ICSM: from a hacked website to a nonprofit transparency portal in Brasília

ICSM has worked since 2010 with sports, culture, education and job training in Santa Maria, an administrative region of Brazil's Federal District. The institute receives federal funds through grant agreements, so it needs a website that shows its work and accounts for the money clearly.

The old WordPress site had been compromised. Of its 629 posts, only 33 were the institute's news. The other 596 were spam pages, indexed by Google under the name of a nonprofit that accounts for public money.

Brazil's Law 13,019/2014, the regulatory framework for civil society organizations (MROSC), asks nonprofits to publish the signing date and the accountability dates of each partnership, and those items were missing. Some text was locked inside images, footer links were broken and the institute's name was spelled two different ways.

Since the old code was contaminated, none of it was reused. We rebuilt the site as static pages: the server delivers ready⁠-⁠made files, the database sits out of reach of the web and there are no plugins to update. Only the revised text of the 33 news posts and about 106 project photos, chosen one by one, came back from the old site.

Each of the 596 spam pages now answers with a 410 code, which tells Google the content was removed for good. The old addresses that still mattered got permanent redirects, to keep the links shared on social media and in search.

The transparency portal, built with Transparência360, brings together the institute's four grant agreements with Brazil's Ministry of Sports and Ministry of Women. Each agreement shows its purpose, term, total value, amount transferred, accountability status, documents to download and the link to check it on Transferegov, the federal platform for transfers. A summary panel adds up the values from the data itself.

For the team, we built a simple sign⁠-⁠up panel. The site's six forms, from volunteering to the futsal tournament, land in the same place, with an email alert and a button that opens a WhatsApp chat with whoever signed up.

Today the ICSM site has 50 pages, all of them the institute's own. Transparency moved to the center of the site. The R$ 496 thousand in partnerships appear added up and itemized agreement by agreement, with R$ 300 thousand already transferred. The accountability status is in plain view for funders, oversight bodies and the people the institute serves.

The site also became light and accessible. Files went from 2.8 GB of WordPress uploads to about 66 MB for the whole site. In Lighthouse, Google's tool for measuring page quality, the site scored 100 for accessibility and 93 to 98 for performance on mobile.

Upkeep became cheap. The site runs on the same hosting plan the institute already paid for, and updating the transparency data means editing one data file, with the summary recalculated on its own. Families, volunteers and donors in Santa Maria find in one place what ICSM does and how it uses public money.