The National Protective Security Authority's Security-Minded Communications guidance for educational settings asks schools to stop giving away information that helps someone plan harm, and to use their communications to deter instead. Your website is where most of that information lives. Publish everything the Department for Education requires, in the minimum form it requires, and check every other page against one question: could this help a stranger plan a visit we would not want? It costs nothing, and a business manager and comms lead can do the first pass in an afternoon.
We have written before about Security-Minded Communications for schools: the idea, the two halves of it, and the habits that follow. This article does something narrower and more practical. It takes the NPSA guidance for educational settings and applies it to the one channel every school has and few have looked at through this lens: the website.
It also deals with a tension the guidance does not cover. Schools in England are required to publish quite a lot online. The answer is not to publish less than the law asks for. It is to publish exactly what it asks for, and nothing that helps the wrong reader.
Why the website matters
NPSA describes three stages in planning an attack: choosing a target, detailed planning, and confirming what is known. The first two lean heavily on what it calls hostile reconnaissance, and much of that now happens online.
The guidance includes a real case, documented by Jersey Police, of a man who planned to attack a school. His research included the school's own website, Google Maps, Street View and YouTube, followed by night-time visits to look at the entrances and exits. None of it was noticed at the time.
A school website is built to be helpful to strangers: prospective parents, job applicants, people hiring the hall. That is exactly why it needs a second read from the point of view of the stranger you do not want.
Read the original. The NPSA guidance is ten pages and worth reading in full. It is available from the NPSA website. It is Crown copyright, so we summarise it here rather than reproduce it.
What you must publish, and how to do it safely
The Department for Education sets out what maintained schools must publish online, and what academies and colleges must or should publish. Most of it carries no security risk: admissions, curriculum, Ofsted reports, results, SEND, pupil premium, uniform and policies such as behaviour and complaints. A few items overlap with what the NPSA guidance says to handle carefully.
| Requirement | What the law asks for | How to meet it without oversharing |
|---|---|---|
| Contact details | Postal address, telephone number and the name of the staff member who handles queries | Name that person, as required, but route contact through a shared office address and the main phone number. Do not add a directory of direct emails. |
| Opening hours | When the compulsory school day starts and ends, and total weekly hours | Publish exactly that. Leave out caretaker hours, when the site is locked and when it stands empty. |
| Governance | Governors' and trustees' names, terms and roles, and for academies their relevant interests | Publish as required, with a clerk or governance email rather than personal contact details. |
| Policies | Specific policies such as behaviour, charging and complaints | Publish those. Security, lockdown and site management procedures are not on the list, so keep them internal. |
The principle is simple. The law sets a floor, not a ceiling, and the floor contains nothing that a hostile would find especially useful. The risk sits in everything schools add on top.
The page-by-page check
Work through your site with these eight areas in mind. The guidance's own three questions do most of the work: how much detail do we need, can we give our real audience what they need without giving a planner what they want, and if we must publish the detail, can we make it less useful?
1. Homepage, about and welcome pages
These are usually low risk. Watch for hero images and promotional videos, especially drone footage, that show the full perimeter, gates, fences and parking from above. Aerial shots are beautiful and are also a free site survey.
2. Contact and staff pages
A full staff list with direct email addresses helps targeted phishing as well as physical planning. Use role-based addresses such as office, admissions and lettings, and the main switchboard. Publish named contacts only where the law or good practice requires them.
3. Calendar, events and term dates
Term dates are fine. Exact capacities are not needed: NPSA's example is that advertising "only 100 places" and then filling them tells anyone watching how big the crowd will be. Avoid precise timings for when large groups will be outdoors, and announce visits by high-profile guests afterwards rather than in advance.
4. News, newsletters and social feeds
Newsletter archives are often the richest source on a school website. Look for staff rotas, details of who is on site during holidays, building work schedules and comments about faults, such as a broken gate or cameras being replaced. Celebrate events after they happen where you can.
5. Policies and procedures
Publish what you are required to. Do not publish lockdown procedures, site security plans, invacuation points or emergency contact cascades. Give parents a plain summary of what happens in a lockdown and how you will contact them, and keep the detail for staff.
6. Lettings and facility hire
Lettings pages often carry the most detail on the whole site: floor plans, room dimensions, access routes, out-of-hours times and who unlocks. Describe the spaces, give capacities as ranges if needed, and send floor plans to confirmed hirers on request rather than publishing them.
7. Maps, open days and virtual tours
The guidance is clear on this one. Show public areas only, leave out corridors, dimensions and exits, and ask whether an unescorted visitor could navigate your site from what you have published. Consider escorted-only tours. If a virtual tour is not earning its place, take it down. NPSA publishes separate guidance on virtual tours.
8. Photos and video
Check backgrounds for door entry panels, camera positions, key safes, alarm panels and signage that reveals room uses. Staff and volunteers should be identifiable as staff by a lanyard or pass, but turn passes over so the detail cannot be copied.
Use one page to deter
The second half of the guidance is about deterrence. NPSA research shows that promoting your security measures discourages people planning harm, and that ordinary site users want to hear what is being done to keep them safe.
The simplest way to do that is one short page, often called something like "Keeping our school safe". It might say that visitors sign in at reception and wear a pass, that the site has CCTV and controlled entry, that staff are trained to notice things out of the ordinary, and that the school works with local police. It should say how to raise a concern: 999 in an emergency, 101 otherwise, or the confidential Anti-Terrorist Hotline on 0800 789 321.
Only promote what you actually have. The guidance is emphatic on this. Claiming CCTV that does not record, or patrols that do not happen, collapses the moment it is tested. Keep the language reassuring, "looking out for anything out of the ordinary" rather than "stopping criminals and terrorists", and never give locations or technical detail.
If you are not sure whether your cameras would stand up to that claim, our guide to inherited school security systems shows how to check.
Make it a routine, not a project
NPSA suggests developing an action plan after reading the guidance. In a school, that can be very light:
- Do one full review this term. The business manager, whoever runs the website and social media, and ideally the designated safeguarding lead. An afternoon with this article and a laptop.
- Fix the easy things straight away. Personal emails, floor plans, capacities, old newsletters and the virtual tour.
- Add a pre-publishing question to whoever posts: could this help a stranger plan a visit we would not want?
- Brief staff and volunteers. The guidance points to free training: See, Check and Notify, and the Action Counters Terrorism e-learning, which NPSA suggests could form part of induction. Our guide to SCaN for schools explains it.
- Repeat once a year, and whenever the website is redesigned.
This sits in the Prevent stage of our preparedness model: denying someone the information they need before they ever reach the gate. It is also the cheapest security measure a school will ever take. Nobody needs to sell you anything to do it, including us.
Frequently asked questions
Do schools have to publish staff names on their website?
Not all of them. Maintained schools must publish the name of the member of staff who deals with queries from parents, carers and the public, and governance information including governors' names. Academies have similar requirements, including the headteacher and the chair of governors. Neither list requires a full staff directory with direct email addresses, which is the detail NPSA guidance advises against publishing.
Should a school publish its lockdown procedure online?
Lockdown procedures are not on the Department for Education's list of what schools must publish. Security-Minded Communications guidance advises against publishing detail that would help someone plan harm, and a lockdown procedure describes exactly how a school responds. Keep the procedure internal and give parents a short summary of what to expect and how the school will contact them.
Is it safe to post photos of school events on social media?
Usually, yes, with care. Check the background for door entry panels, camera positions, key safes and site layout. Make sure staff passes are not legible. Where you can, post about events after they have happened rather than trailing them in advance, which keeps the good news story and removes the advance notice.
Should our school have a virtual tour?
Ask what it is for. A virtual tour that shows corridors, exits and room layouts can help an unescorted visitor navigate the site, which is exactly what NPSA guidance warns about. If you keep one, limit it to public areas and avoid showing entrances, exits and internal routes in detail. NPSA publishes separate guidance on virtual tours.
Sources
- NPSA: Security-Minded Communications, Guidance for Educational Settings
- Department for Education: What maintained schools must publish online (updated 24 October 2024)
- Department for Education: What academies and further education colleges must or should publish online (updated 24 October 2024)
- Department for Education: Protective security and preparedness for education settings