Looking for parties, events or school? Go →

For the IT department

This page is for whoever manages firewalls, proxies and web filters. It lists exactly what Quizhat needs to work from your network: one domain, on port 443.

What Quizhat is

Quizhat (quizhat.app) is an online platform for end-of-course tests and quizzes in training courses, run by FESTALAUREA SRLS. The trainer projects the questions and participants answer from the browser of their phone or PC: no app, no account for participants.

What to allow

  • Domain: quizhat.app and www.quizhat.app (redirects to quizhat.app). If your filter allows it, allow *.quizhat.app.
  • Port: HTTPS only, TCP 443 (Let’s Encrypt certificate). Port 80 only redirects to HTTPS and the site sends HSTS (one year, subdomains included). HTTP/3 (UDP 443) is used when available, otherwise the browser stays on TCP by itself.
  • Live connection: WebSocket on wss://quizhat.app/live. If a proxy blocks WebSockets, the browser switches by itself to plain HTTPS: /live/sse (Server-Sent Events), /live/poll (long polling) and /live/send (POST). The quiz still works; for the fallback the proxy must not hold back or buffer streaming responses (text/event-stream).
  • Optional: stats.quizhat.app, anonymous cookie-less visit statistics (GoatCounter, self-hosted on the same server). If it is blocked, the quiz works all the same.

Suggested category

Education / Training. The domain is recent, which is why some filters list it under “newly registered domains” or games: it is an educational platform for courses and assessment tests.

What is not there

No software to install and no executable files to download: a browser is enough. No ads, no third-party trackers, no profiling cookies.

Third-party domains

Running a quiz needs no other domain: pages, fonts, images and the live connection are all on quizhat.app. Other domains are needed only in these cases:

  • www.youtube-nocookie.com, www.youtube.com and YouTube’s video domains: only if the quiz contains a video. On phones the video loads only after a tap on “Load the video”.
  • checkout.stripe.com and billing.stripe.com: only for the trainer, when paying for a plan (Stripe pages).
  • accounts.google.com and login.microsoftonline.com: only if the trainer signs in with Google or Microsoft.

Data and security

The application, database and backups are on an Aruba server in a data centre in Italy. Connections are always encrypted and participants join with a code and a name, without an account. Details in the privacy policy and the data processing agreement. Security reports: security.txt.

Testing the network

The Connection check page, opened from a PC or phone on your network, tests the site, the WebSocket and the two fallback connections in a few seconds, and says what is blocked.

Ready-made message for the IT department

For the trainer: copy this text and send it to the client’s IT department before the course.

Contact

For technical questions write to festalaurea.info@gmail.com (FESTALAUREA SRLS).