Admin – Lessonsmith

🔒 My KS3 Computing plan

Your own KS3 order, visible only to you: Autumn 1 Online safety (3 lessons) then cryptography (4), Autumn 2 Python turtle with the Bebras Challenge, Spring 1 web, Spring 2 AI, Summer 1 game making, Summer 2 micro:bits. Teachers on paid plans see the Lessonsmith plan; you can switch between both.

Open my plan Open the Lessonsmith plan

You need to be signed in with your two-step code to see it.

☁️ Google Cloud spending

How to see Google's actual bill here

In Google Cloud, open Billing → Billing export, and turn on Standard usage cost export to BigQuery. Make a new dataset (for example billing_export) in the EU location.
In IAM, give the service account Lessonsmith uses for pictures the BigQuery Job User role, and BigQuery Data Viewer on that dataset.
After a few hours, BigQuery shows a table called gcp_billing_export_v1_…. In Render, set GOOGLE_BILLING_EXPORT_TABLE to project-id.billing_export.gcp_billing_export_v1_… (the full name, copied from BigQuery).
For emails when spending gets high, also set a budget with alerts in Google Cloud Billing: that works even when you're not looking at this page.

Google adds costs to the export within about a day, so the actual figure lags a little behind the estimate.

🧭 Recommendations

🛡️ Safety settings for Lessonsmith

These apply to everyone. Changes are saved straight away and recorded in the security log below. Your own account always needs two-step sign-in to open this page.

Two-step sign-in required for The owner (you): always School admins: always School leaders Every teacher, in schools and on their own

Pupils Teachers can set tasks for pupils Schools can offer class rewards for coin levels (each school opts in; whole groups only) Schools can let pupils sign in with their school Google or Microsoft account (each school opts in) Teachers who aren't linked to a school can set only Lessonsmith's own questions for pupils (not their own or edited ones) Teachers can show pupils the mark scheme after a task Teachers can run practice tests (answers sealed for the teacher, handed in online) Teachers can ask AI to suggest marks (each school must switch it on too) Class tasks stay open for at most days Emergency pause: stop pupils joining any session, group or task right now

AI pictures (Google, on Vertex AI) Staff can make AI pictures for slides and worksheets (each school can switch it off) Pupils see pictures from the approved picture library in Revision Forge If the model isn't offered in a UK or EU region, allow Google's global region (data may be processed outside the UK and EU) Pictures teachers can make each month, across the whole site: Pictures you can make for the library each month: Library pictures you make may use Google's global region (your descriptions never include personal data), so the newest model can be used

Staff sign-ins Staff stay signed in for days

Shorter is safer on shared school computers. Applies to new sign-ins.

Schools' safety setup

Security log (last 200 actions: sign-in security, admin actions, school settings and tasks; never pupil data)

🖼 AI pictures

📦 Picture bank: fill the teachers' library in bulk

Choose subjects and how many pictures each should have. Lessonsmith's AI writes the descriptions (spread across each subject's topics), then the pictures are made in the background with the library model and added straight to the teachers' library. You can close this page; it carries on, and pauses if the monthly library limit is reached.

Make pictures for the library

🧩 Pictures for Revision Forge lessons

When the teachers' library has pictures for a subject, Lessonsmith can suggest the best one for each part of every topic's "Learn it" lesson. It only suggests a picture where it really helps, so some topics get none. Nothing reaches pupils until you approve it.

Subject

🚩 Reported pictures

You check every report first. A report from a school also goes to the class teacher and the school's admins; after you and they find no concern, the school's safeguarding lead confirms before it's used there again. Free accounts and visitors' reports only come to you.

Recently closed reports

Picture library

Library Subject or topic Search Hidden only

🛡️ Picture safety library

Every picture that has been reported, screened, rejected, removed or skipped, rated ▲ Amber (reported, waiting for checks), ● Green (screened and cleared) and ■ Red (screened and rejected, or removed). ◆ Grey descriptions were stopped by the safety checks before a picture was made. Deleting a picture removes it for good. Each school's safeguarding lead sees their own school's pictures on their own page.

🔎 Top accounts by AI cost this month

Watch for unusually heavy use; plan limits already cap everyone.

🚀 If you grow

Each paying teacher making 30 resources a month at this month's average cost, priced at the average of your two plans.

⚙️ Current settings

Change these in Render → lessonsmith → Environment, then Save Changes. The site restarts with the new values.

💷 How to reduce spending

Set a hard monthly cap at console.anthropic.com → Settings → Limits, and add billing alerts. A bug or abuse can then never run up a surprise bill.
Lower thinking effort: AI_EFFORT is now low by default (20–40% cheaper and faster). If complex resources (schemes of work, exam questions) feel thin, try medium.
Send more tools to the fast model: add ids to AI_FAST_TYPES (now: exit, starter, report, homework, rubric, quiz). Candidates: worksheet, diff, adapt. Visual and research resources always use the main model.
Fewer web searches: AI_MAX_SEARCHES is now 2 by default. Set 1 to save more, or 3–5 for more thorough research.
Cheaper main model: set AI_MODEL to claude-sonnet-5-5 (about half the price of Opus). Compare 10–20 resources first.
Allowances: monthly limits are in src/plans.js. Free stays at 5. If Pro margins tighten, a 60–80 limit still feels generous to most teachers.
Price heavy features higher: web research already uses 2 of the allowance. Visual resources could do the same if they become a big share of spend.

🏗️ How to scale

Up to a few thousand teachers: the current setup (one Render server and one SQLite database file) is enough. The server mostly waits on the AI.
Anthropic rate limits: new API accounts can make fewer requests per minute. Limits rise automatically as you spend. If you expect a launch spike, ask Anthropic for a higher tier in the console.
Bigger server: in Render, upgrade the instance (Settings → Instance type) if pages slow down under load.
Many thousands of teachers: move the database to Render Postgres so you can run several servers side by side. This is a one-off code change.
Backups: turn on disk snapshots in Render so the database can be restored.
Data location: Render runs in the US by default; UK schools may prefer an EU region (Frankfurt). Moving region means creating a new service and copying the database.

🔑 Password reset link

If a user can't get the reset email, make a link here and send it to them yourself. It works once, for 1 hour.

🛡 Security check

One button checks the whole site: attacks in today's activity, failed admin attempts, your two-step sign-in, settings, packages with known problems, disk space and backups. Each problem has a fix button. Every fix asks for a code from your authenticator app first.

🚨 Emergency actions

For when something is wrong right now. Each one is written to the audit log and can be undone.

🔒 Lock down the site

Pauses new sign-ups (email, Google and Microsoft) and stops pupils joining anything. Signed-in staff carry on.

Also sign everyone else out

🚪 Sign everyone out

Ends every sign-in except this one. Use it if a password or the admin key may have leaked (then change it in Render).

⏸ Pause the whole service (level 6)

For when someone may be inside an admin account. Everyone else is signed out and emailed: "Lessonsmith is temporarily unavailable while we carry out urgent maintenance…". Only you can sign in until you resume it. At night (10pm to 7am) the site does this by itself for level 6.

⛔ Block a visitor

Use the 8-character code from Suspicious activity. Blocks last up to 30 days; you're never blocked yourself.

🗂 Incident log

Real attacks and security problems only: page loads, clicks and your own mistakes on your recognised devices aren't counted. It checks every 2 minutes. You're emailed once, and only for very serious incidents (levels 5 and 6), never when something stops or is resolved. Once you resolve something it stays resolved, unless there are new attempts after that. Small incidents resolve themselves after a quiet day.

What the levels mean

Loading…

📤 Get or export the security log

Download the resolved incidents (with the date and time of every attempt and what was done) and the security entries of the audit log. Once your file is saved, everything in it is deleted from the server. Open incidents and anything from the last hour stay, so an attack in progress is still tracked. The file has account email addresses in it: keep it somewhere safe, like your other security records.

From To Format

Also the Suspicious activity counts for those days (they reset on that panel)

🔦 Suspicious activity

Requests worth a second look: wrong passwords and two-step codes, bots probing for files a website shouldn't have, blocked and slowed-down requests, crawlers and sign-up bursts. Visitors are shown as a short code, never an IP address. Counts are kept for 30 days. A few probes and wrong passwords every day are normal on the internet; look out for spikes and for one visitor doing a lot.

Loading…

🛡️ Safety: staff accounts and pupil logins

Staff accounts confirm they're a teacher or education professional aged 18 or over, and pupil-style addresses (like @students.… or @pupils.…) can't sign up. Pupils use the free learning resources without logging in; pupil logins with a school account are blocked unless the school authorises pupil sign-in on its whole-school licence, and an existing account on a school's pupil domain is signed out and can't log in. Use this card to block a school's pupil domain, and to suspend any account that shouldn't be here. Suspending signs the account out everywhere.

🚩 Tasks pupils have reported

A report holds the task at once: no pupil sees it until you decide. Release it if it's fine, or remove it (and suspend the account below if it shouldn't be here). Follow your safeguarding procedure and tell the school's DSL where there is one.

Accounts that look like pupils

Suspend an account

Blocked email domains

💾 Backups

Download a copy of the whole database (accounts, resources, schools and Training studio data). Keep it somewhere private and secure, such as an encrypted drive, because it holds personal data. Download one each week, and before any big change.

Restore a backup onto a new site

Use this only when moving Lessonsmith to a new server or region. It works only on a brand-new site with no accounts except yours, so it can never overwrite live data. The site restarts by itself afterwards, which takes about a minute.

🏫 School licences

Set up a school after it pays. Everyone on its list gets the School plan (everything in Pro Full) until the end date. The school's admins can then add and remove their own staff at /school.html.

🪙 Pupil coins for schools

Make coins for a school's year groups (Year 4 to Year 13) in one go, for example when a school signs up. Coins hold no names or emails: just a random code, a random nickname, the year and progress. Coin cards: download the list and the cards (with QR codes) and send them to the school's admin securely; only the school knows whose coin is whose. School sign-in: nothing to send. Pupils pick up a coin for their year the first time they sign in with their school account, and we keep only a one-way fingerprint of that sign-in. The school's admins see and manage these coins in their own Pupil coins section.

School

Make coins by class

Your own class codes are filled in here for your account only; schools choose their own codes in their Pupil coins section. Each class gets 30 coins unless you change it, and serial numbers carry on from the school's last coin.

📅 Or by year group only, or a 🎒 sign-in pool

Print or download the school's cards

The whole school, chosen classes, or only lost card numbers. The CSV is numbered in order.

🔬 SEND Suite trials (R&D)

Requests for trial Smith Coins. Check the requester's ID card email first, then authorise: the trial starts now and runs for its weeks. Coins are collected by the requester with their pickup key; we only keep scrambled codes. Ending a trial (or reaching its end date) deletes its key, so the records on its coins can't be opened again. Contact details are deleted 30 days after a trial ends or is declined.

🧪 Try the SEND Suite yourself

Mints an owner test trial straight away, with no request or ID check, so you can try every tool or demonstrate it. Test trials are marked 🧪 in the list above, and end (deleting their records) like any other.

🪙 Smith Coins licences

Organisations trialling or licensed to use Smith Coins in their own services. Active licences marked public are listed on the Partner page under "Organisations using Smith Coins", and anyone can check a licence by its reference. Ending a licence takes it off the list straight away.