Why organisations block Twitch
Live streams last for hours and keep running in a background tab. That makes Twitch different from on demand video: the cost is continuous, and the pull to keep watching is strong.
Minimum age rules apply too: Twitch's terms set a minimum age of 13, with parental involvement required for younger teens in many regions. Check the current terms for your country.
Before you start: a five minute inventory
Answer these questions first. They decide which runbook applies and which exceptions you will need to plan for.
- Which networks are in scope: staff, students, guests, IoT and entertainment devices?
- Which devices do you manage, and which are personal or visitor devices?
- Does anyone have a work reason to watch or broadcast, such as marketing, a game studio or an esports team?
- Should the block follow laptops and Chromebooks off site, or apply on premises only?
- Is a softer control enough, such as shaping or a schedule, or is a full block required by policy?
Verified Twitch domains
These domains are operated for Twitch and carry the site, live video, images and service traffic. Twitch adjusts its infrastructure over time, so use this as a baseline and let a category rule pick up new names.
| Domain | Role | Effect of blocking |
|---|---|---|
twitch.tv | Website, sign in, channel pages, chat and API hosts | The interface and chat stop working |
ttvnw.net | Live video delivery | Streams stop playing, even in embeds |
jtvnw.net | Static files, avatars, thumbnails and emotes | Pages render without images |
twitchcdn.net | Further video and asset delivery | Closes leaks in partial blocks |
twitchsvc.net | Service and back end traffic used by Twitch apps | Apps fail to connect fully |
Do not block shared cloud delivery networks. Some Twitch assets travel through general purpose content delivery networks that also serve thousands of unrelated websites. Block Twitch's own domains and leave shared infrastructure alone.
Not sure whether a hostname in your logs is Twitch related? Check it in our domain lookup tool before adding it to a rule.
Runbooks by environment
Each runbook lists what to configure, how to handle exceptions and what to check afterwards. Methods are vendor neutral and work with most firewalls, DNS filters and device managers.
Most organisations need more than one runbook. A school, for example, usually combines the school runbook for students with the office runbook for staff and the guest runbook for visitors. Keep one policy object per runbook so changes stay predictable.
Office or corporate network
DNS + firewall + endpointConfigure
- DNS filter: block Streaming Media, or the Twitch domains with subdomains.
- Firewall: Twitch application rule, outbound DNS only from your resolver, port 853 blocked.
- Laptops: endpoint web filtering or a browser URL blocklist via Intune.
Exceptions
- Marketing or community teams who run a brand channel.
- Game studios that need to watch their own streams.
- Grant by user group, with an owner and review date.
Check
- Stream stops in a browser tab within a minute.
- Desktop and mobile apps cannot connect.
- Off site laptop still blocked.
School or district
Google Admin + DNS + firewallConfigure
- Chromebooks: add the Twitch domains to Blocked URLs in the Google Admin console for student units, and block the Twitch Android app.
- Student SSID: block Streaming Media and Gaming categories on the DNS filter.
- Firewall: force DNS, block QUIC on UDP 443 for student VLANs.
Exceptions
- Esports clubs may need supervised access during club hours.
- Use a separate staff unit or a scheduled rule for the club room.
- Keep chat in mind: supervise sessions where it is visible.
Check
- Student Chromebook at home: blocked.
- Student phone on school Wi-Fi: blocked.
- Club room during club hours: allowed, outside hours: blocked.
Gaming café, LAN venue or esports arena
Firewall + shapingConfigure
- Block Twitch viewing on player machines during tournaments, so bandwidth goes to game traffic.
- Allow it on the broadcast machine that streams the event.
- Shape streaming on the public Wi-Fi instead of blocking it.
Exceptions
- Broadcast and production machines by address or device group.
- Staff devices on their own VLAN.
Check
- Player machines cannot load streams.
- Outgoing broadcast is not affected.
- Game latency is stable under load.
Guest Wi-Fi
DNS + firewall onlyConfigure
- DNS filter policy for the guest SSID with Streaming Media blocked or shaped.
- Firewall rule forcing DNS to your resolver.
- Client isolation so guest devices cannot reach each other.
Exceptions
- Usually none. If you sell a premium tier, give it its own SSID and policy.
Check
- Personal phone on guest Wi-Fi: blocked or limited.
- Terms of use mention the streaming policy.
Library or public computers
Kiosk policy + DNSConfigure
- Browser policy on public machines with the Twitch domains in the block list.
- DNS filter policy for the public network with Streaming Media blocked or time limited.
- Session timers so one user cannot hold a machine for a whole stream.
Exceptions
- Staff desks on a separate network segment.
- Event rooms where the library hosts gaming sessions.
Check
- Public machine: Twitch blocked after a reboot or session reset.
- Public Wi-Fi: blocked or limited for personal devices.
Remote and hybrid workforce
Endpoint firstConfigure
- Endpoint web filtering or a roaming DNS agent on every company laptop.
- Managed browser policy as a second layer.
- No reliance on the office network, since most traffic never reaches it.
Exceptions
- Same groups as in the office, managed in one place.
- Personal devices stay out of scope.
Check
- Laptop on home broadband: blocked.
- Laptop on a phone hotspot: blocked.
- Policy reports show the device as compliant.
Methods in detail
The runbooks combine these building blocks. Here is what each one does well and where it stops.
Router
- Add twitch.tv and the delivery domains to the blocked list.
- Keyword rules for "twitch" help if exact matching is all you have.
- Easy to bypass with a VPN or custom DNS.
DNS filter
- Covers every device that uses your resolver, including consoles and TVs.
- Category policies catch new Twitch hosts without edits.
- Needs the firewall to stop resolver changes.
Firewall
- Application signatures identify Twitch traffic directly.
- Schedules and user groups for clubs and teams.
- Traffic shaping as a softer alternative.
Intune
- Push a URL blocklist with the Twitch domains to Edge and Chrome through the settings catalog.
- Or add the Twitch domains as block indicators in your endpoint protection, deployed with Intune.
- Endpoint level blocking also covers Firefox and other browsers.
Google Admin
- Blocked URLs per organizational unit for Chromebooks.
- Block the Twitch Android app and any Twitch extensions under Apps and extensions.
- Policy applies wherever the student signs in.
Phone MDM
- Supervised Apple devices: hide or block the Twitch app, add domains to the web content filter.
- Android Enterprise: leave Twitch unapproved in managed Google Play.
- Only control that works on mobile data.
Esports programs: a supervised access model
Many schools and colleges run esports teams, and coaches use Twitch to review matches and broadcast games. A blanket block is not always the right answer for them.
Who
- Named coaches and team members, in a dedicated group or organizational unit.
- No access for the general student population.
When and where
- Scheduled rule for practice and match times only.
- Applied to the esports room VLAN, not the whole campus.
How
- Adult supervision while chat is visible.
- Broadcast from a school account with chat moderation set up.
- Logs reviewed by the program lead each term.
Common mistakes and what to watch in logs
Most failed Twitch blocks come down to a handful of oversights. Your DNS and firewall logs tell you quickly which one applies.
| Mistake | Log signal | Fix |
|---|---|---|
| Only twitch.tv blocked | Successful lookups for ttvnw.net and jtvnw.net hosts | Add the delivery domains or switch to a category rule |
| Exact hostname instead of domain | Blocked www.twitch.tv but allowed other subdomains | Use subdomain matching on the registrable domain |
| Guest SSID forgotten | Twitch lookups only from the guest address range | Apply the policy to every SSID and VLAN in scope |
| Encrypted DNS not handled | Few DNS queries at all from some devices, but high video traffic | Disable secure DNS by policy and block known encrypted resolvers |
| VPN use after rollout | Spike in VPN and proxy category lookups | Block the category and VPN apps through MDM |
App vs browser, and the embed problem
Twitch reaches users through more surfaces than most services. Each one needs to be covered by at least one layer.
| Surface | What happens when blocked | Layer that covers it |
|---|---|---|
| Browser tab | Block page or error, stream stops | DNS filter, firewall, endpoint policy |
| Embedded player on another site | Player shows an error or stays black | Same, because embeds load from Twitch domains |
| Mobile app on Wi-Fi | "Unable to connect" style messages | DNS filter plus firewall app rule |
| Mobile app on cellular | Not affected by network rules | MDM only |
| Console and TV apps | App fails to load streams | DNS filter and firewall on that segment |
| Browser extensions and overlays | Stop showing live status | Google Admin or browser extension policy |
VPN and proxy bypass
Gamers tend to know their way around VPNs, so plan for bypass attempts from day one. The flow below shows the usual escalation and the control that answers each step.
Our VPN and proxy category tracks VPN services, web proxies and anonymizers, including the many short lived proxy sites that appear every week.
How to test the Twitch block
Live video makes testing easy: either a stream plays or it does not. Repeat the full set after every firewall firmware update and at the start of each school term or quarter, since profiles and devices change. Use a busy channel so you can see results quickly, and test each surface from the table above.
Keep the results in a simple log that any colleague can find. It saves time during audits and when the next person inherits the network.
- Run nslookup for twitch.tv and for a host under ttvnw.net from a client on each network. Expect a block answer.
- Open a live channel in a private browser window after flushing DNS. Expect a block page or error.
- If a tab was already playing before the change, reload it. Existing connections can survive briefly.
- Open a web page with an embedded Twitch player. Expect an error or black frame.
- Open the mobile app on Wi-Fi, then on mobile data with a managed phone.
- Set a public DNS server manually on a test laptop. Twitch should stay blocked.
- Test exceptions: club room during club hours, marketing user account.
- Record each result with date, network and device type.
Category based blocking for live streaming and gaming
Twitch is one of many live streaming platforms, and new ones launch regularly. A category database covers the whole group, so blocking Twitch does not simply move viewers to a smaller site.
Twitch sits in our Streaming Media category, with Gaming as a ranked secondary category. That lets a school block it under either policy, and lets a gaming venue allow game downloads while blocking streams.
Firewall, DNS filter and MSP platforms license the database to run these policies inside their own products, as files in their own systems with a lookup API included. MSPs can read our MSP web filtering notes, and schools can see K-12 school web filtering. Blocking video more broadly? See how to block YouTube or enforce Restricted Mode.
Twitch blocking FAQ
Which domains do I block to stop Twitch?
Block twitch.tv plus its delivery and service domains ttvnw.net, jtvnw.net, twitchcdn.net and twitchsvc.net, all with subdomains. Back the list with a Streaming Media category block.
Can I block Twitch by blocking Amazon CloudFront?
No. Some Twitch assets are delivered through shared cloud delivery networks used by thousands of unrelated sites. Blocking those would break large parts of the web. Block Twitch's own domains instead.
Why do Twitch streams still appear on other websites?
Websites can embed Twitch players. The embed still needs Twitch's domains, so once twitch.tv and the video delivery domains are blocked, embeds show an error or an empty frame.
Does blocking Twitch affect online games?
Usually not. Games run on their own servers. Some games link Twitch accounts for rewards, and those links will fail while Twitch is blocked.
Which category is Twitch in?
Twitch is in Streaming Media in our database, with Gaming as a ranked secondary category, so you can block it with either a streaming or a gaming policy.
Can I block Twitch only during lessons or work hours?
Yes. DNS filters and firewalls support scheduled rules. Apply the block during core hours and lift it at lunch or after hours if your policy allows, and test both states.
Does blocking Twitch stop people from streaming to Twitch?
Blocking twitch.tv and its service domains also stops broadcasting software from connecting to Twitch ingest servers in most cases. If you need to allow outgoing broadcasts for an event, create a specific exception for the broadcast machine.
Live streaming and gaming categories for your product
120 million categorized domains with daily updates, delivered as downloadable files. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Twitch is a trademark of Twitch Interactive, Inc. Amazon CloudFront is a trademark of Amazon.com, Inc. or its affiliates. Microsoft, Intune and Edge are trademarks of Microsoft Corporation. Google, Chrome, Chromebook and Google Play are trademarks of Google LLC.
Apple and iCloud are trademarks of Apple Inc. Firefox is a trademark of the Mozilla Foundation. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.