Education Web Hosting: What Schools Actually Need

Most school websites do not need special education hosting. They need ordinary, reliable hosting and a clear rule about what is never allowed to live on them. The compliance question that everybody worries about only becomes serious when a system starts holding student records, and for the majority of schools that system is a separate product bought from a specialist, not the box the homepage runs on.

So the first job in education web hosting is not shopping. It is drawing a line down the middle of your estate: the public site on one side, anything touching student data on the other. This guide explains what FERPA, COPPA and GDPR actually require, which of those obligations land on you and which land on a vendor, exactly which documents to ask for, and how to build the public side well. We also say plainly which half of that line our own hosting belongs on.

Key Takeaways

• Split the estate first. A brochure site with term dates and staff photos carries almost no regulatory weight. A gradebook or a student information system carries a great deal.
• FERPA binds the school, not the host. An outside vendor can only handle education records if it is treated as a school official under the school's direct control, and that arrangement lives in a written contract.
• There is no FERPA certification and no COPPA certification. Any provider claiming one is describing a private assessment or, more often, nothing at all.
• COPPA regulates commercial operators of services directed to children under 13. A public school's own site is usually not the operator; the ed-tech vendors it uses generally are.
• For a public school website in the United States, accessibility is now the more likely source of a complaint than privacy. The technical target is WCAG 2.1 Level AA.
• Devoster is a general-purpose host: good for the public site, the department blog and the club pages, and the wrong place for student records. That section is near the end.

The Question That Decides Everything

Before comparing a single plan, sort every system you run into one of two buckets: publishing, or record-keeping. Publishing systems hold information you would happily print in a newsletter. Record-keeping systems hold information about identifiable students that a parent has a legal right to inspect.

The table below is the sorting rule. Print it and use it in the procurement meeting, because the argument you are about to have with a colleague who wants to put the parent portal on the same server as the homepage is easier to win with a table.

What the system holds	Typical example	Regulatory exposure	Where it belongs
Public information only	Term dates, staff list, news, admissions pages	Accessibility rules, little else	Ordinary shared hosting or managed WordPress
Contact details from adults	Enquiry form, newsletter sign-up, event RSVP	General data protection duties, retention	Ordinary hosting, with a written retention rule
Content created by children under 13	Student blogs, e-portfolios, class galleries	Children's privacy rules reach the vendor	A vetted platform, or a tightly scoped install with no accounts for pupils
Coursework, submissions and grades	An LMS with a gradebook	Education records	A provider that will sign the written agreement your district requires
Enrolment, attendance, discipline, health, special education plans	A student information system	Education records, sometimes health data too	A specialist provider only, never general-purpose hosting
Payments	Lunch accounts, trip fees, uniform shop	Card industry rules	Your payment provider's hosted page, never your own server

Most schools discover that four of these six rows already live somewhere else, bought years ago by a different department. That is fine. Write it down anyway, because the inventory is the first thing an auditor, an insurer or an anxious parent will ask for.

What FERPA Actually Requires

Who it binds

The Family Educational Rights and Privacy Act applies to educational agencies and institutions that receive funds under programmes administered by the US Department of Education. That covers essentially all public school districts and most colleges and universities. It gives parents, and students once they turn eighteen, the right to inspect and review education records, to seek correction, and to control disclosure.

Notice who is missing from that sentence: your hosting company. FERPA does not regulate vendors directly. It regulates the school, and the school's obligations reach vendors only through the contracts the school signs. The US Department of Education's Student Privacy Policy Office publishes the current guidance and it is worth reading before a procurement cycle rather than during one.

The school official exception, and what it demands of a host

Schools may disclose education records without consent to a school official with a legitimate educational interest. An outside contractor can be treated as a school official, but only if the school meets specific conditions: the contractor performs a service the school would otherwise use its own employees for, it is under the direct control of the school with respect to the use and maintenance of education records, and it is bound by the limits on redisclosure.

Direct control is the phrase that decides most vendor conversations. In practice it means a written agreement that says the vendor uses the data only for the contracted purpose, does not mine it, does not sell it, does not pass it on without permission, returns or deletes it at the end of the contract, and tells you promptly if something goes wrong. A vendor that will not sign those terms cannot be treated as a school official, which means you cannot lawfully hand it education records.

What FERPA does not do

• It does not certify anyone. There is no register, no badge and no examining body. A vendor calling itself FERPA certified has invented a category.
• It does not prescribe technical controls. Unlike a security standard, FERPA does not tell you which cipher suite to use. Your obligation is to keep the records confidential, and how you do that is your problem.
• It does not cover directory information you have properly designated, such as a name or a graduation year, provided parents were given notice and the chance to opt out.
• It does not give parents a right to sue. Enforcement runs through the Department of Education, and the ultimate sanction is funding. That is cold comfort when the local paper runs the story.

What COPPA Actually Requires

Who counts as an operator

The Children's Online Privacy Protection Rule, enforced by the Federal Trade Commission, applies to operators of commercial websites and online services directed to children under 13 that collect personal information, and to general-audience services with actual knowledge that they are collecting it from children under 13. The FTC's COPPA guidance is the primary source and it is written in plain English.

The word doing the work there is commercial. A public school district running its own website is generally not the operator the rule is aimed at. The ed-tech company whose reading app the district deploys to two thousand Chromebooks generally is. So the school's COPPA exposure is mostly a vendor management problem rather than a hosting problem.

School-granted consent, and its limits

The FTC has recognised that a school can provide consent on behalf of parents in place of individual parental consent, but only in a narrow lane: the service must be used for an educational purpose, and the data collected may be used only for that purpose. The moment a vendor wants to use pupil data for advertising, product development or anything else commercial, school consent stops covering it and you are back to needing the parents.

Two practical consequences. First, read the vendor's privacy policy for the phrase improve our services, and ask exactly what that means. Second, if you run student blogs on your own hosting and pupils under 13 can create accounts, you have quietly become the operator of a service that collects children's personal information. Either close the accounts and publish work under teacher accounts instead, or treat the platform with the seriousness a vendor would have to.

GDPR, and Schools Outside the United States

If your school is in the EEA or the UK, or if you enrol students who are, the GDPR applies and the structure is different again. The school is the controller, the host is a processor, and Article 28 requires a written contract that specifies the subject matter, duration, nature and purpose of processing, the categories of data and data subjects. The processor cannot bring in a sub-processor without your prior authorisation, which is why the sub-processor list matters as much as the contract itself.

Two obligations catch schools out repeatedly. Article 33 gives you seventy-two hours from becoming aware of a qualifying breach to notify your supervisory authority, which is only achievable if your host has agreed contractually to tell you quickly. And if personal data leaves the EEA you need a lawful transfer mechanism, so a school in Europe putting pupil data on a US-hosted server has a question to answer that a school in Texas does not.

Accessibility Is the Requirement Schools Underestimate

For a public school website in the United States, an accessibility complaint is a more likely event than a privacy investigation. In April 2024 the Department of Justice published a rule under Title II of the Americans with Disabilities Act setting a technical standard for web content and mobile apps of state and local government entities, including public schools. The standard is WCAG 2.1 Level AA, and compliance dates are staggered by the size of the entity, so check the date that applies to your district on ADA.gov.

The practical work is unglamorous and mostly editorial rather than technical:

• Real text instead of images of text. Every year a school posts the lunch menu as a photo of a printed page, and every year it is unreadable to a screen reader.
• Alt text on meaningful images, and empty alt attributes on decorative ones.
• Captions on video. If you post assembly recordings or board meetings, captions are not optional.
• PDFs that are tagged and readable, or better, page content instead of a PDF.
• Colour contrast that survives the school brand palette, and a visible keyboard focus outline that nobody has styled away.
• Heading structure that reflects the page, since a screen reader user navigates by headings the way you navigate by eye.

The W3C Web Accessibility Initiative publishes the guidelines themselves. None of this depends on which host you choose, which is precisely why it gets forgotten during a hosting project.

The Paperwork to Ask a Host or Platform For

Send one email before you compare prices. The answers sort the field faster than any feature grid.

Ask for	Why a school needs it	A good answer looks like	A bad answer looks like
A written data agreement	It is how direct control and purpose limitation become enforceable	A template sent the same week, open to redlines	Our terms of service already cover that
Sub-processor list	You cannot document your data flows without it	A named list with countries and a change notice period	We use industry-standard partners
Data location, including backups and support access	Residency and transfer questions turn on it	Specific regions, and where support staff sit	Globally distributed for performance
Breach notification window	Your own clock starts when you become aware	A number of hours, written into the contract	We will notify you promptly
Deletion and export at contract end	Schools change vendors, and records must come home	A defined format, a defined deadline, written confirmation	Contact support and we will see what we can do
An audit report, if one exists	Evidence beats assertion for anything holding records	The report under NDA, with its scope and period	A trust page with logos on it

Building the Public School Site Well

Platform and traffic reality

A school website is a low-traffic site with a handful of violently spiky days: results day, enrolment opening, the first snow closure of the winter, and the evening a controversial board decision hits the local news. On every other day the traffic is trivial.

That shape argues for a cached static-ish site rather than a big server. WordPress with a page cache plugin serves a school homepage from disk in a few milliseconds and will absorb a snow-day spike that would flatten an uncached install on much larger hardware. Spend your effort on caching before you spend money on resources.

Backups on a school-year calendar

Daily backups with seven days of history are fine for a business that changes daily. A school site changes in bursts and then sits still for a term, which means a mistake made in October can easily go unnoticed until January, by which point a week of history is useless. Keep at least one restore point per term, stored somewhere your hosting account cannot reach, and do a real restore before the school year starts.

The accounts problem

The most common security incident on a school site is not an attack. It is a teacher account that still works two years after that teacher left, or a shared password in a staff handbook. Before you migrate anything, list every account, delete the leavers, turn on two-factor authentication for anyone who can publish, and give teachers author-level permissions rather than administrator.

If you self-host an LMS

Running Moodle yourself is entirely doable and meaningfully different from running a brochure site. It needs a cron task executing every minute or queued jobs pile up silently, a data directory kept outside the web root, sustained database capacity rather than burst capacity, and a real upgrade plan because major versions do not wait for your timetable. If your LMS holds grades, re-read the FERPA section above, because you have just become the operator of a record-keeping system.

Where Devoster Fits, and Where It Does Not

You are reading this on a hosting company's blog, so here is the straight version.

Devoster is a general-purpose host. We sell shared hosting with cPanel, managed WordPress, Node.js hosting, unmanaged KVM virtual servers with full root access, reseller hosting, dedicated servers and domain registration. Shared hosting starts at $2.90 per month for Lite and $5.90 per month for Standard, with a Pro tier above that. Virtual servers run on Intel Xeon Gold 6138 processors with NVMe storage and a 1 Gbps link, with unlimited bandwidth, one IPv4 address, DDoS protection and free migration, in a single US-South location.

For the publishing half of your estate, that is a good fit. A school homepage, a department site, a teacher blog, a PTA page, a club site, a prospectus microsite. Cheap, fast, easy to hand to a communications officer who is not a developer.

For the record-keeping half, we are the wrong answer and we would rather say so here than in a procurement questionnaire. We hold no security certification of any kind. There is no third-party audit report to send your district's counsel. We do not publish a data processing agreement as a standard product, we do not sign business associate agreements, and we publish no service level agreement or availability commitment. Our virtual servers are unmanaged, so patching, hardening and log retention would be your team's job, and we have one location in the US-South, which is a problem for any school that needs data to stay in Europe.

If you are shopping for somewhere to put a gradebook, a student information system or anything with a pupil's name attached to a health note, buy from a provider whose evidence you can put in front of your board. Then come back for the website.

Budgeting and Procurement Without Guesswork

School hosting budgets tend to go wrong in the same three ways.

• Paying enterprise prices for a brochure site. If the site is cached HTML for 360 days of the year, a large plan buys you nothing. Buy small, cache well, and keep the difference for the accessibility remediation you are going to need.
• Forgetting the renewal. Introductory pricing on a multi-year term looks excellent in the business case and considerably less excellent in year four. Ask for the renewal rate in writing and budget on that number.
• Ignoring the labour line. The expensive part of a school website is rarely hosting. It is the person who keeps it current. A plan that saves a hundred dollars a year and costs a staff member two hours a week is a bad trade.

On discounts, ask rather than assume. Some providers run education or nonprofit programmes and some do not, and terms change, so get the current offer in writing from each vendor on your shortlist instead of trusting a blog post, including this one. If you are comparing plan types before you ask, our shared hosting versus VPS comparison sets out where the line usually falls, and web hosting for beginners covers the vocabulary you will meet in vendor calls.

Frequently Asked Questions

Is there such a thing as FERPA certified hosting?

No. FERPA creates obligations for schools and reaches vendors only through contract terms, and no government body certifies providers against it. When a host advertises certification here, it is describing something it invented or a private assessment with its own criteria. Ask for the written agreement instead.

Can a school website run on ordinary shared hosting?

Usually yes. A site publishing term dates, news, staff lists and admissions information carries little regulatory weight, and a cached content management system on a small plan handles the traffic comfortably. The rule to enforce is that nothing identifying a student academically or medically ever lands there.

Which compliance frameworks does Devoster meet?

None are certified or audited. We are a general-purpose host with no third-party attestation report, no published data processing agreement and no signed agreement covering student records. Use us for the public site. For a gradebook or a student information system, choose a specialist provider that can evidence its controls.

Does COPPA apply to our school district's own website?

Usually not directly, because the rule targets commercial operators. It very much applies to the ed-tech vendors you deploy to pupils. Your exposure is a vendor management task: check what each service collects, confirm the data is used only for the educational purpose, and keep the documentation.

What accessibility standard should a school site meet?

WCAG 2.1 Level AA is the technical target adopted for state and local government web content in the United States, including public schools, with compliance dates staggered by entity size. Check the date for your district. Most of the work is editorial: real text, alt attributes, captions, contrast and heading structure.

Can we host a learning platform like Moodle ourselves?

Technically yes, and many schools do. It needs a cron task every minute, a data directory outside the web root, steady database capacity and a genuine upgrade plan. Remember that once it holds grades it is a record-keeping system, so the contract questions in this guide apply to whoever hosts it.

Your Next Step

Spend an hour on the inventory before you spend a dollar on education web hosting. List every system, sort each one into publishing or record-keeping, and write down who the vendor is and what agreement is on file. Most schools find at least one surprise, and it is always better to find it yourself.

Then buy accordingly: a specialist for the records, and something simple and well-cached for the site. If the website half is what you are solving today, our shared hosting and managed WordPress plans are built for exactly that job, and free migration means moving the existing site is not the obstacle it looks like.