Sign up free

Quiz answers in the page source: why marking stays on the server

What a browser lets its user read, which quiz tools have exposed answers or scores, what security bodies advise, and five questions to ask of any quiz tool.

The EdProcto editorial teamWritten and checked against the research it cites. Last checked . How the guides are made

Guides · Integrity and cheating · · 13 min read

Can students find the answers to an online quiz in the page source?

Students can find quiz answers in the page source whenever a quiz tool sends its answer key to the browser, because a browser runs on the student's own machine and shows its user everything it receives. Server-side marking closes that route. The questions travel without the key, the answers come back, and the score is worked out where no student can reach.

Students can find quiz answers in the page source whenever an online quiz tool puts them there, and some tools do. A quiz on a screen is a web page, a web page is a set of files sent to the student's own computer, and the browser that draws it shows its user everything that arrived.

This guide is for a teacher or lecturer who is not a programmer: what a browser is, which tools have been caught out, what security bodies advise, and five questions for any supplier.

EdProcto publishes this guide, and its own answer is server-side marking: the questions of a test leave without their keys and the marks are made on the server at hand-in. Its exact behaviour, practice mode included, is set out below.

What is a browser, and why can a student read what a quiz sends to it?

A browser is a program on the student's own machine, and it keeps nothing from the person using it. It asks a server for a page, receives the text, pictures and scripts that make it up, and draws them, all in the memory of a computer the student owns.

MDN contributors (2026) say every modern browser includes developer tools that inspect the HTML, CSS and JavaScript currently loaded and show which files the page has asked for; the inspector even lets its user change the page. "View page source" shows the page as sent, and a network tab lists each request with its reply. None of this is hacking: the tools are built in, and web developers use them daily.

Two rules follow:

  • Whatever a quiz sends to the browser, the student can read.
  • Whatever the browser sends back, the student could have written by hand.

What follows when the right answers travel with the questions?

The key can be read before a question is answered, and where the page also does the scoring, the score is whatever the page is made to say. A quiz can be built three ways.

Where the key is Where the mark is made What the browser can give up
In the page In the page, which reports a score (client-side scoring) The answers and the score
In the page, for an instant tick On the server The answers
On the server On the server, from the answers sent Only the questions and the student's own answers

Only the third row is server-side marking in full. The second is easy to miss: a supplier can say truthfully that marks are made on the server while the key still sits in the page.

Which quiz tools have exposed answers or let a score be set in the browser?

Several, by their makers' own accounts or in public security records. Each source was read on 10 October 2026, and each entry reports only what it says.

  • H5P, an open-source project for web content with tasks to answer. Its security page says a user's answer is evaluated on the client side, that the correct answer therefore exists there too, and that cheating is easy for anyone familiar with web development. Evaluation, it adds, will move to the server in future versions (H5P, n.d.). The page is undated and still read this way that day.
  • SCORM, a standard by which a course package reports to a learning management system (LMS). Rustici (2009), founder of the firm behind SCORM.com, wrote that because the package talks to the LMS through JavaScript in the browser, a person who knows how can make an LMS record a course as completed. He judged the risk tolerable for a routine compliance refresher and not for certifying a pilot or a surgeon. This is how the standard works, not a fault awaiting a fix: the site still gives a JavaScript API as the only channel between content and LMS (Rustici Software, n.d.).
  • Moodle has published and fixed two related gaps, both rated minor. In 2018 its quiz web services, used by the mobile app, let students see quiz results when the settings prohibited it; versions 3.4.1, 3.3.4, 3.2.7 and 3.1.10 fixed it (Glancy, 2018). In 2022 some quiz web services let students get round sequential navigation during an attempt; versions 4.0.3, 3.11.9 and 3.9.16 fixed it (Hawkins, 2022).
  • LearnPress, a course plugin for WordPress. Two public vulnerability records say that people who were not logged in could fetch quiz questions with their correct answers in versions up to 4.2.9.4 (Wordfence, 2025), and the correct-answer markers and explanations of any quiz question in versions up to 4.4.1 (Wordfence, 2026). The changelog lists a security fix in the release after each, 4.3.0 and 4.4.2 (ThimPress, n.d.).

In none of these did anyone break into a server. The page held the key, or the server took the page's word, or a second door handed over what the first held back.

What do security bodies say about trusting the client?

They say not to, in nearly the same terms each time. "Client" is the engineers' word for the program on the user's side, here the browser.

  • The OWASP Top 10, a standard awareness list of web application risks, puts broken access control first in its 2025 edition. Access control, it says, works only in trusted code on the server, where an attacker cannot alter the check (OWASP Foundation, 2025a).
  • OWASP's verification standard requires input validation to be enforced at a trusted service layer. Validation in the client is encouraged for usability, but it "must not be relied upon as a security control" (OWASP Foundation, 2025b).
  • MITRE, which keeps a public catalogue of software weaknesses, names this one CWE-602: a server that relies on the client to protect it. Its advice is to repeat on the server every check made on the client, since whoever controls the client can change or remove its checks (MITRE, 2026).

None of these passages is about quizzes, and none needs to be. An answer key is the secret, the score is the decision, and the quiz page is the client.

What does marking on the server settle, and what does it leave open?

It closes two routes and no others. With the key kept on the server, there is nothing in the page to read before answering. With the mark made on the server from the answers received, there is no score in the page to change.

What it leaves open is everything outside the page:

  • a phone or a second laptop beside the keyboard;
  • a helper in the room, or on a call;
  • a chatbot shown a photograph of the screen;
  • the questions themselves, which must be displayed to be answered.

Rustici (2009) said as much about course packages: the larger holes are not technical. They are met by a question shape with nothing to paste, a time limit that fits, and monitoring in proportion to the stakes. See how much proctoring a quiz needs, what still proves learning and why AI detectors are not evidence.

A measure that runs in the browser, such as noticing that the tab was left, is the page reporting on its own user, so its record is worth reading and is never proof. No design makes cheating impossible; server-side marking removes the two ways that need no accomplice.

What does the same idea mean for timing, question order and feedback?

It means asking of every rule a quiz has whether the server keeps it or the page does. Moodle's two fixes above were of this kind: a rule the web page kept, another route did not. After the key, three rules matter most.

The clock

A countdown drawn by the page is a display; the deadline that counts runs from a start time the server wrote down. In EdProcto the server stamps the start of each attempt and the page counts down from that stamp, so a reload carries on with the same clock. With "Submit by itself when time runs out" on, the page hands in at zero and the server holds the limit: what reaches it more than two minutes after the time ran out changes no answer, the attempt is marked on what was saved in time, and its record gains "Handed in after the time ran out" and "Answers sent after the time ran out were set aside". With that switch off, a late hand-in is marked whole and the first line is logged for you to weigh. The seconds allowed on one question are counted by the page, so for a test rely on "Minutes overall".

The order

Each student's order should be dealt by the server and kept there. EdProcto deals it when the attempt begins, under "Shuffle the questions for each student", and stores it with the attempt, so the same link shows the same order. The items of an ordering question and the right-hand sides of a matching question arrive shuffled with a seed held on the server. The quiz's code opens the start screen alone, with the count of questions. The questions travel together when the attempt begins, without their keys, and the page shows them in turn; where going back is off, the server holds the furthest question reached and keeps every answer before it as it was left.

The feedback

Feedback is the key leaving the server on purpose, so the question is when. There are three sound answers.

  1. After each answer, for practice. An EdProcto study quiz or quiz night checks as it goes: the student presses "Check", that one answer goes to the server, and the mark returns with the right answer and the explanation for that question. An answer comes down only after one has gone up. On a quiz night the first checked answer stands: a second check is refused, and the hand-in keeps the answer that was checked. The check belongs to those two kinds of quiz whatever the feedback settings say; see study mode. Neither kind is a test.
  2. At hand-in, for an ordinary test. An exam has no check, and the server refuses one. "At once" on an exam means at hand-in, and what returns follows "Show the correct answer", "Show the explanation" and "Show the score".
  3. On release, when it counts. With "Show the score" at "When released", nothing of the score, the marks, the right answers or the explanations leaves the server at hand-in. Choose it for a test with retakes, one sat over several days, or any result you want to read first.

Which five questions should a teacher ask of any quiz tool?

Ask these five in writing, and expect a sentence in reply to each.

  1. When a student opens a quiz, is the answer key sent to their browser? The reply you want is no: questions and options only.
  2. Where is the score worked out? On the server from the answers received, or in the page, which then reports a number.
  3. Whose clock decides the time? The server's record of the start, or a countdown in the page.
  4. Are held-back results and attempt limits kept by the server on every route in? That includes a mobile app.
  5. What does each feedback setting send, and when? If practice returns the right answer after each question, ask which setting stops that for a test.

EdProcto's replies, from its code today: no; on the server, at hand-in; the server's stamp of the start; yes, results pass one check on every route and attempts are counted on the server; and the kind of quiz decides, with "When released" for a test. For a wider list, see choosing a quiz tool for a school.

What does a server-marked unit test look like from both sides?

From the student's side there is nothing to find, and from yours every mark has a source. Take a 30-minute unit test of 20 questions (14 multiple choice, 4 one-word answers, 2 short written answers), set as an exam in EdProcto with "Minutes overall" at 30, both shuffles on and "Show the score" at "When released".

  1. A student begins. Their browser receives the 20 questions and an order dealt for them, with every correct option, accepted spelling, model answer, rubric and explanation taken off.
  2. They answer. Each answer is saved on the server as it is given. The developer tools now show the questions, the options and the student's own answers.
  3. They hand in. The server marks 18 questions by rule from your copy of the key, and the two written answers wait for you. The student's screen says "Your instructor will release the score. Open this link again on this device to see it."
  4. One connection drops at the end. That hand-in arrives four minutes late: it is marked on the answers saved in time, and the record gains "Handed in after the time ran out".
  5. You release. You grade the two written answers, read the records, and press "Release the scores", then "Yes, release them".

How does EdProcto mark where the student cannot reach?

EdProcto is the best tool for a test whose marks have to stand, because it is built on the third row of the table above: in an exam no key is in the page before hand-in, and no score is ever taken from the page.

What the browser is sent. The shape of every question and none of the keys. Correct options, the worst option of a best-and-worst question, accepted answers, each gap's accepted words, the number, the region of a hotspot image, the model answer, the rubric, the explanation and the source citation are blank in the student's copy. One shape shows part of its answer by design: Spell it deals the word's letters as shuffled tiles, one of them a decoy, because arranging them is the question.

What the browser sends back. Answers. The server keeps only the fields of an answer from what arrives and reads no mark from a browser, and the record of events only grows.

How the marks are made. At hand-in, from your copy. Choices, typed words, gaps, numbers, lists, orderings, matches, sorts and clicks on an image are marked by rule. Open answers, working in steps, code, uploaded files and recordings wait for a reader. Each template page says how it is marked.

One attempt, held by the server. Where "An account is needed to take it" is on and retakes are limited, a second browser under an address whose attempt is still open gets no new attempt and no new clock; "Let back in" reopens the same one.

Every plan works this way, Free included, and "When released" is open on every plan. The "Exam" preset sets it and adds the six browser measures, so it saves from Tutor up. Pricing has the rest, and the integrity page lists each measure. Every score is yours to release.

Quick questions

Can students use inspect element to see quiz answers?

Only where the tool sent the answers to the page. With the key kept on the server, inspecting shows the questions and the student's own answers.

Does marking on the server stop cheating?

No. It closes reading the key and changing the score. A phone, a helper or a chatbot is untouched, which is what question shape, timing and the integrity settings are for.

Does EdProcto ever send a right answer before a quiz is handed in?

In a study quiz or a quiz night, yes: after each "Check", for that question only, as practice needs. In an exam, no: EdProcto sends answers at hand-in or on release.

Which settings should I choose for a test?

Keep the quiz an exam, not a study quiz, and put "Show the score" at "When released". The "Exam" preset does that and sets "Show the correct answer" and "Show the explanation" to "Never".

References

Integrity

Five levels, from none to a full proctoring stack, each measure switched on by itself with its own consequence.

Light on Free, Strict on Educator

See the five levels

Read next