Whitelist Requirements for Locked Down Environments
This article lists the domains, ports, and proxy settings that need to be allowed for PaperScorer to work properly in a locked-down network environment.
Who This Article Is For
This article is aimed at network administrators responsible for managing:
- School and district firewalls
- Student Chromebook content filters (Lightspeed, GoGuardian, Securly, iBoss, Cisco Umbrella, etc.)
- SSL inspection / TLS-intercept appliances
- Proxy servers and web filters
Teachers usually don’t need to follow these steps — this is for the IT team that manages the network.
Required Domains
These domains must be allowed for PaperScorer to function at all.
| Domain | What it’s for |
|---|---|
*.paperscorer.com |
Main PaperScorer web app, API, mobile app endpoints. |
forms.paperscorer.com |
Answer-sheet image hosting (used by both the engine and the web app to display scanned sheets). |
ik.imagekit.io |
Image CDN for sheet thumbnails and previews. |
fonts.googleapis.com and fonts.gstatic.com |
Web fonts used in the UI. Without these PaperScorer renders in a fallback system font but is fully functional. |
js.stripe.com and checkout.stripe.com |
Credit-card payment processing for Teacher Pro upgrades. Required only if your users will purchase upgrades directly. |
Recommended Domains
These domains enable error reporting and in-app support — not strictly required, but they help our support team resolve issues much faster when something does go wrong.
| Domain | What it’s for |
|---|---|
*.sentry.io |
Captures error reports when something goes wrong in PaperScorer, so our team can diagnose and fix issues. |
*.fullstory.com |
Anonymous session telemetry that helps us understand how users move through the app and pinpoint UX bugs. |
*.helpscout.net and beacon-v2.helpscout.com |
In-app help and support widget. Without this, users can’t reach support directly from inside the app. |
NOTE: PaperScorer’s core functionality (creating assessments, printing, scanning, grading, LMS sync) works fine without the recommended entries. But if a teacher contacts support with “PaperScorer isn’t working,” the Sentry and FullStory integrations let our team see the exact error the user hit. Without these, troubleshooting often takes hours longer.
LMS Integration Domains
If you use one of our LMS integrations, additionally allow the relevant LMS domain so the OAuth handshake and grade-sync calls can reach it:
| Integration | Domain |
|---|---|
| Google Classroom | accounts.google.com, classroom.googleapis.com |
| Canvas | Your Canvas instance domain (e.g. yourschool.instructure.com) |
| Brightspace | Your Brightspace instance domain (e.g. yourschool.brightspace.com) |
| Clever | clever.com, secure.clever.com |
Ports
- 443 (HTTPS) — required for all PaperScorer traffic.
- 80 (HTTP) — optional, used only for the initial redirect to HTTPS. Can be blocked if your firewall auto-upgrades HTTP to HTTPS.
- WebSockets — PaperScorer uses standard HTTPS WebSockets over port 443; no separate port configuration needed.
SSL Inspection Considerations
If your district uses SSL inspection (also called deep packet inspection or TLS intercept), there are a few extra steps:
- Install your SSL inspection CA certificate on all devices that use PaperScorer.
- Add PaperScorer to the SSL inspection bypass list if possible — this avoids certificate-mismatch errors and improves upload performance.
- If you use certificate pinning, make sure PaperScorer’s certificates aren’t being blocked. We use standard certificates from common CAs (Let’s Encrypt, Amazon Trust Services).
Upload Size and Timeout Settings
PaperScorer accepts uploads up to 250 MB per file. If your firewall or proxy has a body-size limit smaller than this, large PDF uploads may fail.
Recommended proxy settings:
- Maximum body size: 250 MB or larger
- Upload timeout: 5 minutes or longer (large PDFs take time)
- Keep-alive timeout: 120 seconds or longer
Common Filter Configurations
Specific allow-list steps for the most common content filters used in K–12 networks:
Lightspeed Systems
Add these rules to the “Allow” list:
*.paperscorer.comforms.paperscorer.comik.imagekit.io
GoGuardian
Create a custom policy rule:
- Rule type: Allow
- Domain:
paperscorer.com - Apply to: All users (or specific grade levels)
Securly
Add paperscorer.com to the Approved Sites list.
iBoss
Add *.paperscorer.com under Category Overrides → Allow.
Cisco Umbrella (formerly OpenDNS)
Add paperscorer.com to the Destination List → Allow.
Testing the Whitelist
After configuring, test from a student or teacher device:
- Visit https://app.paperscorer.com in a browser.
- Confirm the page loads without security warnings.
- Sign in.
- Upload a test PDF to Upload & Score. If it processes successfully, the whitelist is configured correctly.
Troubleshooting
The page loads but nothing works.
HTTPS works but WebSocket or API calls are being blocked. Check that port 443 is open in both directions, your proxy allows WebSocket upgrade requests, and no firewall rule is blocking large POST bodies.
Users see “Connection Reset” errors during upload.
Usually a proxy size limit (raise to 250 MB+), a proxy timeout (raise to 5+ minutes), or SSL inspection misconfiguration.
Login redirects fail.
If your whitelist only allows specific subdomains, make sure you allow the entire wildcard *.paperscorer.com , not just www.paperscorer.com . Login, API, and file hosting all use different subdomains.
Scans don’t upload but everything else works.
Check that forms.paperscorer.com and ik.imagekit.io are allowed — both are involved in scan storage and display.
Mobile App
If you’re using the PaperScorer mobile app on a locked-down network, the same *.paperscorer.com rule applies. App Store / Google Play installation also needs their respective stores to be reachable, but that’s typically handled separately by your MDM.
Getting Help
If you’ve configured the whitelist and PaperScorer still doesn’t work, email support@paperscorer.com with:
- The exact error message users are seeing
- Browser developer-console output when the error happens (F12 → Console)
- A short description of your firewall/proxy setup
- The domains you’ve already allowed
We’ll help you identify the missing rule and get your environment working.