The Nonprofit’s Guide to Website Security
Nonprofit website security isn’t something you should think about after you get hacked.
Your website collects donations, contact information, newsletter subscriptions, or other details about the people your organization serves. It is also one of the most visible representations of your nonprofit. Keeping it secure protects your data, your donors, your reputation, and your ability to carry out your mission.
Why Nonprofit Website Security Matters
Nonprofits can be attractive targets because their websites often handle personal and financial information. The National Council of Nonprofits recommends that organizations assess their data-security risks and take steps to protect information from unauthorized access.
An attacker may exploit an outdated plugin, weak password, compromised administrator account, vulnerable server, or poorly secured third-party service. The result could be anything from spam or malicious content appearing on your website to a complete site takeover.
And even when sensitive data isn’t stolen, recovering a hacked website takes time and money. Two things most nonprofits would rather spend on their mission.
The goal of nonprofit website security isn’t to make your website impossible to attack. It’s to reduce vulnerabilities, detect problems quickly, and make sure you can recover if something goes wrong.
How to Keep Your Nonprofit Website Secure
1. Keep Your Website Software Updated
One of the simplest, and most commonly neglected, parts of website security is keeping everything up to date.
That includes:
- Your content management system (e.i. WordPress)
- Plugins and extensions
- Themes
- PHP and other server software
- Security tools
- Other third-party components
Security vulnerabilities are regularly discovered in website software. Once a vulnerability becomes known, attackers can look for websites that haven’t installed the available fix.
It’s recommended to keep CMS software, plugins, and themes updated and to remove unused or deactivated plugins and themes.
This is where regular nonprofit website maintenance matters.
Installing an update isn’t enough if nobody is checking whether the update caused a compatibility problem or whether another part of the site needs attention afterward.
2. Use HTTPS and Keep Your SSL Certificate Current
Your website should use HTTPS, which is indicated by the lock icon in the browser’s address bar.
HTTPS encrypts information transmitted between a visitor’s browser and your website. This is particularly important for websites that handle forms, account information, donations, or other sensitive data.
An SSL certificate also helps visitors feel confident that they’re interacting with the legitimate version of your website.
But SSL isn’t a “set it and forget it” task.
Certificates expire, DNS settings can change, hosting environments can be migrated, and configuration problems can cause security warnings or make parts of your website stop working.
3. Secure Administrator Accounts
Your website can be perfectly configured and still be vulnerable if someone has access to an administrator account.
Use strong, unique passwords and enable two-factor authentication wherever it is supported. Limit administrator privileges to people who actually need them.
You should also regularly review who has access to your website.
When a staff member, volunteer, board member, or contractor no longer needs access, remove or reduce their permissions. Don’t leave old accounts sitting around indefinitely.
We recommend changing passwords regularly, enabling 2FA, reviewing administrative changes, and checking for unexpected administrator accounts.
4. Remove Plugins and Tools You Don't Need
Every plugin, extension, integration, or third-party component adds another piece of software to your website.
That doesn’t mean you should avoid plugins. It means you should know what is installed and why.
Unused or abandoned plugins can create unnecessary security risks. Outdated and unsupported plugins can leave websites exposed to known vulnerabilities.
Regularly review your website and remove:
- Plugins that are no longer used
- Themes that are no longer needed
- Old integrations
- Duplicate tools
- Unsupported software
A smaller, well-maintained website is generally easier to manage than one filled with tools nobody remembers installing.
5. Back Up Your Website and Test the Backups
Backups are your safety net.
If your website is hacked, damaged during an update, accidentally changed, or otherwise compromised, a clean backup can make recovery dramatically easier.
We recommend the 3-2-1 backup approach. Three copies of your data, using two different storage types, with one copy stored off-site.
For a nonprofit website, backups should cover more than just the visible pages. Depending on your setup, you may need backups of:
- Website files
- Databases
- Media uploads
- Configuration
- Important website settings
And don’t assume that because your hosting company says “backups included,” your recovery strategy is complete.
6. Protect Your Domain and DNS
Your domain name is one of your nonprofit’s most important digital assets.
If someone gains control of your domain registrar account, they may be able to change DNS records, redirect your website, interfere with email, or potentially take control of other services connected to your domain.
Protect your registrar account with strong authentication and limit access to the people who actually need it.
Also make sure to keep your domain registration information and renewal status up to date.
7. Monitor Your Website for Problems
Security isn’t only about preventing attacks. It’s also about noticing when something has gone wrong.
Regular monitoring can help identify:
- Website downtime
- Unexpected changes
- Malware
- Suspicious activity
- Broken SSL
- Expired domains
- Failed backups
- Software vulnerabilities
A compromised website isn’t always obvious. Attackers may add hidden pages, malicious links, spam, or unauthorized accounts without immediately changing your homepage.
8. Be Careful With Forms and Online Donations
If your website accepts donations, registrations, applications, or other information, think carefully about what information you actually need to collect and where that information goes.
We recommend taking inventory of the data an organization collects, where it is stored, and who is responsible for it.
A good rule to follow is not to collect or store information you don’t need.
For online donations, use reputable payment processors and avoid unnecessarily handling sensitive payment information yourself.
Your website team should also review third-party integrations periodically. A donation platform, CRM, email service, analytics tool, or other integration can become part of your website’s overall security picture.
9. Have a Plan for When Something Goes Wrong
Even a well-maintained website can experience a security incident.
Your nonprofit should know:
- Who manages the website?
- Who manages the domain?
- Who is your hosting provider?
- Who can access the website?
- Where are your backups?
- Who should be contacted if the website is compromised?
- How can the website be restored?
- Who needs to be informed?
If a website is defaced or compromised, recommended response steps include contacting the hosting provider, restoring from a clean backup, changing passwords, identifying the vulnerability, and monitoring the site after recovery.
Having this information documented before an incident happens can save hours of scrambling when every minute matters.
10. Make Website Security Part of Ongoing Maintenance
The biggest mistake nonprofits can make is treating website security as a one-time project.
Security changes as your website changes.
New plugins are installed. Staff members come and go. Domains renew. Software receives security patches. Third-party services change. New vulnerabilities are discovered.
That’s why security works best as part of ongoing nonprofit website maintenance.
A secure nonprofit website should have a regular process for:
- Updating software
- Reviewing administrator access
- Monitoring uptime and security
- Maintaining backups
- Checking SSL and domain status
- Removing unnecessary software
- Reviewing integrations
- Addressing vulnerabilities
- Responding to problems
You don’t necessarily need someone on your team doing all of this manually. You need someone responsible for making sure it gets done.
A Simple Security Checklist for Nonprofits
Use this as a starting point for reviewing your website:
☐ HTTPS/SSL is active and current
☐ CMS, plugins, themes, and server software are updated
☐ Unused plugins and themes have been removed
☐ Administrator accounts are reviewed regularly
☐ Strong passwords and 2FA are enabled
☐ Website backups run regularly
☐ Backups are stored separately from the live website
☐ Backups have been tested for restoration
☐ Domain and DNS accounts are secured
☐ Website uptime and security are monitored
☐ Forms and donation tools collect only necessary information
☐ Third-party integrations are reviewed
☐ Your team knows who to contact during a website emergency
Download the security checklist here.
Don't Let Website Security Fall Through the Cracks
For many nonprofits, the problem isn’t that they don’t care about website security. It’s that website responsibilities are scattered across staff members, volunteers, contractors, hosting companies, and whoever happens to know the WordPress password.
That makes it difficult to know what is actually being maintained and what is being overlooked.
Nonprofit WebOps provides ongoing website operations for nonprofits, including hosting, SSL, DNS, maintenance, updates, backups, security, and technical support.
Instead of managing a collection of separate providers and hoping nothing falls through the cracks, you have one team responsible for keeping your website’s technical infrastructure running.
Your nonprofit has enough to manage. Your website security shouldn’t be another thing you have to chase.
Need a Team to Manage Your Nonprofit Website’s Security?
Let Nonprofit WebOps take care of the technical details behind your website with a predictable flat monthly fee and one team managing your web operations.