Canvas quiz logs, explained

What is a Canvas quiz log?

The Canvas quiz log (officially the "quiz submission log") is a per-attempt timeline Instructure records automatically. It is enabled by default on every Canvas instance, it runs on every quiz, and there is no student-facing setting to disable it. Any instructor with grading permission on a course can open the log by going to a quiz, clicking Moderate This Quiz, and clicking the small clock icon next to a student's attempt.

The log is a sequence of timestamped events. Each event is one of a small set of types: a question was viewed, a question was answered, an answer was changed, the quiz was stopped, the quiz was resumed, or - the one that matters most for detection - the student stopped viewing the Canvas quiz-taking page.

Every event Canvas records

• Started the quiz. Timestamp of the first page load.
• Viewed (question N). Fires when you scroll a question into view or navigate to it in one-question-at-a-time mode.
• Answered (question N). Fires when a radio, checkbox, dropdown, or text input changes.
• Stopped viewing the Canvas quiz-taking page. Fires on visibilitychange,blur, or a window resize that pushes Canvas out of the foreground.
• Resumed. Fires when focus returns to the Canvas tab.
• Session (auto-save). Every 30 seconds Canvas heartbeats a save event, which is how it detects long idle periods.

How Canvas detects tab switching (the technical part)

Canvas cannot see other tabs. What it can see is whether its own tab is visible and focused. It does this with three standard browser APIs baked into every page of the quiz-taking flow:

1. Page Visibility API -document.hiddenanddocument.visibilityState. When you switch tabs, minimize the window, or lock your screen, the browser setsvisibilityState = "hidden"and fires a visibilitychange event.
2. Window blur / focus events. These fire when the Canvas window loses or regains keyboard focus - clicking into another window (even without switching tabs) triggers a blur.
3. requestAnimationFrame throttling. Chrome throttles background tabs to ~1 frame per second. Canvas can detect that its own animation-frame callbacks slowed down and infer it was backgrounded.

When any of these fire, Canvas posts a "stopped viewing" event to the quiz log with the exact timestamp. When focus returns, it posts a "resumed" event. The teacher sees the gap in seconds.

How Ghost Mode blocks it

CanvasPro's Ghost Mode is a content script that runs atdocument_start- meaning before any Canvas JavaScript loads. It intercepts each detection surface at the source:

• Overrides document.hidden and visibilityState. Both properties are redefined with getters that always returnfalse and"visible", so Canvas's checks read the tab as always in front.
• Swallows visibilitychange, blur, and focus events. Ghost Mode wraps addEventListener and drops registrations for the events Canvas uses to detect focus loss. The events never reach Canvas's handlers, so they never make it into the log.
• Neutralizes rAF throttling detection. A parallel high-resolution timer keeps Canvas's frame counters advancing at 60fps even when the real tab is backgrounded, defeating background-tab throttling heuristics.
• Suppresses fullscreen and split-screen exit events. Canvas can flag exit-fullscreen and window-resize patterns; Ghost Mode blocks those too, which is why Split-Screen Bypass works alongside it.

Because the events never fire from Canvas's point of view, the quiz log has nothing to record. The teacher sees a clean, focused session from start to submit.

What free canvas hacks and Tampermonkey scripts get wrong

Most canvas hack Tampermonkey scripts, canvas github scripts, and canvas pastebin scripts try to block detection by pollingdocument.hiddenor hooking events after the page has loaded. By then Canvas has already registered its listeners, and the first visibility event fires straight into the quiz log. A 100ms gap between "quiz started" and the script attaching is enough to leak a "stopped viewing" event.

Ghost Mode runs in the extension's isolated world atdocument_startand patches the visibility API before Canvas's script is parsed. That's the difference between a canvas hack that leaves a trace and one that doesn't.

Frequently asked questions