FlowmatixGuide · School websites
Our school website has been hacked. What do we do in the first 24 hours?
A parent sends a screenshot. The home page shows something it should not, or redirects somewhere strange, or Google is warning people away. This is the order to do things in, written for the person in the office who has just been handed the problem.
The first hour: stop it spreading, keep the evidence
- Do not log in and start deleting things. You may destroy the evidence of how it happened, and the attacker's access usually survives a tidy-up anyway.
- Take the site offline or put up a holding page. Ask your host to do it. Most can within minutes. A blank holding page is better than a defaced one that is still serving visitors.
- Take screenshots and note the time. Of the defacement, the redirect, any Google warning, and any email the host sent. Put them in a folder with today's date.
- Change the passwords you can. The hosting control panel, the website admin, and the email account those logins are tied to. Use new passwords, not variations of the old ones.
- Tell one person who can make decisions. The principal or business manager. The rest can wait an hour; this cannot.
If your website was built by someone who has since moved on and nobody knows the logins, say so now. The host can almost always reset access for the domain's registered owner, and that is usually the school.
Who you have to tell, and who you should
For a government school, your department's IT security or service desk should be told the same day. Victorian government schools report through the department's ICT service desk; New South Wales and Queensland schools have equivalent channels. Catholic and independent schools report to their diocese or system office where one exists. They have seen this before and often have a provider on call.
If the site held personal information that may have been taken, such as enrolment enquiry forms stored in the website database, the school may have obligations under the Notifiable Data Breaches scheme. That is a decision for the principal with the department or system office, not the office on its own, but the question has to be asked.
Tell your families once the facts are clear, not before. A short notice that the website was compromised, is being restored, and that no student data was held on it (if that is true) is enough. Speculation helps nobody.
Restoring: the backup question
The quickest path back is a clean backup from before the compromise. The host usually keeps daily snapshots for a week or two; the web developer may hold older ones. Ask both for the date of their most recent backup before you decide anything.
Restoring an infected backup puts you back where you started, so whoever restores must also find and close the way in. In schools this is nearly always one of three things: a plugin that was never updated, an administrator account with a reused password, or a theme that was abandoned by its author. The restore is the easy part; the closing is what stops the second visit.
If there is no usable backup, the site will have to be cleaned in place or rebuilt. A clean of a typical school WordPress site is a day or two of specialist work. A rebuild from the content you still have is a separate project and should be quoted as one. Either way, ask for the list of what was found and what was changed, in writing, for the file you started in the first hour.
Getting the warnings removed
If Google or a browser is showing a warning, it will persist for days after the site is clean unless you ask for a review. That is done through Google Search Console, which someone at the school or the provider should already have for the site. If nobody does, setting it up takes twenty minutes and is worth doing regardless.
Check the email domain too. A compromised website is sometimes used to send spam from addresses that look like the school's. If families report odd emails, your mail provider's security view will show whether the school's domain was involved.
The week after: making the next one a non-event
The incident ends when three questions have written answers: how did they get in, what did we change so that path is closed, and who is now watching the site week to week. The third is the one most schools skip, which is why the second visit is so common.
Watching is not complicated. Software updates applied promptly and checked afterwards, administrator accounts reviewed each term, a backup that someone has actually restored once to prove it works, and someone whose job it is to look at the site every month. It can be the provider, the department's arrangement, or a care plan; it should not be nobody.
If you are not sure where your school site stands today, the free health check below reports what is visible from outside, without logging in and without changing anything. It is the same review we would do before taking on the care of a site.
Make sure there is no second time.
Website Care keeps your existing site updated, monitored and backed up, with someone responsible every month, from $1,200 a year.