This Islamic boarding school website design service builds websites for pesantren (Islamic boarding schools), madrasah, foundations, and mosques. Each one gets three things right. First, student registration through a form with parental consent. Second, a donation page that keeps infaq, cash waqf, and zakat apart, each by its own rules. Third, a report on how funds were used, which the board updates itself. All of it is secured against the online gambling intrusions that so often hit the websites of pesantren and mosques. All of it is built by me, from Jakarta, as a website engineer and technical lead.
The website suits pesantren, madrasah, education and social foundations, and mosques. They can stand alone or sit under one foundation. An academic information system and a payment gateway are not part of the default package. If you already use them, the website links to them. For general schools, I wrote a separate article.
In short
- Student registration through a short form with parental consent, sent to the committee's email.
- A donation page that keeps infaq, cash waqf, and zakat apart, with room for the permit number and a report the board updates itself.
- A ponpes.id, sch.id, or or.id domain in the institution's name, with help on the paperwork.
- Secured against online gambling intrusions, with a free 3 month malware cleanup guarantee.
- Paid once. Afterwards only the domain, plus a server if you choose one. Staff or appointed students (santri) update news, schedules, and reports.
- First step: tell me about your institution through the form on the homepage.
Why institutional websites get hijacked for online gambling, and what it means for the board
Websites of pesantren, mosques, and schools attract intruders, because Google trusts their domains and nobody watches them closely. In July 2024, West Jakarta police dismantled a syndicate that had hacked 855 government and university websites and rented their subdomains to gambling operators for Rp3 million to Rp20 million a day. A pesantren or mosque website built on an old template and never updated is the same open door.
For the board, the damage is not just technical. The pesantren's name shows up in gambling search results. Donors hesitate, and parents start asking questions. That is why I put security and the cleanup guarantee at the front of this article, not in a footnote.
Student registration through a form: enough data, and in line with child data rules
The registration form on pesantren websites I build asks only for what the first stage needs. That means the student's name, date of birth, and previous school, the guardian's name and contact, and the chosen programme. Submissions go to the admissions committee's email, and guardians with questions press the committee's WhatsApp button. Documents such as birth certificates and family cards come at the next stage. They are not uploaded to the website.
A child's data is personal data with special rules. Article 25 of Law No. 27 of 2022 requires the consent of a parent or guardian. The forms I build include that consent checkbox. A short note says what the data is used for.
This flow is cheaper and safer, and it matches how parents in Indonesia behave: they almost always want to ask on WhatsApp before they register. A registration system with accounts and online payment only makes sense once the committee has at least one admin. It also needs more applicants than the form and chat can handle. A system like that is costlier to build and to keep running. There is no need to rush.
The pesantren itself must be registered. Article 6 of Law No. 18 of 2019 requires a pesantren to register with the Minister of Religious Affairs to obtain its registered status. Showing the pesantren or madrasah statistics number on the website helps parents confirm it is official.
Donation and waqf page: keeping infaq, cash waqf, and zakat apart
The donation page on foundation and mosque websites I build keeps three things apart, because each has its own rules. Infaq and sadaqah (voluntary donations) fall under the rules on collecting money or goods. Law No. 9 of 1961 requires a permit, with exceptions for collections required by religious law or held within a limited circle. Article 4 of Social Affairs Ministry Regulation 8/2021 on collecting money or goods exempts collections held inside a place of worship.
Article 10 of the same regulation counts bank accounts, online services, apps, e-money, and social media as collection methods. If a foundation raises money from the wider public through its website, a permit comes into play. Depending on the reach, it comes from the Minister of Social Affairs, a governor, or a regent. Article 25 then requires a report on the proceeds and how they were distributed.
Cash waqf is different again. Article 28 of Law No. 41 of 2004 says cash waqf is placed through a sharia financial institution appointed by the Minister, with a cash waqf certificate. Zakat may only be managed by BAZNAS, a licensed zakat institution (LAZ), or a zakat collection unit (UPZ). Article 38 of Law No. 23 of 2011 bans acting as a zakat collector without a permit.
The donation page I build gives each of the three its own block. There is room for the permit number and the LAZ or UPZ status if there is one, bank accounts in the institution's name, and a QRIS code. The board decides which regime applies. I am not a legal consultant.
The board updates the fund usage report through the panel, per month or per programme. Social Affairs Ministry Regulation 8/2024 even asks permit applicants to show an institutional profile on their publication page: history, board, activities, address, and telephone. Rules aside, an open report is the strongest reason a donor gives again.
Which pages does a pesantren, madrasah, foundation, or mosque website need?
- Profile: history, vision, the head or foundation chair, the board, and legal status (deed, registered status, statistics number).
- Programmes: formal schooling and classical text study, tahfiz (Quran memorisation), student activities, and the daily schedule; for a mosque, prayer times, study circles, and events.
- Registration: rules, dates, fees if the board chooses to show them, and the form.
- Donations and waqf: purpose, bank accounts, QRIS, permits, and reports.
- News and gallery: updated by appointed staff or students through the panel.
- FAQs: when parents may visit, how to reach students, how to channel zakat.
- Contact: address, map, and WhatsApp numbers for the committee and the office.
A foundation that runs a pesantren, a madrasah, and a mosque at once gets one website with a section per unit. It can also be one domain with a subdomain per unit, whichever matches how the foundation is run.
A ponpes.id, sch.id, or or.id domain in the institution's name
Websites I build use the Indonesian domain that matches the type of institution. That is ponpes.id for a pesantren, sch.id for a madrasah or school, and or.id for a foundation or mosque. Each needs documents, such as a reference letter from the pesantren's head for ponpes.id or a notary's deed for or.id, as summed up in the registrar's guide. The domain is in the institution's name, not mine and not one board member's, so a change of board never loses the domain.
Found by parents and worshippers on Google and in AI answers
Websites I build are structured to be found for searches such as "tahfiz pesantren in Bogor" or "study circle schedule at a mosque in Tebet". The content is also prepared so AI Overviews, ChatGPT, and Perplexity quote it correctly when parents ask a machine. Your details are matched to the Google Business Profile. News and articles written by students or staff through the panel become extra ways in from search.
Speed is targeted to pass Core Web Vitals on phones, because parents outside the big cities often open the website on a slow mobile connection. Uploaded event photos are tidied on their own. This site uses the same approach. Its Lighthouse mobile score on 12 October 2026 was 94. When admission results come out, the website stays up even if thousands of parents open it at once.
Tracking: usually not needed
Mosques and pesantren rarely advertise, and websites I build run fully without tracking. If the foundation chooses to advertise a specific programme, tracking can be installed from your own ad account, and it only turns on after the visitor consents. It never sends the contents of the form to an ad platform.
Safe from malware and online gambling, with a free 3 month cleanup guarantee
Pesantren and mosque websites I build are secured to the same standard as this site. On 12 October 2026 this site held an A+ on both securityheaders.com and Mozilla HTTP Observatory. Your board can test it with the same tools. Those technical details are deliberately withheld here so they cannot be used as a guide by intruders.
A hijacked website can show gambling ads under the pesantren's name. For a pesantren or mosque, that is a wound that heals slowly. So your website comes with a free malware cleanup guarantee for 3 months from launch, stated on the proof of payment; other packages give 1 to 6 months. Within the guarantee period, the cleanup costs your treasury nothing extra. The work means removing malicious code, restoring the website files from the latest backup, and closing whatever entry point I find in the website I delivered.
After the guarantee ends, a cleanup is billed as separate work, and severe cases can run to tens of millions of rupiah, a heavy figure for a foundation's treasury.
The guarantee is a cleanup service by me, not compensation. It does not cover admin negligence, such as a password shared with many people, or changes made by others. Outages at the server or domain provider you chose are not covered either, nor are components that go out of date after the guarantee ends without renewal. The full terms are on the terms page. It draws on my experience cleaning up hacked websites, including sites hijacked for online gambling.
Cost: paid once, light on the institution's treasury
Websites for pesantren, madrasah, foundations, and mosques are paid for once, in stages, with a written breakdown. You can bring it to a board meeting. From launch onward the running cost is the domain renewal, plus a server if you decide you need one. A profile website with a form and a donation page usually runs without a monthly server. The pages stay up without any subscription that must be renewed.
Support after handover is optional. That support means fixes, updates to website components, and limited help when you need it. There is no annual contract. News, schedules, the gallery, and reports are updated by appointed staff or students through the panel. Access rights are limited per person. Extra features can come later, such as a subdomain per unit, online registration payment, or Arabic and English versions for donors abroad. The same service builds them, at a special rate.
Ready to use, in the institution's name, source code if needed
The default of this service is a ready-to-use website. The built files live on the institution's domain, and the domain and accounts are in the institution's name. There is a panel for changing content. A handover document can be passed to the next board. Moving the files to another hosting provider is possible at any time. If one day the board wants a different manager, my access is revoked and the website keeps running.
The project files for rebuilding and reshaping the website, known as the source code, are not included by default. For a foundation this is a good deal. The cost is far lower, the board still handles news and reports through the panel, and my support applies to the version I delivered.
The code is worth buying only if the foundation has its own IT team or plans a large system, such as an integrated academic system. That option is priced on its own and costs much more, and sometimes it is not available when the website uses licensed components. Its status is written in the offer.
Why the board should not build it with AI, hire an agency with no clear accountability, or use a free hosting template
| Consideration | Building it yourself with AI | An agency with no clear accountability | A free hosting template | Built by an engineer (this service) |
|---|---|---|---|---|
| Donation page | AI mixes zakat, infaq, and waqf into one button | Copied from elsewhere | A generic donation block | Kept apart by their rules, with room for permits and reports |
| Safety from online gambling | Nobody watches it | Untested | Updated late, with thousands of other sites | Tested with public tools, 3 month cleanup guarantee |
| Change of board | Only one person knows how it works | Access stays with the agency | Accounts in one person's name | Domain, accounts, and documents in the institution's name |
| Child data in forms | Stored who knows where | Depends | A stock form with no parental consent | Only what is needed, with parental consent, to the committee's email |
| Who is accountable | The board, between teaching duties | Unclear | Nobody | The same person from start to handover |
| Annual costs | AI tool and builder subscriptions | A monthly retainer | Free until you need a feature | The domain, plus a server if chosen |
AI can produce a pesantren page that looks finished overnight. It will have a "donate now" button that mixes zakat and infaq, and a registration form with no parental consent. I wrote about the mistakes of unchecked AI-built websites in the online store case. An agency where nobody knows who did the work leaves a new board unsure who holds access once the old board moves on. A free hosting template is the entry point for online gambling I find most often on pesantren and mosque sites.
I am not the right choice if you need a full academic system with grades, attendance, and tuition payments from day one. For that, choose the system provider, and let the website link to it.
Who is behind this Islamic boarding school website design service?
This website design service for pesantren, madrasah, foundations, and mosques is run by me, Dicky Ibrohim, website engineer and technical lead. My profile is on the about page. Day in, day out I build websites and applications, fix the ones that break, and clean up the ones hit by malware. That includes sites of foundations and schools hijacked for online gambling, and the cases I have handled run into the thousands. I use AI to speed up repeated parts, then test the result myself until the registration form reaches the committee's email.
I am not a foundation board member and not a legal consultant. Fundraising permit status, LAZ status, and programme content come from the institution and are approved by the board. Material from me is licensed. Material from the institution is guaranteed by the institution.
Process: from the institution's profile to launch
- Tell me about your institution through the form on the homepage: the type of institution and its units, location, and the domain you want. Say whether you need registration and a donation page.
- **A written offer is sent within one or two business days. Inside it: the page structure, schedule, fees and payment stages, whether a server is needed, the malware guarantee period, and the scope of support. It can go to a board meeting.
- A short interview: programmes, admission dates, the purpose of donations and permit status, and the questions parents and worshippers ask most often.
- Text and design: I draft them, and the board reviews and approves them, especially the donation and registration pages.
- Preview on phone and laptop: the form and WhatsApp button are tested until the messages reach the committee's email.
- Launch and handover: access, ownership documents in the institution's name, and a guide to the panel go to the board.
What the institution needs to prepare
- The institution's name, deed or registered status, statistics number, address, and the domain documents (a reference letter from the head or the foundation deed).
- Profiles of the head or the board, the programmes, and schedules.
- Admission rules and dates, plus the committee's WhatsApp number and email.
- The purpose of donations, bank accounts in the institution's name, the QRIS code, and any fundraising permit, LAZ, or UPZ status.
- Event photos and the names of the staff or students who will run the panel.
Eight questions to ask before choosing someone to build your pesantren or foundation website
- Does the donation page keep infaq, cash waqf, and zakat apart by their rules? (Yes, with room for permits and reports.)
- Does the registration form include parental consent and ask only for what is needed? (Yes.)
- In whose name is the ponpes.id or or.id domain registered? (The institution's, not an individual's.)
- What happens if the website is hijacked for online gambling? (I clean it up free during the 3 month guarantee on the proof of payment.)
- Which costs recur? (Just the domain, plus a server if you pick one; support is optional.)
- Can students or staff update news and reports themselves? (Yes, through a panel with rights per person.)
- Can the website move to another host when the board changes? (Yes, at any time.)
- Can a subdomain per unit or online payment be added later? (Yes, at a special rate.)
First step: tell me about your institution
Parents and donors trust an institution that is open about itself, whose registration is clear, and whose reports can be read. This website design service for pesantren, madrasah, foundations, and mosques builds exactly that. The website does all three by the rules, stays safe from intrusion, and remains easy for the next board to run.
Tell me about your institution through the form on the homepage or email hello@dickyibrohim.com. I will reply with a page structure that fits your type of institution, the cost, and a likely launch date before the admission season.
Frequently asked questions
How much does a pesantren or foundation website cost?
The build fee is paid once, in stages, with a written breakdown. After launch, the running costs are the domain, plus a server only if the institution chooses one; support is optional. The amount depends on the number of units (pesantren, madrasah, mosque under one foundation), the registration form, and the donation page. I send it after you tell me about your institution through the form on the homepage.
Does a mosque or foundation need a permit to put a donation bank account on its website?
Social Affairs Ministry Regulation 8/2021 on collecting money or goods exempts collections held inside a place of worship from the permit requirement. It also counts bank accounts, online services, and social media as collection methods. When a foundation uses them to reach the general public, it needs a permit from the Minister of Social Affairs, a governor, or a regent, depending on the reach. The website I build leaves room for that permit number, and the management confirms its status; I am not a legal consultant.
What is the difference between infaq, cash waqf, and zakat on a donation page?
Infaq and sadaqah (voluntary donations) fall under the rules on collecting donations. Cash waqf under Law 41/2004 is placed through a sharia financial institution that receives cash waqf, which issues a certificate. Zakat under Law 23/2011 may only be managed by BAZNAS, a licensed zakat institution (LAZ), or a zakat collection unit (UPZ). The donation page I build keeps the three apart, so the institution never receives funds under a regime it is not entitled to.
Can a pesantren receive zakat through its website?
Only if the pesantren or foundation is a licensed zakat institution (LAZ) or a zakat collection unit (UPZ) under BAZNAS; Law 23/2011 prohibits acting as a zakat collector without a permit. Without that status, the donation page carries infaq, sadaqah, and waqf only, and zakat is directed to the authorised institutions.
Do donation reports have to be published on the website?
Social Affairs Ministry Regulation 8/2021 requires licensed fundraisers to report the proceeds and how they were distributed, and Regulation 8/2024 asks applicants to display an institutional profile on their publication page. Obligation aside, an open report on the website is the strongest reason a donor gives again. The panel lets the management update it themselves.
How does student registration work through the website?
A prospective guardian fills in a form with only as much student and parent data as needed and ticks the parental consent box. The submission goes to the admissions committee's email, and the committee follows up on WhatsApp. A child's data may only be processed with parental consent under Law 27/2022, and the form is designed for that.
Which domain is right: ponpes.id, sch.id, or or.id?
A pesantren uses ponpes.id, a madrasah or school uses sch.id, and a foundation or mosque uses or.id. Each requires institutional documents, such as a reference letter from the head or the foundation deed, and I help with the paperwork in the institution's name.
Can one website serve a foundation that runs a pesantren, a madrasah, and a mosque?
Yes. Either one website with a section for each unit, or one foundation domain with a subdomain per unit, whichever matches how the foundation is run.
Do I receive the source code?
The default is a ready-to-use website: the built files live on the institution's domain, movable to any hosting, with access and a handover document. The source code is a separate option with its own fee and is not always available; its status is written in the offer.
What if the website gets malware or is hijacked for online gambling?
The website comes with a free malware cleanup guarantee for 3 months from launch, as stated on the proof of payment; other packages give 1 to 6 months. The guarantee is a cleanup service, not compensation; the scope and exclusions are on the terms page.
