How to block Snapchat on your network
Snapchat is a phone app first and a website second. That changes how you block it: the network layer matters, but the device layer usually decides whether the block really holds.
This guide is for school IT teams, youth organisations, businesses and the MSPs who run their networks.
Why schools and employers block Snapchat
The reasons are less about bandwidth and more about safeguarding, conduct and evidence. Disappearing messages make problems harder to see and harder to investigate after the fact.
Safeguarding
Contact from strangers, location sharing on the map and image sharing among minors are the main concerns for schools and youth groups.
Bullying in school hours
Group chats and stories can spread a hurtful image across a year group within minutes, during lessons.
Attention in class
Streaks push students to open the app every day, often during lessons. Removing it from school Wi-Fi reduces that pull.
Records and conduct
Businesses in regulated sectors cannot allow client discussions in channels that erase themselves.
Workplace privacy
Photos snapped in a clinic, lab or warehouse can show patient data, prototypes or customer records.
Age rules
Snapchat's terms require users to be at least 13. Primary schools and junior clubs often block it outright for that reason.
Verified Snapchat domains
These are the well-known official hosts. Block each with all subdomains. Snapchat has changed hosts over time, so treat this as a starting point and confirm in your logs.
| Domain or host | What it does | Block? |
|---|---|---|
snapchat.com | Main site, account pages, app API hosts such as app.snapchat.com, and Snapchat for Web. | Core |
sc-cdn.net | Content delivery for snaps, stories, lenses and app assets. | Core |
feelinsonice-hrd.appspot.com | A long-standing Snapchat API host on Google App Engine. Block this exact hostname only. | Core |
snap.com | Corporate site of Snap Inc., the parent company, and some business pages. | Optional |
bitmoji.com | The avatar service owned by Snap, linked to Snapchat accounts. | Optional |
appspot.com | Shared Google App Engine domain used by thousands of unrelated apps. | Never |
Keep blocks narrow. A rule on the whole appspot.com domain breaks unrelated school and business tools that run on the same platform. Match the exact Snapchat host instead.
Before adding an unknown host from a log, check it in the domain category lookup. Anything labelled Social Networking belongs in the same rule.
The five-layer Snapchat block
Each layer catches what the one above misses. Small sites can stop at layer two; schools with managed phones or tablets should go all the way down.
Write the rule first
- State that Snapchat is not allowed on school or company Wi-Fi and devices, and why.
- Say whether personal phones on mobile data are covered by conduct rules, since your network cannot reach them.
- Name the person who approves exceptions, for example a media club or a social media team.
Stop the names resolving
- Set DHCP to hand out your filtering resolver on every SSID, including guest and student.
- Block the Social Networking category and the core domains above.
- On a home-style router, use the website block or parental control page and add each domain.
- Force all port 53 traffic to your resolver and drop outbound DNS over TLS on port 853.
Catch what DNS misses
- Add the application signature for Snapchat to an application control block rule.
- Use a URL filter profile with the social category blocked as a second check.
- Block QUIC on UDP 443 so the firewall sees server names on TCP.
- Where possible, enable TLS inspection for student segments and exclude sensitive categories such as banking and health.
Close Snapchat for Web
- In Google Admin, add snapchat.com to the URL block list for student and staff organisational units.
- In Intune, push an Edge URL block list policy, or a web content filter that blocks Social networking.
- Turn off browser-level DNS over HTTPS by policy so the browser uses your resolver.
Control the app itself
- Block the app from installing, or remove it, on owned iOS and Android devices.
- Push an always-on filter or DNS profile so rules apply on mobile data too.
- Prevent users from adding VPN profiles or changing private DNS settings.
MDM steps by platform
The menu names vary by MDM product, but the controls exist in every mainstream tool. Supervised or fully managed devices give you the most control.
- Create a restrictions profile that hides or blocks the Snapchat app by its bundle ID.
- Add a web content filter payload with snapchat.com and sc-cdn.net on the deny list.
- Restrict installing apps to those approved through your volume purchase account.
- Block VPN configuration changes.
- Use a fully managed or work profile mode.
- Allow only approved apps from managed Google Play; leave Snapchat off the list.
- Set a private DNS hostname for your filter and stop users changing it.
- Disallow user-added VPN apps, or set an always-on VPN to your filter.
- In Google Admin, block the Snapchat Android app for the organisational unit.
- Add snapchat.com to Chrome URL blocking for the same unit.
- Restrict Chrome extensions to an approved list so proxy extensions cannot be added.
- Pair with a category filter for new hosts.
App vs browser, and why phones escape
A phone on your Wi-Fi follows your DNS and firewall rules. The same phone on mobile data follows nobody's rules but its own. Plan for both cases in writing so expectations are clear.
Phone on your Wi-Fi
Covered by DNS, firewall and category rules. The app fails to send or load snaps when the core hosts are blocked.
Phone on mobile data
Outside your network. Only MDM on an owned device, or a phone policy in school, reaches it.
Snapchat for Web
Runs in a desktop browser on a snapchat.com subdomain. Covered by domain blocks and browser URL policy.
Personal devices (BYOD)
Put them on a separate SSID with DNS filtering. You control what the Wi-Fi resolves, not what the phone installs.
The common bypass routes and how to close them
Students in particular share workarounds quickly. These are the routes that turn up in school networks most often, with the control that closes each one.
Free VPN apps
Block the VPN / Proxy / Anonymizers category, block VPN signatures in app control and stop VPN profile installs through MDM.
Private DNS on Android
Phones can send DNS to a public resolver over TLS. Block outbound port 853 and enforce private DNS settings on owned devices.
Hotspot from a friend
No network rule reaches this. A school phone policy and MDM on owned devices are the only answer.
Web proxy sites
Proxy front-ends for social apps appear under new names daily. A category refreshed daily is the practical defence.
Cached sessions
An app opened before the rule went live may hold a connection briefly. It fails at the next reconnect.
Alternative apps
Blocking one app often moves students to another. Category rules for Social Networking and Email and Messaging cover the next one too.
How to test the Snapchat block
Use a test phone set up like a student or staff device, signed into a test account, with mobile data turned off.
- From a client on the network, run
nslookup app.snapchat.comand confirm your resolver blocks it. - Open the app and try to send a snap to the test account. It should fail to send.
- Open a story. Media from sc-cdn.net should fail to load.
- On a laptop, open Snapchat for Web in Chrome and Edge. The block page or an error should appear.
- Install a free VPN on the test phone and confirm it cannot connect.
- Set Android private DNS to a public provider and confirm the phone loses connectivity rather than reaching Snapchat.
- Turn mobile data on and confirm MDM controls still block the app on owned devices.
- Check the DNS and firewall logs for the blocked events, tagged with the right category.
Recommended settings by type of site
The right depth of block depends on who uses your network and what you are responsible for. Use this as a starting point, then adjust to your own policy and local rules.
| Setting | Network layer | Device layer | Watch out for |
|---|---|---|---|
| Primary school | Block Social Networking and VPN categories on every SSID. | Block the app on all school tablets and Chromebooks. | Pupils joining a parent's hotspot at pick-up time is outside your control; cover it in the home-school agreement. |
| Secondary school | Block on student SSID; staff SSID per policy. | MDM block on school devices; BYOD on a filtered SSID. | Proxy and VPN sites shared between students. Review VPN category hits weekly. |
| Youth club or sports academy | DNS filter on the guest network with social apps blocked. | Usually none; devices are personal. | Staff phones used for club photos should follow a separate safeguarding policy. |
| Office | Block for most groups, allow for social media staff. | Endpoint web filter or Chrome policy on laptops; MDM on company phones. | Business uses such as advertising on Snapchat need an exception group. |
| Clinic or care home | Block on staff and patient networks. | MDM block on shared devices and work phones. | Patient privacy: photos in clinical areas are the real risk, so pair the block with a camera policy. |
| Retail or hospitality guest Wi-Fi | Usually allowed; block adult and malware categories only. | None. | If families are the main guests, consider blocking social apps for under-age portals. |
Still working after the block? A quick diagnosis
Works on one phone only
Look at that phone's network settings for a VPN profile, a private DNS hostname or an MDM exemption.
Chats send, media fails
The API host is reachable but the content host is blocked. Find the API hostname in your logs and add it.
Works for a few minutes
Cached DNS on the device. Toggle airplane mode or wait for the record to expire, then test again.
Works on the staff SSID
Check that the staff network uses the same resolver and policy, or that the difference is intended.
Keep the block current with category data
A list of five domains will not stay accurate for long. A Social Networking category, refreshed every day, catches new web clients, lookalikes and proxy front-ends without manual edits.
Social Networking
The category for Snapchat and its web client. Block it on student and general staff policies.
Email and Messaging
Chat apps that students move to next. See the messaging category.
VPN / Proxy / Anonymizers
The category that keeps the other two from being bypassed.
For schools, read about K-12 school web filtering; for app makers, see the parental control app category database.
Related guides: how to block X (Twitter) and how to block Roblox on a school network.
What to tell students, parents and staff
A block that nobody understands generates workarounds. A clear, short explanation reduces both tickets and attempts to get around it.
Students
Explain that school Wi-Fi is for learning, that VPN use is logged and against the rules, and where they can get help if something on a social app upsets them.
Parents
Say plainly that the school can block Snapchat on its own Wi-Fi and devices, but not on a phone using mobile data. Point them to the phone settings and parental tools they control at home.
Staff
State whether staff may use the app on the staff network, and remind them never to contact students through personal social accounts.
Help desk
Give the team a one-line answer for "Snapchat is not working" tickets and the exception process, so the policy is applied the same way every time.
Safeguarding lead
Share the weekly report of blocked Snapchat and VPN attempts. Repeated attempts from one device can be an early sign that a student needs support, not only a sanction.
Snapchat blocking FAQ
Can I block Snapchat on my Wi-Fi?
Yes. Block snapchat.com and sc-cdn.net with their subdomains in your DNS filter or firewall, plus the Social Networking category. Phones on that Wi-Fi will no longer load snaps or chats. Phones on mobile data are not affected by a Wi-Fi rule.
Should I block appspot.com to stop Snapchat?
No. appspot.com hosts thousands of unrelated Google App Engine apps, including school and business tools. Block only the specific Snapchat hostname on it if you see it in your logs.
Does blocking Snapchat on the network stop it on mobile data?
No. Mobile data bypasses your network entirely. On school or company owned phones, use MDM to block or remove the app and apply a device-level filter. On personal phones, network rules only cover your Wi-Fi.
What is Snapchat for Web and does it need a separate block?
Snapchat for Web lets users chat and call from a desktop browser on a snapchat.com subdomain. Blocking snapchat.com with subdomains covers it, as does a browser URL block list in Google Admin or Intune.
Why does Snapchat still work after I blocked its domains?
Usual causes are cached DNS answers on the phone, the phone switching to mobile data, a VPN or private DNS setting on the device, or a hostname you have not blocked. Check your logs for Snapchat traffic and block the Social Networking category as well as the names.
How does a category database help block Snapchat?
New hosts, web clients and lookalike sites get labelled Social Networking as they are categorized, so a category rule catches them without anyone editing a list.
Power your filter with daily category data
For filter vendors, MSPs and edtech makers: 120 million domains in 59 categories, running inside your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
License the databaseSnapchat and Bitmoji are trademarks of Snap Inc. Google, Chrome, Android and App Engine are trademarks of Google LLC; Apple, iPhone and iPad of Apple Inc.; Microsoft and Intune of Microsoft Corporation; other names belong to their respective owners.
They are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.