<![CDATA[This research is motivated by the increasing security needs of school digital services, while the management and configuration of systems on several school websites still has the potential to cause security gaps. The purpose of this study is to analyze and compare the security level of SMK At-Tamimi's website with InfinityFree hosting and recommend the most relevant improvements. The method used is non-destructive penetration testing with a comparative descriptive approach, through the stages of footprinting, scanning-fingerprinting, vulnerability verification, and reporting. The test was carried out on two school websites, namely SMK At-Tamimi and MAN 2 Situbondo, using the ZAP by Checkmarx application and supporting checks on the website security configuration. The test results show the difference in risk levels between websites. Both websites generate 9 alerts. The SMK At-Tamimi website contains 1 finding of High risk (11.1%), 2 Medium (22.2%), 2 Low (22.2%), and 4 Informational (44.4%), while MAN 2 Situbondo does not contain High (0%) findings, with 2 Medium (22.2%), 4 Low (44.4%), and 3 Informational (33.3%). The MAN 2 Situbondo website has the highest level of security because there are no indications of high-risk vulnerabilities as well as better configuration. The SMK At-Tamimi website is in a lower security position compared to its comparative website, because there is an indication of Cloud Metadata Potentially Exposed, but it is not accompanied by proof of access that can be validated within the test limit. The findings of the study indicate the need to strengthen the security configuration of school websites through the implementation of HTTPS/SSL, the addition of security headers, and regular system updates. Additionally, the use of paid hosting can be an alternative to gaining broader control over security configurations and reducing the risk of security misconfiguration.]]>
