Classroom › FAQ
How blocking works in Classroom: Site Lock vs. Allow-Only
How Blocking works in Classroom: Site Lock vs. Allow-Only
This document explains how URLs and paths are enforced in Classroom, comparing access plans with allow-only blocking to Site Lock.
Allow-Only Plans vs. Site Lock: Neither feature ever allows “exactly this URL and nothing else”:
● An Allow-only blocking plan ignores the path part of a URL completely. Adding a URL allows the entire site (domain) plus all its subdomains.
● Site lock respects the path as a prefix: the given page and everything under it is allowed, but other sections of the same site are blocked — unless the teacher enables “Allow entire site”.
Site lock can be used with or without the option “allow entire site”
Examples
A teacher enters: https://example.com/math/unit1
Student tries to visit | Allow-only plan | Site lock (default) | Site lock + “Allow entire site” |
✅ Allowed | ✅ Allowed | ✅ Allowed | |
✅ Allowed | ✅ Allowed | ✅ Allowed | |
✅ Allowed | ❌ Blocked | ✅ Allowed | |
example.com (homepage) | ✅ Allowed | ❌ Blocked | ✅ Allowed |
sub.example.com (any subdomain) | ✅ Allowed | ❌ Blocked | ✅ Allowed |
❌ Blocked | ❌ Blocked | ❌ Blocked |
Behavior summary by feature
Allow-only blocking plan | Site lock (default) | Site lock + “Allow entire site” | |
Is the path honored? | No — dropped when the plan is applied | Yes — as a prefix (the page and anything under it) | No — whole site allowed |
Scope of one URL entry | Whole domain + all subdomains | Only URLs starting with the entered address | Whole domain + all subdomains |
Query parameters (?…) | Irrelevant | Ignored when matching | Ignored when matching |
Wildcards (*.domain) allowed when entering | full URL required | Not directly; weblink dependencies may use them | Same as default site lock |
Block-only plans and the org blocklist
For blocking the path is honored, also as a prefix:
Blocked entry: example.com/games | Result |
❌ Blocked | |
❌ Blocked | |
✅ Allowed | |
example.com (homepage) | ✅ Allowed |
A URL with a path in a Block-only plan blocks that section of the site only; the rest of the domain stays reachable.