devices?These rules are enforced by Skie as the Android device owner on Chrome stable, beta, dev and canary, and they are on by default. Admins see them in the effective policy view, can set the...
What is the filtering DNS on a Skie device and can students change it?Skie sets the filtering DNS on the device and blocks the Private DNS setting, so apps and browsers all use it. If a change were attempted, Skie re-applies the protection, and the compliance...
Does the school web filter still work on home Wi-Fi and mobile data?Because the filter lives on the device as a locked DNS, a student taking a tablet home is still filtered, and so is a phone on mobile data. Admins do not manage routers for this. The...
Which web filter does Skie use by default and what is the fallback?New organisations are covered immediately: CleanBrowsing Family is the default filter, with a fallback host for when it cannot be reached. An admin who wants a different one picks from the...
What is the curated list of web filters and who controls it?Skie owners keep a list of vetted filtering DNS options, and organisation admins choose from it for the organisation or for individual groups. There is no free-text DNS field to get wrong....
How do I check that my school Wi-Fi works with the Skie web filter?The wizard is in the dashboard. Run it while connected to the network you want to test, and it checks whether the encrypted DNS the filter relies on can get out. Do this before rollout on...
What happens when a network blocks the encrypted DNS port?On such a network the device falls back to the network's own DNS so browsing keeps working, and the Skie dashboard flags it. Admins can then ask the network team to allow the encrypted DNS...
Can a student install Firefox or Brave to get past the filter?Alternative browsers are on a never-allow list, and the install guard silently removes any app installed after enrolment that the group does not allow. Unknown sources are blocked too, so a...
Can students use VPN, proxy or DNS changer apps on managed devices?Skie keeps VPN, proxy and DNS changer apps on a list that no app list can override, and it blocks VPN setup and the Private DNS setting in Android. These switches are on by default. Admins...
How do I block adult content on school devices permanently?Set this once at the organisation level and it flows down. The locked filtering DNS, forced SafeSearch, safe-sites filter, blocked alternative browsers, VPN and proxy apps, and blocked...
Can a student join a phone hotspot to get on an unfiltered network?The filter does not depend on the network, so joining a hotspot does not remove it. Skie also blocks hotspot and tethering on managed devices by default, and Wi-Fi settings can be locked...
Can I add my own list of blocked or allowed websites?Not yet. Custom per-website allow and block lists are not available today, and the team is working on them. What Skie does today is filter by category through a locked DNS, force SafeSearch...
How do you stop students using proxy websites to reach blocked sites?Skie combines the locked filtering DNS, Chrome's safe-sites filter, and blocks on proxy apps, incognito and other browsers. That closes most routes, though a filter is only as good as its...
Can I add my own list of allowed or blocked websites in Skie?Not yet. What Skie offers today is the choice of filter per organisation or group, the Chrome rules, and control of the browser by group and schedule, which covers broad categories rather...
What should we do when the filter blocks a website students need?Skie lets you pick a different filter for a group from the curated list, which is the practical fix when one filter is too strict for a subject. Per-website allow lists are not available...
What if a school or group wants no web filtering at all?Filters in Skie are chosen per organisation or group, and a default applies where nobody has chosen one, so filtering does not start switched off. Whether a group should run with lighter...
Can an app use its own DNS over HTTPS to bypass the filter?Skie closes the main routes: Chrome's secure DNS is off, the Private DNS setting is locked, and alternative browsers, VPN and DNS changer apps are never allowed. The remaining question is...

Students distracted by phones and apps in class · Hostel night-time phone use and curfew rules · Tampering, factory resets and bypass attempts · Managing hundreds of devices, classes and branches · Setting up and rolling out devices quickly · Lost, stolen, broken and reassigned devices