Secure website connection
A website served securely over HTTPS, so every address starts https and the browser shows a padlock. School and trust websites should be served this way.
Check this on my websiteWho it applies to
- Published on
- School and trust websites
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Does not apply to
- No school types are excluded
When is it due?
- Renewal
- No fixed date
The official sources set no renewal date. Keep it accurate whenever it changes.
What's needed
Publish the whole website over HTTPS with a valid certificate, redirecting HTTP requests, so every page and document loads securely (guidance says schools should).
What it must contain
No parts listedThe official sources name no separate parts for this requirement. We check that it is published and easy to find.
What the official sources say
Set out in 1 official source:
Cyber security standards for schools and colleges
check that your email is set up to be secure and that it reduces the risk of third parties being able to send imitation emails – for more information, read our standard within this topic titled, ‘Secure digital technology and data with anti-malware and a firewall’
Should§ Conduct a cyber risk assessment annually and review every term > How to meet this standard > Check data processing, access and permissions
Questions schools ask
Does every school have to publish the secure website connection?
The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools.
When does the secure website connection need to be published?
Renewal: No fixed date. The official sources set no renewal date. Keep it accurate whenever it changes.
Where does the requirement for the secure website connection come from?
It is set out in Cyber security standards for schools and colleges.
Changes to the official sources
Dated change notes published by the Department for Education on the sources above.
16 September 2026 · Cyber security standards for schools and colleges
Added information about schools' and colleges' statutory responsibility to keep children and young people safe online.
8 September 2026 · Cyber security standards for schools and colleges
Link to The Department for Education Cyber Security Hub added.
24 June 2026 · Cyber security standards for schools and colleges
Updated to reflect new technical requirements introduced by the National Cyber Security Centre as part of the Cyber Essentials 2026 standard.
7 April 2026 · Cyber security standards for schools and colleges
Updated the 'Security updates' section to clarify that vulnerability fixes include changes other than software patches.
12 February 2026 · Cyber security standards for schools and colleges
Updated references to 'Action Fraud' to the organisations new name 'Report Fraud'.
10 March 2025 · Cyber security standards for schools and colleges
Added extra information to explain that schools and colleges can record their information assets using the Department for Education information asset register template, and linked to it. Removed references to the Education and Skills Funding Agency, which is closing at the end of March 2025.
3 earlier changes are listed on the source pages.
We last checked these sources on 21 September 2026.
Is this on your school's website?
We check your site the way an inspector or a parent would find it: page by page, against the official wording of each requirement. If it's there, you get the page and the words we found. If it isn't, you get every place we looked.
Check this one requirement free, or scan your whole site against every requirement.
Official sources last checked 21 September 2026 · register version 1.0.4