School website security: accounts, updates and recovery

Identify the services behind the website

List the domain registrar, DNS service, hosting account, content management system, certificate management and any form or email services. Record who owns each account and who can recover access. A website may be technically healthy but still depend on a former employee's personal email address.

Keep this register restricted to the people who need it. Store credentials in the school's approved secure method, not inside the website content plan. Identify a second authorised person for recovery without sharing one everyday administrator account between all staff.

Give people the permissions they need

Separate content editing from powerful administration. Most colleagues need to create or update pages, not install software, manage users or change security settings. Use named accounts so activity can be understood and access can be removed when responsibilities change.

Enable multi-factor authentication where supported, especially for accounts controlling the website, domain and email. NCSC guidance supports MFA for internet-facing and high-risk accounts and careful control of privileged access. Establish a recovery process that does not quietly bypass those protections.

Reduce unnecessary exposure

Remove unused extensions, themes and accounts through the normal change process. Keep supported software updated and identify who checks for security releases. If maintenance is outsourced, define the responsibility and response expectations in writing rather than assuming the hosting fee covers everything.

Limit administrative access and upload capabilities to the actual need. Public upload forms deserve special attention: specify permitted types and sizes, where files are stored, who can access them and how long they are retained. A form for a general enquiry does not need to accept arbitrary documents.

Publish personal information deliberately

Review content for information that should not be public, including document comments, private contact details and identifying information in images. The ICO explains that official school photography requires an appropriate lawful basis and clear information about its use; consent is not automatically the only possible basis.

Use the school's agreed data protection and safeguarding process to decide what can be published. Keep the decision separate from the editor's technical ability to upload a file. If an image or document needs removal, check the original file address as well as the page where it appeared.

Keep forms small and accountable

Ask only for information needed to handle the task. Explain who receives it and how enquiries are used. Avoid inviting families to enter detailed medical or safeguarding information into a general website contact form when the school has a more appropriate route.

Test delivery, spam handling and access to stored submissions. Give someone responsibility for checking that the inbox or queue works. Decide what happens during holidays and staff absence, and ensure the public wording matches the actual response arrangement.

Back up and practise restoration

Know what the backup includes: database, uploaded files, configuration and anything needed to rebuild the website. Keep access to backups appropriately protected and avoid relying solely on a copy reachable through the same compromised account.

Test a restoration in a suitable environment. Record the steps and the result, including whether recent content and downloads were recovered. A backup that has never been restored is an assumption about recovery, not evidence. NCSC guidance specifically encourages knowing how to restore and checking that important data is included.

Prepare for an incident

Write a short response plan naming the technical contact, school decision-maker and relevant data protection or safeguarding contacts. Include a route to preserve logs, restrict compromised access and communicate accurate information. Do not publish speculative explanations before the facts are understood.

For an unavailable site, decide how families will receive essential notices. For suspected exposure of personal information, follow the school's incident assessment process rather than treating it as a cosmetic website error. Keep sensitive details out of broadly shared helpdesk messages.

Review after changes and staff turnover

Check access when staff leave, roles change or contracts end. Review recovery contacts and renewal responsibilities regularly. When introducing a new feature, consider what data it collects, what privileges it needs and how it would be removed later.

Combine these checks with the website content audit and digital governance arrangements. Security works best as a small set of understood routines that continue after the launch project, rather than a badge applied to the homepage.