Securing Your Nonprofit’s WordPress Website

Your nonprofit’s website is where donors give, volunteers sign up, and the people you serve look for help. If you manage it yourself, keeping that WordPress website secure is part of protecting your mission, but you don’t have to be a developer to do it.

In this episode, Lisa walks executive directors and small marketing teams through the essentials of a secure nonprofit website in plain language. You’ll learn why hosting matters, how to enforce HTTPS, which features to disable (like XML-RPC) and which to restrict instead (the REST API), how to set up two-factor authentication and much more. Some of these you can do this afternoon, and some you can hand to your host or web professional.

The 10-point checklist

1. Choose a WordPress-focused host with backups and a firewall.
2. Force HTTPS on every page, and use a hosted payment processor for donations.
3. Keep WordPress core, plugins, and your theme updated.
4. Delete unused plugins and themes, and vet the ones you keep.
5. Review your users, remove old accounts, and use the lowest role needed.
6. Turn on two-factor authentication, starting with administrators.
7. Limit login attempts and retire the “admin” username.
8. Disable XML-RPC if you don’t need it, and restrict (don’t remove) the REST API.
9. Ask your host or developer to confirm the basics: file editor off, correct permissions, a firewall.
10. Run automatic off-site backups, test a restore, and set up vulnerability and uptime alerts.

Resource mentioned Check your HTTPS status and confirm your website is showing secured content over HTTPS by visiting: https://www.whynopadlock.com/

Take the next step Visit fivepennyweb.com to learn how Fivepenny Web Studio helps nonprofits build accessible, secure WordPress websites.

Enjoyed the episode? Please leave a review wherever you listen. It helps other nonprofit leaders find the show.