← fleisch.family

WiFi Blocker & All-Purpose Whack-a-Mole

A free Chrome extension for school IT admins. Prevents students from using Chromebooks with WiFi turned off — blocking offline games and off-the-grid time during class — and shuts down filter-bypass tricks like embedding YouTube/Vimeo videos inside Canva, with per-student reporting of every attempt.

Full-Screen Block
Opaque overlay covers every open tab the instant WiFi disconnects. Nothing visible behind it.
Input Capture
All keyboard, mouse, and touch events are intercepted. No playing games behind the screen.
Auto-Recovery
Overlay disappears automatically when WiFi reconnects. No manual action needed.
Unremovable
Force-installed via Admin Console. Students cannot disable or uninstall it.
Canva Embed Blocker (v1.7+)
Kills YouTube, Vimeo and other video embeds inside Canva designs — a common way students slip video past the content filter.
Attempt Reporting (v1.8+)
Every blocked embed is logged with the signed-in student account and time, viewable on a private dashboard. Spot who's testing the fence.

What students see

📡
WiFi Connection Required
This Chromebook is not connected to the internet.
Turn on WiFi and connect to the school network to continue.
Disconnected

Installation Guide

This extension is self-hosted and deployed via Google Admin Console as a force-installed extension. No Chrome Web Store account required.

Step 1 — Open Apps & Extensions

In Google Admin Console, navigate to:

Devices → Chrome → Apps & extensions

Select the organizational unit containing your student Chromebooks (e.g., Students).

Step 2 — Add by Extension ID

Click the + button (bottom right) and select "Add Chrome app or extension by ID".

Enter the following:

Extension ID nimlkdojgllmgckamjpofecpgbnonchg
Update URL https://fleisch.family/wifi-ext/updates.xml

Step 3 — Force Install

  1. Click Save to add the extension.
  2. Once it appears in your extension list, set the installation policy to Force install.
  3. Click Save in the top right corner.

That's it. The extension will be automatically pushed to every managed Chromebook in the selected OU. Students cannot remove it. Updates are delivered automatically.

Recommended Companion Settings

For maximum effectiveness, pair this extension with these Admin Console settings:

How It Works

The extension uses two layers of protection:

  1. Network request blocking — When WiFi is off, all new page navigations are redirected to a "Connect to WiFi" page via Chrome's declarativeNetRequest API.
  2. Content script overlay — A content script injected into every open tab monitors connectivity. The moment WiFi drops, it places a full-screen, fully opaque overlay that captures all keyboard and mouse input, preventing interaction with any already-loaded content (like cached games).

Fail-Safe by Default (v1.4+)

Manifest V3 service workers go to sleep when idle. In earlier versions of this extension, that meant a student could turn off WiFi while the worker was asleep, and the block rule wouldn't be installed in time — the student's next page load would slip through.

v1.4 inverts the default state. Every time the service worker wakes — on install, on browser startup, on each navigation, and every 30 seconds via an alarm — the block rule is installed first, then a connectivity probe runs and only lifts the block if real internet access is confirmed. The result: there is no window in which a student can navigate while the extension is unsure of the network state.

Active Connectivity Probe

Instead of trusting navigator.onLine alone (which only reports whether any network adapter is up — it stays true even on a captive portal or unrouted hotspot), the extension actively fetches a known-good Google connectivity endpoint:

Both are raced in parallel; the first success counts as online. If neither resolves within four seconds, the device is treated as offline and the block rule is reinstalled. These are the same endpoints Chrome itself uses for OS-level connectivity checks, so they're effectively guaranteed to be reachable from any network where students could plausibly be doing schoolwork.

Version Indicator

Both the redirect block page and the in-tab overlay display the current extension version in the bottom-right corner (e.g. v2.0) — and the version is baked right into the extension's display name (Akiva's Whack-A-Mole v2.0), so you can confirm a device has the latest build at a glance in the Admin Console or chrome://extensions without opening anything.

Canva Embed Blocking (v1.7+)

Students discovered that a blocked video site can still be watched by pasting its link into a Canva design, which renders the video as an embedded player. Because Canva itself is allowed, the embedded video sails straight past the network filter.

This extension closes that hole with two layers:

  1. Network rules — Chrome's declarativeNetRequest blocks the video hosts that power the embeds. Canva renders embeds inside sandboxed, opaque-origin iframes, so initiator-scoped rules don't catch them; instead the extension blocks the embed-only hosts outright (youtube-nocookie.com, player.vimeo.com, vimeocdn.com) — video-only domains with no collateral. Legit Google Drive / Classroom video (googlevideo.com) is deliberately left alone.
  2. Content-script cleanup — Runs in every Canva frame, strips any video iframe that appears, and replaces it with a "Video embeds are disabled on school devices" notice.

Attempt Reporting (v1.8+)

Each time an embed is blocked, the extension reports the attempt — the signed-in student account, the service (YouTube, Vimeo, etc.), and the timestamp. No design content or URLs are captured. Reports are viewable on a private, password-protected dashboard:

Reports Dashboard https://fleisch.family/wifi-ext/reports?key=YOUR_KEY

The dashboard shows totals by student, by service, by day, and a recent-activity feed — handy for spotting who is repeatedly testing the fence.

Deployment Note for Filtered Networks

If your network runs a content filter (Deledao, Lightspeed, GoGuardian, etc.), make sure these URLs are on the allow list, or extension auto-updates and reporting won't reach students' devices:

Built by Akiva Fleischmann. Free and open source.