An enquiry goes to last year's inbox
A department changes its contact, but a form, notification copy or campaign landing page still points elsewhere. Review the whole route, including who notices a delivery failure.
Website security for education
Website security for education.
Keep admissions enquiries, course information and learning-platform links working together, with clearer ownership of your school or college website.
A website problem can reach the admissions desk.
Families and applicants may arrive through a course page, an open-day campaign or an old search result. When those routes drift apart, your staff have to explain the gaps while keeping the intake moving.
Course changes have too many publishers
Academic teams, marketing staff and outside contractors may all maintain parts of the site. Unclear permissions and approval ownership make unexpected edits harder to trace.
A trusted link sends learners elsewhere
A learning-platform migration can leave old sign-in buttons, subdomains and downloadable instructions behind. Visitors need a consistent route to the institution's approved destination.
Maintenance collides with enrolment
An update postponed until an application deadline becomes urgent work at the worst time. A workable plan needs change windows, a decision maker and a way to recover the public site.
Follow the routes your learners rely on.
Choose a journey to see what a defined website review can examine. We agree the domains, permissions and checks first, including where another platform or provider takes over.
Admissions enquiriesForms, routing and ownership
Make the first enquiry a deliberate handoff.
A request for a prospectus should not quietly become a place to collect a full student record. We can examine the public form fields, destination mailboxes, website-stored copies and connected admissions tools that fall within the agreed scope.
The aim is a documented route with a responsible team at each step. Any test submission needs separate approval and synthetic details; a website review does not authorize access to applicant files or decisions about admission.
Questions to resolve in the review
- Fields and attachments
- What the enquiry asks for, whether uploads are necessary and which component handles them.
- Recipients and copies
- Agreed destinations, stored submissions and who owns notifications after a staff change.
- Failure and escalation
- How the team recognizes a broken route and which provider can investigate it.
Course informationPublishing and public documents
Know who can change the next intake's pages.
Course details can appear in department pages, downloadable prospectuses, event listings and campaign microsites. We discuss who can publish, approve or replace those assets and which old routes remain publicly available.
A scoped review can identify broad editor permissions, unused accounts and unclear ownership of public downloads. Your academic and admissions teams remain responsible for the accuracy of entry requirements, fees, dates and the information they approve.
Questions to resolve in the review
- Publishing permissions
- Roles for course editors, central communications staff and development partners.
- Public document ownership
- Who replaces prospectuses and confirms that only intended public files are exposed.
- Intake changes
- The pages, redirects and campaign links that need coordinated checks when a course changes.
Portal linksLearning and application platforms
Keep the boundary between website and platform clear.
A public site may link to a learning management system, parent portal, application service or library platform. We can compare website buttons and published instructions with destinations confirmed by your authorized platform owners.
Reviewing that handoff is different from testing the system behind its sign-in screen. Learning-platform configuration, institutional identity services, grades and student records require their own access, expertise and authorization.
Questions to resolve in the review
- Approved destinations
- Confirmed domains and paths for the portals linked from the public website.
- Old entry points
- Outdated bookmarks, microsite buttons and public instructions that may need updating.
- Provider boundaries
- The point at which the institution's IT team or platform supplier owns investigation.
Connected toolsEvents, embeds and components
Give every added tool a maintenance owner.
Open-day booking, virtual tours, video embeds, analytics and accessibility tools can be maintained by different teams. A website inventory helps establish what loads, why it is present and who can approve or remove it.
For WordPress, the discussion includes core, themes, plugins and custom code. Third-party scripts and embedded services need explicit ownership too. Replacement, removal or technical testing happens only within an agreed change plan.
Questions to resolve in the review
- Component inventory
- Installed software, embedded services and the people responsible for support.
- Maintenance dependencies
- Updates, customizations and vendor decisions that could affect a learner journey.
- Change verification
- A short list of public pages and integrations to recheck after approved work.
The systems, checks and technical work included in a review are agreed before access or testing.
Fit the work around your academic calendar.
An open day, results release or application deadline is not a good moment to discover that a key journey has no owner. We agree the timing and verification steps with the people who run the website.
- Confirm the people and permissions
- Identify named site owners, current editors and provider contacts. Discuss individual accounts, appropriate roles and stronger authentication for privileged access where supported.
- Choose a controlled change window
- Record busy periods, approval contacts and an agreed rollback route. Where available, use staging to check the affected pages before a production change.
- Recheck the public journey
- Verify the agreed course pages, enquiry routes, portal links and event steps. Record anything that needs confirmation from admissions or a separate platform team.
One institution can have several website owners.
The review should reflect who controls the public site, who supports its connected services and who needs the findings. We agree the particular campus, school or group of domains instead of assuming that every system is included.
Schools and school groups
For public websites serving parents and prospective families, with admissions enquiries, term information and links to parent platforms. Each school's ownership and shared group components need to be distinguished.
Colleges and universities
For course catalogues, department publishing, open-day campaigns and links into application or learning systems. Central web teams and local editors need a common view of responsibilities.
Independent education providers
For tutoring and education websites where course discovery, enquiries and booking tools support the first conversation. Paid-course platforms and specialist training systems are separately scoped when relevant.
Start with the routes. Finish with named actions.
A useful engagement connects the technical review to the staff who can approve changes and the providers who can carry them out.
Agree the boundary
List the public domains, important intake dates and learner journeys. Confirm authorized contacts, exclusions and the access needed before any technical work.
Review the agreed setup
Examine the included website components, publishing access, enquiry routing and recovery arrangements. Explain observations in terms the web and admissions teams can act on.
Plan and make included changes
Agree priorities, permissions and timing. Complete the hardening or repairs listed in the proposal, with backup and verification steps appropriate to the change.
Verify and assign the handover
Recheck the agreed public journeys. Record the work completed, remaining limitations and which tasks belong to central IT, admissions, an agency or a platform supplier.
A handover your web and admissions teams can share.
Findings need to survive a staff handover and the next intake. The agreed report separates observations, completed work and decisions that still need an owner.
A scoped journey and ownership record
The public routes and systems reviewed, the agreed boundaries and responsible contacts. Sensitive student or applicant information does not belong in the handover.
Priorities with operational context
What was observed, why it matters and which dependencies affect the next step. A course-publishing concern and an unavailable application link may need different decision makers.
A change and verification record
Included work completed, functions checked and any limitations. Recommendations are kept distinct from changes actually implemented.
Practical follow-up responsibilities
Tasks for your staff, host, web agency or platform supplier, plus questions that need a separate engagement. Recurring support and response arrangements are defined separately.
Review the website without assuming access to everything.
A public education website sits beside systems with very different purposes. The proposal identifies what is included and who can authorize any extension of the work.
Public website and enquiries
- Discussed in this review
- Agreed pages, forms, website-stored copies, publishing roles and component settings.
- Agreed separately when needed
- Applicant records, student information systems, mailbox investigations or changes to admissions decisions.
Learning and identity platforms
- Discussed in this review
- Approved public links and the website's handoff to separately owned services.
- Agreed separately when needed
- LMS internals, institutional single sign-on, examinations, grades or access to learner accounts.
Recovery and assurance
- Discussed in this review
- Agreed backup arrangements, restore responsibilities and included hardening checks.
- Agreed separately when needed
- A restore exercise, load testing, incident investigation, legal advice or formal compliance assessment unless specifically included.
Choose the next step around the actual concern.
A focused review can resolve an unclear setup. A continuing arrangement can establish recurring maintenance responsibilities. Scope, access, timing and commercial terms are confirmed before work starts.
A defined education website review
For a school, college or university that needs a clearer view before an intake, provider handover or planned website change.
- Named domains and public journeys
- Agreed review and implementation boundaries
- Documented findings and practical next steps
Continuing website care
For teams that need an agreed routine for website maintenance and security follow-up across the academic year.
- Defined recurring checks and maintenance tasks
- Coordination around important dates
- Agreed escalation and response arrangements
Bring the context, not student records.
A public URL and a short explanation are enough for the first enquiry. These details help us agree a useful scope without sending confidential information through a general contact form.
- The website and important dates
Share the domain and mention an approaching open day, intake, deadline or provider handover. Include related public microsites only where you are authorized to discuss them.
- The routes that must keep working
Identify course search, prospectus requests, enquiries, event bookings and portal links. Describe the function rather than attaching real submissions or learner information.
- The people who own each part
Tell us whether central IT, admissions, a communications team, an agency or a host maintains the site. Identify who can approve access and production changes.
- The concern and recent changes
Explain unexpected behaviour or a planned migration. Do not send passwords, student identifiers, medical information, safeguarding material or application documents.
Prepare for the next website decision.
These existing guides explain how to scope a security audit and think about website recovery. They can help your team prepare questions before a review or a change window.
Website Security Audit: What Should Be Checked?
A good website security audit makes decisions easier. It should identify what was reviewed, explain relevant risks in context, and give clear priorities rather than…
Website Backup and Recovery Plan for Small Businesses
A backup is valuable only when it helps restore working services. Build your recovery plan around the website, database, integrations and people the business depends…
Further technical guidance
Questions from education website teams.
The first conversation establishes what you control, what is worrying you and which public journeys matter most.
Does this cover our learning management or student records system?
Not automatically. This page concerns the public website and agreed connections. Reviewing a portal link does not assess the platform behind it. LMS, student records, examinations and identity services need separately agreed authorization, scope and suitable specialist involvement.
Can you work around admissions and term dates?
We discuss your calendar before proposing technical work. Change windows, approval contacts, backups and verification steps are agreed for the included changes. Exact availability, response arrangements and timelines are confirmed in the proposal.
Will you submit forms or use real applicant data?
No testing with real applicant or student data is needed for an initial enquiry. A later review may include an authorized synthetic submission where agreed in advance. Access to existing submissions, mailboxes or records is not assumed.
Can the review include several schools or department sites?
Yes, we can discuss a defined group of sites. List the domains, shared components and owners so the proposal can distinguish central controls from local responsibilities. A review of one site does not automatically cover the entire group.
Do we need to replace our existing agency or IT team?
No. We can coordinate the agreed website work with your existing team. The handover identifies which actions belong to Defendoria, your staff, the host, the agency or another platform provider.
Does this certify compliance or guarantee there will be no incidents?
No. A scoped website review can identify issues and support risk reduction, but it is not a certification, a guarantee or a substitute for legal and specialist institutional advice. The report records what was reviewed and its limitations.
How do we get a quote?
Share your public website, the main concern, important dates and who maintains the site. We then discuss the boundaries, deliverables and access needed. The quote and timeline depend on the agreed work; passwords and confidential records are not needed to enquire.
Make your next intake a website priority.
Tell us which public website journey needs attention and the dates your team is working towards. We will discuss a practical scope and the next step with you.
- Share the public website
- Describe the concern and the learner journey affected.
- Identify the right people
- Include the teams or providers who own the website and connected tools.
- Agree the work first
- Review scope, timing, responsibilities and a tailored quote before access or testing.
Please do not send passwords, applicant files or student information.
Discuss my website
Continue to the existing enquiry form with Education already selected as the context.
Industry: Education
Share your website and concern in the existing enquiry form. Your industry follows you into the request.
- A public website URL is enough to begin.
- Access and technical work require an agreed scope.
- Please leave out sensitive or confidential information.
You choose whether to send the form. This page does not submit an enquiry or start a scan.