FlowmatixGuide · School websites
A critical WordPress vulnerability hit school websites this week. Here is what to check.
A vulnerability in WordPress went into active exploitation this week. Hosts pushed emergency patches through to school websites, and in many cases the school office found out afterwards, with a note asking them to test the site. If that was you, this is the fifteen-minute check worth doing before Monday, and an honest look at why it keeps happening.
What happened, in plain words
WordPress runs a large share of school websites, and a flaw was found that attackers were already using. When that happens, hosting companies and departments do the responsible thing: they push a fix to every site they can reach, quickly, during the working day, without a staging copy and without testing each site's forms afterwards. The site is safer. Whether the enrolment form still delivers is now the office's problem.
None of this is the host's fault, and none of it is the school's. It is what happens when a website has no one whose job it is to look after it between emergencies.
Why school websites end up exposed
- Built once, by someone who moved on. The site was set up years ago by a parent, a teacher, or an agency on a one-off job. The plugin list has not been looked at since.
- Updates wait for an emergency. Plugin update notices go to a mailbox nobody checks. The first patch in a year arrives as a forced one.
- Nobody has restored a backup. A backup that has never been restored is a hope, not a backup.
- The office is the test team. After the patch, the people who run the front desk are asked whether the website still works. They are the wrong people to ask, and they are busy.
The fifteen-minute check
Anyone in the office can do this. No login to the website is needed for the first four.
- Type the address without "https". Open a browser and go to
http://followed by your site. It should jump to thehttps://version with the padlock. If it stays on plain http, the site serves unencrypted pages and that needs fixing. - Submit the contact form. Use your own email, subject "test". Did a confirmation appear? Did the email arrive, and to a person who still works at the school? Do the same for enrolment enquiries if that form exists.
- Click the five pages parents use. Home, Contact, Enrolment, Term dates, Newsletter. Dead links, a term-dates page still showing last year, or a newsletter from March are all signs nobody is looking.
- Find the backup. Ask whoever hosts the site one question: what is the date of the last backup you have actually restored? "We take backups" is not an answer.
- If you can log in, open Plugins. Count the ones with an update available. Look for any marked as no longer maintained. Then open Users and remove anyone who has left the school. Admin accounts for departed staff are the most common way in.
If any of those five turns up a problem, it is worth a proper review before the next forced patch.
What "properly managed" looks like
The difference between a site that gets caught by the next vulnerability and one that does not is not the software. It is whether someone owns the routine.
- Updates are applied by someone and checked afterwards. Core, theme and plugin updates go on within the month, tested on a copy where the hosting allows it, with key pages and forms checked after. If something breaks, it is put back and fixed.
- Known vulnerabilities are matched against the plugin list continuously, so a flaw like this week's is patched or blocked at the firewall before the emergency email goes out.
- Backups are daily, off-site, and restored on a schedule to prove they work. There is a snapshot from before every update.
- Someone is watching. Uptime every minute, file changes, certificate expiry, and the forms tested monthly by actually submitting them.
- The school gets a report, not a to-do list. One page a month: what was updated, what was found, what was fixed, and the two things that need a decision.
That is what Flowmatix Website Care is: the routine, owned by someone, on the website and hosting you already have. Vigil, the monitoring behind Website Care, keeps watch; the Flowmatix team, who have worked inside education IT, take care of what it finds. One annual price. Your provider keeps their role, nothing is rebuilt or moved, and there is no lock-in.
If nobody has reviewed your site since the patch
We will do it, free, from the outside. Send us the address and we run a read-only security and health review: WordPress and plugin versions against known vulnerabilities, HTTPS and security headers, backups, forms, broken links and speed. You get a one-page plain-language report within two business days. Nothing changes on your site and there is no obligation.
Make the next patch a non-event.
Monthly checks, updates handled, monitoring and a one-page report, on your existing website and hosting, from $1,200 a year.