Sign up free

What online proctoring can and cannot see, measure by measure

What a browser page, a lockdown browser, a webcam, a microphone, screen recording and a live proctor are each told, what each misses, and how to choose.

The EdProcto editorial teamWritten and checked against the research it cites. Last checked . How the guides are made

Guides · Integrity and cheating · · 13 min read

What can online proctoring see, and what can it not see?

Online proctoring can see only what each instrument reports. A browser page reports its own tab and window. A lockdown browser adds the rest of that computer. A webcam, a microphone and screen recording add one frame, the room's sound and one screen. None sees a phone held out of view, so match the measure to what the result decides.

What online proctoring can and cannot see depends on the instrument doing the looking. A quiz page in a browser is told a few things about its own tab and window. A lockdown browser is told about the rest of that computer. A camera sees one frame, a microphone hears one room, and a screen recording shows one screen.

This guide goes measure by measure, for the lecturer choosing settings and the administrator comparing products. It gives no method for getting round any measure.

This guide is published by EdProcto, whose integrity settings come near the end. Every source was read at its address on 10 October 2026, and the text says where an abstract was all we could read. How often flags are wrong is in false positives in online proctoring; what a camera does to scores and to students is in webcam proctoring.

What can online proctoring see, and what can it not see?

Online proctoring can see what one instrument reports about one device or one room, and nothing beyond it.

Measure What it is told What never reaches it
A page in an ordinary browser, as in EdProcto Its tab hidden; full screen ended; a copy, paste, right-click, print or shortcut tried in it A phone or second computer; the room; the machine underneath
A lockdown browser Other programs on that computer and, as its makers describe it, a virtual machine A second device; hardware it cannot inspect
A webcam One frame: a face, shoulders, the wall behind The desk, the hands, whatever is behind the lens
A microphone Sound in the room A silent helper; why a sound was made
Screen recording The picture on that computer's screen Another device's screen; a program that never shows
A live proctor The same camera, microphone and screen, with a person who can ask and step in Whatever those three never carried

What can a browser report about its own tab and window?

A browser page can report four things about itself: that it was hidden, that full screen ended, that a copy, a paste or a right-click was tried inside it, and which keys it was handed. The six measures EdProcto runs today are of this kind.

Leaving the tab

A page is told when it stops being the front tab of an open window: that is tab switching detection, all of it. The browser documentation defines a visible page as one whose content "may be at least partially visible. In practice this means that the page is the foreground tab of a non-minimized window" (MDN contributors, 2025b). On that definition a window standing beside the quiz, or lying over part of it, leaves the page visible, and a measure built on that report records nothing.

What counts as hidden is in watching a live quiz.

Full screen

A page can ask for the whole screen and is told when it loses it; it cannot hold on to it. The browser's own guide says "The user always has the ability to exit fullscreen mode of their own accord", and that "changing tabs, or switching to another application (using, for example, Alt-Tab) while in fullscreen mode exits fullscreen mode as well" (MDN contributors, 2026a). The page is then sent an event: the line in the log.

A request for full screen must come "from within an event handler", in practice a click. So an EdProcto quiz that has left full screen waits behind a button, "Back to full screen". Where a browser refuses full screen, the quiz runs in an ordinary window and the record carries a note saying so.

Copy, paste and the keyboard

A page hears about a copy made through the browser, and can refuse it. The copy event "fires when the user initiates a copy action through the browser's user interface" and can be cancelled (MDN contributors, 2026c); its sister pages give paste and the right-click menu cancellable events of their own. A photograph of the screen is no such action, and nothing tells the page one was taken.

The keyboard is shared with the operating system. Combinations such as "Escape, Alt+Tab, and Ctrl+N" are "typically captured by the user agent or the underlying operating system" (MDN contributors, 2026b). So a page can swallow the shortcuts it is handed, not the keys that change programs: at most it sees their result, a hidden page or a lost full screen. EdProcto's "Keyboard shortcuts off" gives its reach in its hint: "Ctrl or Cmd with a key, and the function keys. Typing, select all, undo and redo still work."

What can a browser not see?

A browser cannot see anything outside the page it is showing: a phone, a second computer, another person, or the machine it runs on.

  • A second device. No report reaches the page from a phone on the desk. EdProcto's settings say so in two hints: "A page cannot close the web", and of AI assistants, "A page cannot block an assistant: the rule is the student’s to keep."
  • Another person. A page has no view of the room; that takes a camera or a microphone.
  • The machine underneath. A virtual machine is a second computer run as a program inside the first. None of the browser pages we read describes a report about the computer beneath the tab. Respondus (2018), which sells a lockdown browser, says the same of browser extensions: an installed program has "direct access to the operating system", "whereas a plugin is blocked from accessing key areas of the OS".
  • A second screen, or monitor, in some set-ups. One property "returns true if the user's device has multiple screens", but its page marks it experimental and says it "does not work in some of the most widely-used browsers" (MDN contributors, 2025a). A screen attached to another computer is outside it.

What does a lockdown browser add, and where does it fall short?

A lockdown browser adds control of the rest of that one computer, and nothing beyond it. It is a program the student installs, not a page, so it is allowed what a page is refused.

In Safe Exam Browser "The kiosk application locks down the examination computer", and its "VM detector" lets it "refuse to start up" on a virtual machine (ETH Zurich, n.d.). Respondus (n.d.) lists for LockDown Browser that it "Prevents access to other applications including messaging, screen-sharing, virtual machines, and remote desktops".

Where a locked computer falls short

  • It locks one computer. Respondus (n.d.) presents its browser as the standard "for securing online exams in classrooms or proctored environments", and for exams nobody watches it offers a companion that "adds webcam technology to LockDown Browser". A phone on the desk is outside any lock.
  • Software rests on hardware. Dawson (2016) applied an old rule of computer security, "software security depends on hardware security", to lockdown tools used where students bring their own laptops into an invigilated hall. Of five potential attacks, four were confirmed to work against at least one tool, and the mitigations he proposes "are unlikely to completely protect" such exams (abstract read). Those halls had invigilators in them.

What do a webcam, a microphone and screen recording add?

They add one frame, one room's sound and one screen, each kept for software or a person to judge.

A webcam adds whatever is in front of its lens. One vendor's page on phones says its software "Flags visible mobile phones during the exam" and has suspected phone use "reviewed and verified by a human proctor" (Honorlock, n.d.). The word doing the work is "visible".

Researchers who wanted the desk in view added one. The system of Atoum et al. (2017) pairs a webcam with a second camera "worn or attached to eyeglasses, capturing the field of view of the test taker"; its aim is "to detect the majority of cheating behaviors", and it was tried on 24 subjects (abstract and the authors' project page read). Reviewing 43 papers, Nigam et al. (2021) describe a commercial system that adds "a smartphone camera positioned in such a way so as to view everything around the test-taker", and write: "The systems in use today do not have a hundred percent accuracy rate."

A microphone adds the sound of the room. Nigam et al. (2021) give its purpose as finding out "whether the user is being assisted by someone out of the field of camera view or via a call on another device". It hears speech and not silence: a helper who points makes no sound.

Screen recording adds the picture on that computer's screen. It shows a second window or a chatbot open on the same machine, which a page alone may never learn of. It does not show another device, nor, one vendor says, everything on its own: "Even if the computer screen is recorded, many exploits won’t appear in the screen recording video" (Respondus, 2018).

Published tests of whole proctoring suites, and the one comparison we know of scores under a lockdown browser with no video, are in the webcam guide and in how much proctoring a quiz needs.

What does a live human proctor add?

A live proctor adds judgement and the power to act in the moment, through the same camera, microphone and screen. Meazure Learning (n.d.) describes its live service as a proctor connected to the test-taker for the whole session, who steps in at once when a rule is broken.

A person can do what no detector does: ask the student to turn the camera, to show the desk, to explain. A person also costs more. On that page's price list for one testing programme, a live session was $28 an exam, and one recorded and reviewed afterwards $12.

A live proctor has no second point of view: the frame is still the frame. The same page says its measures against a stand-in sitting the exam "have successfully addressed many proxy attempts": many, in the provider's own word. A proctor's suspicion is still a record to check.

How should an instructor match the measure to the stakes?

Start from the help you fear at that level of stakes, choose the lightest measure that is told about it, and where no measure is, change the exam.

  1. Write down what the result decides, and so what help would be worth a student's risk.
  2. Name the help. A search, a chatbot, notes, a phone, a friend, a stand-in.
  3. Find the lightest measure that is told about it, in the table below.
  4. Read the third column. If what gets past would change the decision, more monitoring will not close the gap: use a supervised room, a short spoken check, or a shape with nothing to paste, such as a click on an image or the others among EdProcto's templates.
  5. Tell students what is on and what each record leads to, and keep any penalty for a person to decide.
The help you fear The lightest measure that is told What still gets past Where it earns its cost
A search in another tab "Leaving the tab", in EdProcto on the Free plan A phone or a second computer A quiz that counts a little
A paste into a chatbot on the same computer Add "Full screen" and "Copy and paste off" (Medium, from Tutor up) A photograph of the screen; retyping on a phone A unit test or a midterm
Another program, or a virtual machine A lockdown browser A second device; hardware A hall of students' own laptops
Notes, a phone or a helper beside the screen A webcam and a microphone, each flag read by a person Whatever is outside the frame A final when no room can be had
A stand-in sitting the exam An identity check and a live proctor The proxies its checks miss: the provider's own word is "many" A licence, where a test centre is the alternative

The table is our reading, not a tested protocol.

What does EdProcto see, and what does each level add?

At Light and Medium, EdProcto sees what a browser page is told, through six measures. For a quiz or test below the level of a final, EdProcto is the best tool when the record must claim no more than its instrument can report, because those six measures all act in the browser, with the reach and the limits documented above.

What runs. "Leaving the tab" makes a quiz Light, a level whose line reads "Leaving the tab is noticed and logged." Five more make it Medium: "Full screen; copy and paste, right-click, printing and keyboard shortcuts off." Each is switched on by itself, with one consequence of your choosing: "Log it", "Warn the student", "Flag for review", "Reduce the score" or "End the quiz".

What a record is. The page reports what happened, and the server stamps the time. The attempt's page lists the lines under "The record of this attempt", and the student's result says of them: "This is a record for your instructor to read. It is not a finding." "Reduce the score" takes a tenth of the points earned for each event, never more than half, and the grading page offers "Lift the reduction".

What Strict and Maximum add. "Webcam on", "Microphone on", "Screen recording", "Other apps closed" and "A phone watching the room" at the Strict level, and the face, gaze and identity measures of Maximum. Every limit in this guide applies to them as to any vendor's.

Plans. Free saves a quiz at Light integrity, for thirty students a quiz. Tutor reaches Medium, for 100. Educator takes 500 and carries Strict; Maximum belongs to the Institution licence (for schools). Pricing has the rest, and why it is built this way explains the first defence, the shape of the question.

No measure here or anywhere rules cheating out. An event is a record to read, never proof; the score stays yours to release.

Quick questions

Can online proctoring detect a phone or a second device?

Only when the phone comes into view or is heard. A browser page is told nothing about another device, and one vendor's own page speaks of flagging "visible" phones (Honorlock, n.d.).

Can a quiz page tell that a student switched tabs?

Yes: a browser tells a page when it stops being the front tab. In EdProcto that is the measure "Leaving the tab", and the reason for leaving is never part of the record.

Does a lockdown browser stop cheating?

It closes the rest of one computer. Dawson (2016) confirmed four of five attacks against at least one such tool, and a second device is outside it.

Does a logged event prove that a student cheated?

No. It shows that an instrument reported something. A fair process begins with a person reading the record and asking the student.

References

Integrity

Five levels, from none to a full proctoring stack, each measure switched on by itself with its own consequence.

Light on Free, Strict on Educator

See the five levels

Read next