For security reasons, you should not have control over the user's refresh, forward, and back buttons.

I just realized the utter impossibility of doing this and making it fair.

You do not have control over the following:
- The browser the student has.
- The Internet Service Provider the student subscribes to.
- Whether the ISP burdens users with popups in exchange for free or low-cost service.
- Security settings.
- Firewalls.
- Traffic loading on the ISP.

So I can see some problems:

- The page stops loading in the middle, but the timer starts.

- The page loads, but JavaScript is turned off.

- The page loads except for the script.