When Tony Porterfield’s two sons came home from elementary school with an assignment to use a reading assessment site called Raz-Kids.com, he was curious, as a parent, to see how it worked. As a software engineer, he was also curious about the site’s data security practices.

And he was dismayed to discover that the site not only was unencrypted, but also stored passwords in plain text — security weaknesses that could potentially have allowed unauthorized users to gain access to details like students’ names, voice recordings or skill levels. He alerted the site to his concerns. More than a year later, the vulnerabilities remain.

“A lot of education sites have glaring security problems,” said Mr. Porterfield, the principal engineer at a software start-up in Los Altos, Calif. “A big part of the problem is that there’s not even any consensus of what ‘good security’ means for an educational website or app.”