How to Block AI Image Generators on Your Network
AI image tools turn a sentence or a photo into a new picture in seconds. That is useful for design teams and a real problem in classrooms, HR files and brand channels.
This guide covers which tools to target, the methods that work on each layer, and how to keep up with the new generators that launch every week.
In this guide
- Why organisations block image generation
- Where image tools hide, beyond the famous sites
- Known generator domains to start with
- Six layers of blocking, from router to MDM
- Apps, bypass routes and a test matrix
- Category rules that update themselves
Why organisations block AI image generators
The reasons depend on who sits on the network. A school worries about pupils, a bank about brand fraud, a creative agency about licensing. The three risk groups below cover most cases.
Fake images of real people
- Sexualised or humiliating images of pupils or staff made from a class photo
- Fake evidence in bullying, harassment or extortion
- Sexual images of children are illegal in many countries whether real or AI-generated
- In the US, the Take It Down Act (2025) targets non-consensual intimate images, including AI-made ones
Brand, fraud and copyright
- Fake product photos, fake receipts and fake screenshots used in scams
- Generated images that copy a protected style or logo reaching marketing
- Unclear licence terms for commercial use on some tools
- Deepfake executive images used in social engineering
Uploads and bandwidth
- Staff upload product photos, ID scans or client images to edit them
- Uploaded photos may be stored or shown in public galleries
- Video and image generation can use heavy bandwidth on school networks
- Explicit content generated by tools with weak filters
Schools: blocking does not replace an incident plan. Decide in advance who handles a report of a fake image of a pupil, how evidence is kept and when police or child protection services are involved. Check the current guidance in your country.
Where AI image generation hides
A list of the five famous generators covers a small slice of real use. Image generation now sits in many kinds of sites and apps, and each needs a different control.
Known AI image generator domains
These are the main public domains of widely known image tools, offered as a starting list. Services add and change domains, so a category rule is what keeps the block complete.
| Service | Main domain | Note for admins |
|---|---|---|
| Midjourney | midjourney.com | Also usable through a community chat app, so block there too if needed |
| Leonardo | leonardo.ai | Image and video generation in one account |
| Ideogram | ideogram.ai | Strong at text inside images, popular for fake signs and posters |
| Stability AI | stability.ai | Company site and model access; models also run elsewhere |
| Adobe Firefly | firefly.adobe.com | Block the subdomain only; blocking adobe.com breaks other Adobe services |
| Craiyon | craiyon.com | Free, no account needed, common in schools |
| NightCafe | nightcafe.studio | Community gallery of generated images |
| Playground | playground.com | Image generation and editing |
To see how any of these, or a site from your own logs, is categorized, use the domain category lookup. For a full log export, bulk categorization is faster.
Six layers for blocking AI image tools
Stack the layers that match your estate. Small offices may need only the first three; schools with take-home devices need all six.
- Block the Image & Visual and Video AI subcategories, or the whole AI category for students.
- Add the domains above as a safety net.
- Force clients to your resolver and block encrypted DNS hosts.
- Set the vendor's AI category to block for student or general staff groups.
- Import an external dynamic list of image and video generators so you can block them while other AI tools stay open.
- Keep an allow rule for design staff if they have an approved tool.
- Add domain indicators with a block action in Defender for Endpoint, with network protection on.
- In Defender for Cloud Apps, filter the Generative AI catalogue for image tools and tag them unsanctioned.
- Use the Edge URL block list policy for browser coverage on Windows.
- Under Devices, Chrome, Settings, URL blocking, add generator domains for student organisational units.
- Block image and avatar extensions in the Chrome Web Store settings.
- Review image features in Workspace apps under the Generative AI settings.
- Allow only approved apps on school and work phones and tablets.
- Block face-swap and avatar apps by name or by store category where your MDM supports it.
- Push a DNS profile so mobile data passes the same filter.
Apps vs browser, and the bypass routes
Browser access is the easy part. The harder part is the phone app and the person who wants around the block.
App vs browser
- Browser: domain rules on DNS, firewall and browser policy all apply
- App on your Wi-Fi: domain rules apply, but users see an error, not a block page
- App on mobile data: only MDM controls apply
- Apps that process images on the phone itself make no network call to block, so app restrictions are the only option
- Desktop image apps: application control on managed computers
Bypass routes to close
- Consumer VPN apps: block the VPN and proxy category and app installs
- Mirror and wrapper sites: category coverage, updated daily
- Encrypted DNS: disable DoH in browser policy
- Generators inside allowed chat apps: control via that app
- Personal hotspots: device-level policy on managed laptops
- Image hosts linked from blocked tools: the adult content category catches explicit galleries
Test matrix
Run each cell. A pass means a clear block page or a clean failure; a fail means the tool generated an image.
The last row matters. If ordinary stock photo or design sites break, your rule is too broad. Good category data keeps creative software in its main category with AI as a secondary one.
Signs that image generators are already in use
Before you block, look at what your logs already show. It tells you how big the change will be for users and which teams to talk to first.
Allowing image generation safely for creative teams
A design or marketing team may have good reasons to use image tools. A short guardrail list lets you say yes to them without opening the tools to everyone.
Guardrails to set first
- One approved tool under a business plan, with commercial use terms checked by legal
- Access only for the named group, by directory group on the firewall
- No uploads of photos of real customers, staff or children
- Generated images labelled as such in internal files
- Explicit content settings locked in the tool's admin panel
What stays blocked for everyone
- Face-swap, undressing and "enhance" sites
- Generators that also carry the Adult category
- Unvetted tools with public galleries of user uploads
- Wrapper sites that resell access with no clear owner
- Proxy-capable AI tools that open other blocked content
When a fake image is reported
Do not share or forward the image. Record where it was seen and who reported it.
Pull the filter logs for the time window to see which tool and device were involved.
Block the specific domain at once while the category update catches its siblings.
Follow your safeguarding or HR process, and the reporting routes required in your country.
Policy by role: a quick reference
Most networks need only a few roles. Map each to a firewall or filter group, then attach one policy per row.
| Role | Image tools | Video tools | Photo uploads to AI | Why |
|---|---|---|---|---|
| Primary pupils | Block | Block | Block | Age limits in tool terms, safeguarding |
| Secondary students | Block or one chosen tool in class | Block | Block | Fake image risk among peers |
| Teachers | Warn | Warn | Block photos of pupils | Lesson material, privacy of pupils |
| Office staff | Warn | Block | Block | Brand and data risk |
| Design and marketing | Allow approved | Allow approved | Allow, no real people | Business need under contract |
| Guests | Block explicit tools only | Allow | Allow | No company data involved |
Common mistakes when blocking image generators
These are the errors that make a block look fine on day one and leak by week three. Each has a simple fix.
| Mistake | What goes wrong | Fix |
|---|---|---|
| Blocking a parent domain | Blocking a whole software company's domain to stop its image feature breaks fonts, licences and sign-in for other products | Block the generator subdomain, or use the suite's admin setting |
| Only blocking famous brands | Users move to a smaller generator within a day | Block the Image & Visual subcategory, not five names |
| Forgetting video tools | The same fakes appear as short clips | Treat the Video subcategory the same as images for minors |
| No rule for guest Wi-Fi | Pupils and staff use personal phones on the guest network | At least block explicit and face-swap tools on guest networks |
| No block page | Users think the network is broken and try a VPN | Show a short page that names the policy and who to ask |
| Never reviewing | The list ages while new tools launch daily | Use category data with daily updates and review logs each term |
MSPs who manage many schools or offices can hold one policy template and apply it per tenant. See web filtering for MSPs for how that works with category data.
Category-based blocking with our database
Image generators come and go fast, and many are thin wrappers around the same models. Rules that read a category stay current without anyone editing lists.
16,000+ AI-tool domains in 18 subcategories, including Image & Visual, Video and Design, 3D & Creative.
About 300,000 newly registered domains categorized daily, rechecked after a week and a month.
Several ranked categories per domain, so an explicit fake generator carries both AI and Adult.
Files that run in your own systems, with exports such as RPZ, EDL and hosts lists.
Suggested rule set
| Category in our data | Students | General staff | Design team |
|---|---|---|---|
| AI / LLM Tools: Image & Visual | Block | Warn | Allow approved |
| AI / LLM Tools: Video | Block | Warn | Allow approved |
| AI / LLM Tools with Adult | Block | Block | Block |
| AI / LLM Tools: Design, 3D & Creative | Block or allow chosen | Allow | Allow |
| VPN / Proxy / Anonymizers | Block | Block | Block |
Read more on the AI / LLM Tools category, the related nudity category, and how districts handle this on the K-12 web filtering page. The available export types are covered in blocklist formats.
Frequently asked questions
Can I block AI image generation but keep a general chat assistant?
Partly. Standalone image tools have their own domains and can be blocked by category. Image features built into a chat assistant usually share its domains, so control them in the assistant's admin settings.
Why do schools block AI image generators?
Mainly to prevent fake and sexualised images of real pupils and staff, and to respect the age limits in the tools' own terms. Some tools also produce adult content with weak filters.
Will blocking image generators break design software?
It should not, if the data separates design suites from generators. Suites with a generative feature keep their main category, with AI as a secondary one.
How do I stop image generation bots inside chat apps?
Bots inside a chat or community app use that app's domains. Control them through the chat app's own settings or block the app for the affected users.
Which category covers AI image generators in your database?
AI / LLM Tools, Image & Visual subcategory. Tools whose output is mainly explicit also carry the Adult category.
Are AI image generators illegal?
Most are legal tools. What is illegal in many places is the content some people make with them, such as sexual images of children or non-consensual intimate images. Check the current law in your country.
Can students still use a generator on their own phone?
On their own mobile data, yes. Your controls cover school devices and school networks. That is why schools pair the block with clear rules, education about fake images and an incident plan.
Should we block image generators for staff too?
Many organisations warn rather than block for staff, and fully block only explicit and face-swap tools. Teams with a business need get one approved tool under a contract.
Do I need TLS inspection to block image generators?
No. Domain-level blocking works from DNS or the server name the browser sends. Inspection is only needed for path-level rules or upload controls.
Keep image generator blocks current
License category data with AI subcategories, daily updates and multi-category ranking for your filter, firewall or school product.
Talk to usMidjourney, Leonardo, Ideogram, Stability AI, NightCafe, Playground and Craiyon are trademarks of their respective owners. Adobe and Firefly are trademarks of Adobe Inc. Microsoft, Intune, Defender and Edge are trademarks of Microsoft Corporation.
Google, Chrome and Google Workspace are trademarks of Google LLC. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.