Someone has full control of your website. Right now.
The pharmaceutical spam links our team discovered are not the threat — they are the proof that a threat exists. To inject server-level code that runs invisibly on every page load, an attacker must have the same depth of access as a system administrator. They are inside your infrastructure. They have been for some time.
Today, they have chosen to run a quiet pharmaceutical spam operation because it is financially motivated and stays hidden. But that is a choice — and it is their choice to make, not yours. At any moment, without warning, that same level of access could be used to:
The evidence: what's happening right now
The active compromise was confirmed by impersonating Google's search crawler. The attacker's code — running on your server — detected the simulated crawler and revealed itself by injecting over 170 pharmaceutical spam links into the page response. This technique is called cloaking: serving different content to search engines than to human visitors. It requires deep server-level access to execute and is invisible to anyone browsing the site normally — including your own team.
The injected links all point to nolapublicschools.org — a domain your organization also owns and operates on the same hosting infrastructure. Both domains are almost certainly compromised. Your own assets are being turned against you.
Verify this yourself in 60 seconds
The following command impersonates Google's crawler and asks your site for its homepage. The output reveals what Google — and the attacker — actually sees.
</div></div></div><a href='http://nolapublicschools.org/online-500-mg-lasix/'>online 500 mg lasix</a>
<a href='http://nolapublicschools.org/order-metformin-without-prescription/'>order metformin without prescription</a>
<a href='http://nolapublicschools.org/propecia-onlina-australia/'>propecia onlina australia</a>
<a href='http://nolapublicschools.org/buy-clomid-for-men-online/'>buy clomid for men online</a>
... 170+ additional pharmaceutical spam links omitted for brevity ...
billdalton@MacBook-Pro ~ % █
The platform has no security support.
nolapublicschools.com runs on Joomla 3, a content management system that reached end-of-life in August 2023. This means the Joomla development team no longer releases security patches, bug fixes, or updates of any kind for this version. Every vulnerability discovered after that date remains permanently unpatched on your installation.
The current attack is almost certainly a direct result of this. Joomla 3 installations have been systematically targeted by automated exploit kits that scan for known vulnerabilities and inject malicious code at scale. Your site was not individually targeted — it was caught in a wide net cast across thousands of similarly outdated installations.
2023
- End-of-life since August 2023 — no security patches
- Actively compromised with pharma spam injection
- No HTTPS enforcement — site runs on HTTP
- Custom page builder creates fragile, non-portable content
- Nearly 2,000 PDFs with no document management system
- Shared hosting not suited for a district-wide site
- Zero accessibility compliance — fails WCAG 2.0 Level A
- No active security monitoring or update management
- Actively maintained — security updates released regularly
- Clean rebuild eliminates all compromised code
- HTTPS enforced by default at the hosting level
- Stable, portable, standards-compliant layouts
- Structured document library with searchable archive
- Managed hosting with automatic updates and security scanning
- Built to WCAG 2.1 AA compliance standards from day one
- Ongoing maintenance plan with monthly security reviews
The site fails federal accessibility law.
Under ADA Title II, public school districts are required to make their digital communications accessible to people with disabilities. The Department of Justice's 2024 final rule established WCAG 2.1 Level AA as the enforceable standard for state and local government websites, with compliance deadlines beginning in 2026.
An accessibility scan of nolapublicschools.com found serious failures across every category that matters to users who rely on screen readers, keyboard navigation, or other assistive technologies. The site received scores of zero in two of the eight categories evaluated.
| Category | Score | Priority | Key Issues |
|---|---|---|---|
| Forms | 0 — Fail | Critical | Checkboxes and radio buttons have no labels. Form controls change context without warning. Submit buttons are improperly typed. |
| Landmarks | 0 — Fail | Critical | Navigation has no role="navigation" tag. Main content is not in a main landmark. Screen reader users cannot navigate the page structure. |
| General | 41 — Fail | Critical | iFrames missing labels. ARIA menu roles misapplied to navigation, causing incorrect screen reader behavior. |
| Interactive Content | 69 — Needs Work | High | Buttons missing assistive technology tags. Ambiguous links lack context. Broken ARIA attribute references. |
| Graphics | 69 — Needs Work | High | Decorative icons not hidden from screen readers. Functional images missing text alternatives. |
| Text Content | 100 — Pass | None | Emphasis and strong tags are properly structured. |
| Metadata | 100 — Pass | None | Page language, title, and viewport tags are correctly set. |
| Lists | 100 — Pass | None | List elements are properly structured. |
What needs to happen next.
These three issues — active security compromise, end-of-life platform, and accessibility failures — share the same root cause: a website that has outlived its platform without active stewardship. The solution to all three is the same: a clean rebuild on a modern, secure, accessibility-compliant foundation, with an ongoing maintenance commitment that keeps it that way.