Online Exams Without Cheating: What Actually Works
Browser lockdown and webcams are expensive and still incomplete. A few simpler measures neutralize most of the cheating that actually happens.
No online exam is 100% cheat-proof. The right question is not "how do we bring cheating to zero" but "how do we make cheating expensive enough that it isn't worth it."
The measure with the biggest effect: random questions from a bank
If every candidate sees a different set of questions, coordinating between two people becomes nearly useless. This is the most effective and the cheapest measure there is.
To keep the exams equivalent, randomization has to be rule-based rather than purely random: "5 questions from category A at medium difficulty, 3 questions from category B." That way every candidate gets a different exam, but the difficulty is the same.
Shuffle the answer options too
Even with identical questions, when the order of the options differs, "the answer to question 3 is B" means nothing.
The timer has to live on the server
If the browser holds the remaining time, a little tampering makes it infinite. The server is always the reference clock; the browser only displays it.
A subtle point: the countdown in the browser has to use a monotonic clock, not the system clock — otherwise a candidate gains extra time by setting their computer's clock back.
One attempt per person
A cookie-based limit is bypassed with a different browser. If the exam matters, the limit has to be based on something the candidate enters themselves — a national ID number, a student ID, an employee ID — and enforced in the database.
Things that work less well than you'd think
- Tab-switch detection. It records that the user left the page, but a Telegram notification triggers the same event. It's fine as supporting evidence, not as grounds for disqualification.
- Disabling right-click and copy. Defeated by a photo of the screen, and it only annoys honest users.
- Forced full-screen. Meaningless on mobile, and in some browsers it doesn't work at all.
Most important of all: question design
If the questions test memorization, every technical measure gets bypassed sooner or later. A question that demands application — analyzing a scenario, calculating from the data provided — can't be answered with a web search.
That is both the best defense and a better exam.