Block Other Browsers on School iPads and Chromebooks

Your filter is tuned for one browser. Students can install many others, and some of them are built to route traffic where your filter cannot see it. Keep one supported browser and make every other path fail.

Supported browser

Device filter applies

Network filter applies

Rules and reports work

Browser with built-in VPN

Traffic wrapped in a tunnel

Filter sees one server

Categories cannot apply

Cloud or Tor browser

Pages load elsewhere

Filter sees a relay

Sites and history hidden

Simplified view. The exact behavior depends on the browser and on where your filter runs.

Why other browsers can bypass school filters

A browser is not just a window onto the web. Several popular browser apps change how traffic leaves the device, which is exactly what a school filter depends on.

Built-in VPN or proxy

Browsers such as Aloha and Opera advertise a built-in VPN. Inside the tunnel, the network filter cannot see which sites load.

Cloud rendering

Puffin describes itself as a client for a browser that runs on its cloud servers. The device only talks to those servers.

Tor routing

Onion and Tor browsers route traffic through the Tor network. That hides sites from filters and logs, and opens hidden services.

Filters tied to one browser

A filter that runs as a Chrome extension only covers Chrome. An Android browser on a Chromebook sits outside it entirely.

Private modes and own settings

Private browsing, custom DNS and their own proxy settings make reporting patchy, even where a filter still applies.

Other engines in the EU

On iPads, browsers use Apple's web engine, except in the EU, where browsers may ship their own. Test before you allow one there.

Browser apps list: what to block on student devices

Grouped by how each type affects filtering. Mainstream browsers are fine in principle; schools block them to keep one tested browser. The other groups deserve a block on every student device.

App	iOS bundle ID	App Store ID	Android package
Mainstream browsers (keep one, block the rest)
Safari (built in)	com.apple.mobilesafari	1146562112	iOS only
Google Chrome	com.google.chrome.ios	535886823	com.android.chrome
Firefox	org.mozilla.ios.Firefox	989804926	org.mozilla.firefox
Microsoft Edge	com.microsoft.msedge	1288723196	com.microsoft.emmx
DuckDuckGo	com.duckduckgo.mobile.ios	663592361	com.duckduckgo.mobile.android
Brave	com.brave.ios.browser	1052879175	com.brave.browser
Firefox Focus	org.mozilla.ios.Focus	1055677337	look up
Yandex Browser	ru.yandex.mobile.search	483693909	look up
Startpage	com.startpage.app	6478921430	com.startpage.app
Browsers with a built-in VPN or proxy (block)
Aloha Browser	com.alohabrowser.alohabrowser	1105317682	com.aloha.browser
Opera	com.opera.OperaTouch	1411869974	com.opera.browser
Turbo VPN Private Browser	com.allconnected.turbovpn	1365309175	free.vpn.unblock.proxy.turbovpn
Cloud browsers (block)
Puffin Browser	com.cloudmosa.PuffinFree	472937654	com.cloudmosa.puffinFree
Tor and onion browsers (block)
Onion Browser	com.miketigas.OnionBrowser	519296448	iOS only
TOR Browser: OrNET	ch.b-eng.tor	1177964608	look up
Tor Browser (Android)	Android only	none	org.torproject.torbrowser
Search and AI apps that browse (review)
Google	com.google.GoogleMobile	284815942	look up
Microsoft Bing Search	com.microsoft.bing	345323231	com.microsoft.bing
Perplexity	ai.perplexity.app	1668000334	ai.perplexity.app.android
Comet AI Browser	ai.perplexity.comet.ios	6748622471	look up
Private browsers, file managers and video browsers (block)
Private Browsing Web Browser	com.savysoda.PrivateBrowser	368483462	look up
Documents (file manager with browser)	com.readdle.ReaddleDocsIPad	364901807	look up
Browser and Documents Manager	com.eilvera.idwl	979401801	look up
Offline: Files, Browser, VPN	com.godlancer.megadriver	1557618225	look up
Desktop Browser	com.spicyapps.desktopBrowser	940076212	look up
ProTube: Video Browser	com.protube.video	6748081431	look up
Web Video Cast	com.instantbits.cast.webvideo	1400866497	com.instantbits.cast.webvideo
Friendly Social Browser	com.oecoway.friendlyLite	400169658	look up

Before you block a file manager, check whether a class uses it for documents. For any browser not listed, the free bundle ID lookup returns its IDs. VPN apps, which often pose as browsers, are covered in how to block VPN apps.

Safari or Chrome: choosing the one supported browser on iPads

Most districts pick one of the two. Either works with a supervised iPad, as long as the other one is blocked and every rule is tested with the browser you chose.

Point to weigh	Safari	Google Chrome
Install and updates	Built into iPadOS, updated with the system	Store app, pushed and updated by the MDM
Web engine on iPad	Apple's engine	Apple's engine, except where EU rules allow others
Device web content filter	Applies	Applies
MDM restrictions	Own switches, including "Use Safari"	Managed app settings, where your MDM supports them
Saved passwords and history	Tied to the Apple Account on the device, often none on student iPads	Tied to the signed-in Google account, which may sync to home devices
Chrome extensions	Not applicable	Not available on iPad, so extension filters do not run
A good fit when	The district is mixed or Apple-first	Students live in Google Workspace all day
Block in the browser list	Chrome and all others	Safari can be hidden; check web clips and sign-in flows first

Whichever you choose, write it into the device policy so teachers know which browser to use in lessons and which one support will help with.

Why a hand-made browser list goes stale

A list of six browsers feels complete. Then students find the seventh. These are the patterns that keep browser lists moving.

Clone names

"Private browser", "incognito browser" and "secure browser" apps are published again and again by different developers, each with a new bundle ID.

Bundled features

File managers, video downloaders and casting apps add a browser tab. They never look like browsers in a store search.

New AI browsers

AI assistants now ship as browsers that open and summarize pages. They belong in both the AI and browser decisions.

VPN in disguise

Some VPN apps present themselves as browsers, and some browsers add a VPN in an update. Both groups need checking each month.

Two stores

The same browser has a different ID on iOS and Android. A list for iPads does nothing for Android tablets or Chromebooks.

The fix

A category list updated monthly. Every app is categorized from its store listing, reviewed and validated, so new browsers arrive in the next file.

Our VPN and proxy apps list includes the browsers with built-in VPNs, so you can block them with one category.

In-app browsers: the browser inside every app

Tap a link in a chat or social app and a page opens without leaving the app. That small browser is the reason "block apps from opening browser" is a common search.

On school iPads

In-app browsers use the system web engine, so device-level filtering generally still applies.
The bigger risk is apps that are browsers in disguise: search apps, file managers and video downloaders.
Social and chat apps with in-app browsers are usually blocked anyway as their own categories.
Test each allowed app: open a link and check that a blocked site stays blocked.

On school Chromebooks

Android apps show web pages in their own web view, outside the Chrome browser.
A filter that runs as a Chrome extension does not see that traffic.
Keep Google Play in allowlist mode and only approve Android apps you have tested.
Where Android apps are needed, add network or DNS-level filtering as a second layer.

Many chat apps have a full web version, so blocking Telegram, WhatsApp or Discord as apps leaves their websites open. Block the messaging category on the web too. AI chat is the same: our ChatGPT app guide covers the app, and the website needs a web rule in Edge or any browser.

How to restrict browsers on school iPads

Pick the browser you support, usually Safari or Chrome, and build everything around it. All steps assume supervised iPads.

Hide the App Store. Turn off "Install apps using App Store" so new browsers cannot arrive.
Block the browser category. Add every browser bundle ID except your supported one to the blocked apps setting, or the deny list of the declarative App settings on iPadOS 27.
Lock the default browser. On iPadOS 18.2 and later, set allowDefaultBrowserModification to false.
Apply the web content filter. Limit adult content with your deny list, or allow specific websites only for young grades.
Stop VPN and profile tricks. Turn off "Add VPN configurations" and "Install a configuration profile".
Turn off iCloud Private Relay. It keeps Safari traffic visible to the network filter.
Test on a real device. Confirm blocked browsers vanish and that the supported browser still signs in to school services.

When there should be no browser at all

Testing carts: turn off "Use Safari" and use single app mode for the assessment app.
Kiosk iPads: one app locked on screen, or Safari limited to specific websites only.
Turning off Safari also stops web clips from opening, so check school shortcuts first.
See Shared iPad and single app mode for the full setup.

Intune admins

The restricted apps list in the device restrictions template only reports. Use the settings catalog blocked app bundle IDs to block. More in blocking apps with Intune.

How to block YouTube in Safari on a school iPad

"Block YouTube on school iPad Safari" is one of the most searched browser questions. Blocking the YouTube app leaves youtube.com open, so pick one of these web options too.

Block it on the device

Add the YouTube domains to the deny list of the web content filter. It travels with the iPad, so it works on home Wi-Fi.

Block it on the network

Block the streaming category or the YouTube domains in the school's network filter. Good for shared carts that never leave the building.

Filter it instead

Google documents DNS records that point YouTube hostnames to restrict.youtube.com or restrictmoderate.youtube.com to force Restricted Mode.

The app side, including what to allow for younger grades, is in our YouTube app blocking guide. On a family iPad, Screen Time's Content and Privacy Restrictions include a web content setting that can limit adult websites or allow listed sites only.

How to restrict browsers on school Chromebooks

Chromebooks ship with Chrome, so other browsers arrive another way: as Android apps, Linux apps, guest sessions or new browser profiles. Each has a Google Admin console setting.

Stop other browsers arriving

Google Play: set Allow/block mode to Block all apps, admin manages allowlist.
Chrome Web Store: the same allowlist mode stops VPN and proxy extensions.
Linux virtual machines: keep blocked, the default on managed devices.
Android apps from untrusted sources: keep sideloading prevented, the default.
Extensions page developer mode: do not allow, so unpacked extensions cannot load.

Keep Chrome itself under policy

Guest mode: disable, because guest sessions do not apply your user policies.
Incognito mode: disallow; it is the K-12 default, but confirm it.
Add profiles: choose "Disable adding new profiles" and prevent browser guest logins.
Proxy mode and DNS-over-HTTPS: set them to match your filter, not "Allow user to configure".
Task manager: block users from ending processes, so filter extensions keep running.
Developer tools: "Never allow use of built-in developer tools" for students.

Setting names change between console versions, so check the current Admin console. Step-by-step guides: blocking apps in Google Admin and Chromebook apps and extensions.

Android tablets, kiosk browsers and other devices

Library tablets, lab devices and early-years Android tablets need the same one-browser rule, applied through Android Enterprise.

Fully managed Android

Only apps approved in Managed Google Play install. Approve one browser and leave the rest unapproved.

Kiosk browsers

Some MDMs, Hexnode among them, offer a web kiosk mode for Android that locks a tablet to approved sites. See Hexnode app blocking.

Android package lists

Browser blocklists include Android packages for apps on both stores, so one category covers iPads and Android tablets.

Windows laptops

Desktop browsers are programs, not store apps. They need application control rules in your Windows management tool.

Loaner and library tablets change hands daily, so nobody notices a new browser until a problem appears. Apply the same browser blocklist to loaner groups as to 1:1 devices, and check their installed apps report after each lending cycle.

Test checklist after you restrict browsers

Run these checks on one student device per grade band before the change goes district-wide.

Blocked browsers no longer appear on the Home Screen or launcher.
The supported browser opens school sign-in pages without errors.
A blocked test site stays blocked in the supported browser.
Links opened from an allowed app follow the same rules.
Guest mode and incognito are unavailable on Chromebooks.
Google Play shows only approved apps on Chromebooks.
VPN configurations cannot be added on iPads.
The filter still applies on a home network or phone hotspot.
Testing apps and single app mode still work as expected.
Staff devices keep the browsers staff need.
The device reports in your MDM list no unexpected browser apps.
Teachers know which browser to use in lessons and where to report problems.

Browsers are one of several workarounds students try. The full list, with detection and fixes, is in how students get around restrictions.

Browser blocking questions

Answers to what school IT teams ask when they move to one browser.

Why should schools block other browsers on student devices?

Each extra browser is another path your filter has to handle. Some browsers include a built-in VPN, some load pages on remote servers, and some route traffic through the Tor network. Keeping one supported, tested browser makes filtering and reporting predictable.

How do I block browser apps on school iPads?

On supervised iPads, hide the App Store, add the bundle IDs of browser apps you do not support to the blocked apps setting in your MDM, and turn off default browser changes on iPadOS 18.2 and later. Then apply the web content filter and confirm the blocked browsers no longer appear.

How do I block other browsers on school Chromebooks?

Chromebooks run Chrome, so the other browsers arrive as Android apps or Linux apps. Put Google Play in allowlist mode, keep Linux virtual machines off, disable guest mode, incognito and adding profiles, and block proxy and VPN extensions with a Chrome Web Store allowlist.

How do I block YouTube in Safari on a school iPad?

Blocking the YouTube app does not affect Safari. Add the YouTube domains to the deny list of the web content filter, block them in your network filter, or force YouTube Restricted Mode at the network if you want to allow filtered viewing.

Do in-app browsers get around school filters?

Most in-app browsers on iPads use the same system web engine as Safari, so device filters still apply. The bigger risk is apps whose main job is browsing, such as search apps, file managers and video apps with built-in browsers, so include them in the browser blocklist.

Does Intune block browser apps with the restricted apps list?

On iPads, the restricted apps list in the Intune device restrictions template only reports devices that have the apps. To block browser apps, use a settings catalog policy with the blocked or allow-listed app bundle ID settings on supervised devices.

One browser list, kept current for you

Browsers, VPN browsers and proxy apps change every month. Get them as iOS bundle ID lists, Android package lists and MDM import files, together with every other school category.

See school plans Talk to us

Safari, iPad and iCloud are trademarks of Apple Inc. Chrome, Chromebook, Google Play, YouTube and Google Admin are trademarks of Google LLC. Microsoft Edge, Bing and Intune are trademarks of Microsoft Corporation.

Firefox is a trademark of the Mozilla Foundation. Opera, Puffin, Brave, DuckDuckGo, Aloha, Perplexity, Telegram, WhatsApp, Discord, ChatGPT and Hexnode are trademarks of their respective owners.

Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.