Troubleshooting & technical

Fixing Pixton Behind a School Firewall or Content Filter

Fix Checked against Pixton’s docs · September 2026

Quick answer

Pixton loads from several domains, not one, and school content filters frequently allow pixton.com while blocking the others. The result looks like Pixton being broken rather than blocked, which is why unblock requests get written vaguely and rejected. Pixton publishes the exact domains it needs. Put them in the ticket, name the instructional purpose, and ask for the rule to be applied to student devices, not just staff.

Why this happens

A modern web app is not one address. Pixton’s own allow-list has two entries for students — *.pixton.com and fonts.gstatic.com — and a further fourteen for educator accounts, which additionally load Google services, Stripe for billing, a CloudFront distribution, jsDelivr, Sentry for error reporting, and a set of HubSpot domains for the support chat and analytics. A filter that permits the main site and nothing else gives students a frame with no content and teachers a page that half-works.

Filter administrators approve specific requests and defer vague ones. “Please unblock Pixton” gives them nothing to act on. “Please allow these sixteen domains for the Year 6 device group for a comics unit” is a five-minute job.

Work through these in order

  1. Reproduce the failure and capture the blocked domain from the browser console (Ctrl+Shift+J in Chrome on Windows, Cmd+Option+J on Mac). This single detail is what turns a rejected ticket into an approved one.
  2. Write the request using the allow-list below, naming the exact domains, the instructional purpose, and the affected classes or device groups.
  3. Cite Pixton’s own documentation as the source of the list. Filter admins are far more comfortable allowing what a vendor publishes than what a teacher guesses.
  4. Ask for the rule to be applied to the student device group, not just staff. Requests approved for teachers only produce a confusing partial fix where you can see Pixton and the class cannot.
  5. If your district inspects HTTPS traffic through a proxy, ask for an SSL-inspection exemption on the same domains in the same ticket. Otherwise the allow rule passes and the traffic still fails.
  6. Test with one student device before telling the class it is fixed. Filter changes often need a device restart or policy refresh to take effect.
  7. If IT pushes back on the HubSpot or Stripe domains, agree to drop them: they only affect educator-account features like the support chat and billing, and students never need them.

The allow-list to send your IT team

These are the domains Pixton publishes as required. Paste this straight into your ticket. The first two are all that students need; the rest are only loaded on teacher accounts, which also pull in billing, support chat and analytics tools.

# Required for students and teachers
https://*.pixton.com
https://fonts.gstatic.com

# Additionally required for educator accounts
https://*.google.com
https://*.googleapis.com
https://*.stripe.com
https://cdn.jsdelivr.net
https://d10lpsik1i8c69.cloudfront.net
https://sentry.io
https://*.hubspot.com
https://*.hs-scripts.com
https://*.hs-banner.com
https://*.hs-analytics.net
https://*.hscollectedforms.net
https://js.hsleadflows.net
https://*.usemessages.com

If your filter cannot take wildcards, ask for the parent domain instead. If your district proxies and inspects HTTPS traffic, these also need an SSL-inspection exemption — say so in the ticket or you will be filing a second one next week.

What to write in the ticket

Keep it to four lines. What: allow-list request for Pixton, a K–12 comic-creation tool used for a writing unit. Who: the specific device group or year level. Which: the domains from the list above, with a note that the second group is teacher-only and can be dropped. Why now: the date of the first lesson. Attach the console screenshot. That is the whole request, and it reads as a request from someone who knows what they are asking for.

Students versus teachers: why the lists differ

Student accounts touch only Pixton’s own domains and Google Fonts. Educator accounts also load the payment processor, the support chat widget, the analytics scripts and the error reporter. If your district will only allow a minimal set, the two student domains are enough for the class to work; you will lose the in-app support chat on your own device and nothing else that matters in a lesson.

If that did not solve it

If the domains are allowed and Pixton still fails only on school Wi-Fi, ask IT specifically about HTTPS inspection. An intercepting proxy breaks Pixton’s connections even when every domain is on the allow-list, and it is the one thing the allow-list ticket does not cover on its own.

Questions people also ask

Which domains does Pixton need unblocked at school?

For students: *.pixton.com and fonts.gstatic.com. Teacher accounts additionally use Google, Stripe, jsDelivr, a CloudFront host, Sentry and several HubSpot domains. Pixton publishes the full list; it is reproduced on this page.

Why does Pixton work for me but not my students?

The allow rule was applied to the staff device group only. Ask IT to extend it to the student group. The symptom is exactly this: teacher sees Pixton, class does not.

Is Pixton safe to unblock?

Pixton is a K–12 education product that states compliance with COPPA, FERPA and GDPR, with annual third-party audits, and publishes a data-processing addendum. Point your IT team to pixton.com/data-privacy for the documentation they will want.

If it is actually a different problem

Checked September 2026 against Pixton's published documentation. How we research · Report an error