Charities have plenty of things to worry about before someone starts talking about website security – fundraising, impact, safeguarding, reporting, volunteers, funding… Website security can easily fall down the list, but a compromised website can damage trust, disrupt fundraising, expose data, send visitors to malicious websites or leave an organisation facing a costly and time-consuming recovery. And despite what you might think, you don’t need to be a major international charity to be a target.
Why do criminals target charity websites?
The first thing to understand is that most attacks aren’t personal. Criminals aren’t necessarily sitting down and choosing your charity because of what you do. A large proportion of attacks are automated. Bots continuously scan the web looking for websites running vulnerable software, outdated plugins, weak passwords and other known weaknesses. If your website happens to have one, it can be found and attacked.
That doesn’t mean charities have nothing valuable to attackers. Charities hold money and sensitive information, take donations online and often have large networks of staff, volunteers, trustees and supporters. The Charity Commission identifies charities as targets for cyber crime because they hold assets such as money and sensitive data and rely heavily on digital systems.
The NCSC has also highlighted characteristics of the charity sector that can increase its exposure to cyber crime, including its outward-facing nature, reliance on volunteers and a culture of trust. If your organisation takes donations, then you may be more at risk. We partner with charities and NGO’s on designing, building and maintaining their websites, find out more here.
How does a WordPress website get infected?
There are several common routes.
Outdated plugins and themes
WordPress itself, plugins and themes are regularly updated to fix security vulnerabilities. Once a vulnerability is publicly known and a fix is available, attackers can look for websites that haven’t applied the update. WordPress’s own security guidance describes keeping WordPress, plugins and themes up to date as one of the most important steps you can take. That’s not just the plugins you’re actively using. Unused plugins and themes can still increase your attack surface, so WordPress also recommends removing software that isn’t needed.
Stolen passwords
A website can also be compromised without exploiting a technical vulnerability. If an attacker gets hold of an administrator’s password, they may be able to log into WordPress and make changes themselves. That’s why strong, unique passwords and two-factor authentication are so important.
It’s also worth thinking about how many people actually have access to your website. WordPress gives you options for different user roles for good reason. Administrator access is the top level of access and it allows someone to install plugins, edit code and, in some cases, easily undo years of careful work in just a few clicks. In the wrong hands, admin access can be damaging to any organisation, which means it needs to be handled responsibly. Over time, we’ve found that keeping admin access focused and intentional is one of the simplest ways to keep a website healthy and safe. You can read more about how we maintain responsibilities for Admin Access in this post.
Vulnerable custom code
WordPress itself isn’t the only thing to consider. Custom themes, plugins and integrations can introduce vulnerabilities too, particularly where they handle user input or interact with external systems. This is one reason it’s important to work with developers who understand secure WordPress development rather than simply installing a security plugin and considering the job done.
Compromised third-party services
Modern websites rarely operate in isolation. Analytics, donation platforms, forms, maps, video, CRM integrations and other third-party services can all introduce additional dependencies. That doesn’t mean you shouldn’t use them, it just means you should know what you’re adding, why it’s needed and who is responsible for keeping it secure.
What does malware actually do to a charity website?
Malware isn’t always obvious – sometimes a hacked website is taken offline or visibly defaced, but attackers may have other objectives. A compromised site might be used to:
- Redirect visitors to scam or phishing websites
- Inject spam links and pages for SEO manipulation
- Install malicious code
- Steal information
- Create a hidden backdoor for future access
- Send visitors to fraudulent adverts or downloads
- Damage the website’s reputation with search engines
Malware can be hidden in WordPress locations that aren’t necessarily visible in the normal plugin interface, demonstrating why simply checking that everything looks normal isn’t enough.
So how do you actually prevent it?
In short, there’s no single security plugin that makes a website secure. Good website security is about reducing the opportunities for an attacker and limiting the damage if something does go wrong.
1. Keep everything updated
WordPress core, plugins and themes should be kept up to date. Don’t let updates build up indefinitely, and don’t keep abandoned software installed just because you might use it again one day.
2. Remove what you don’t need
Every plugin adds functionality – and potentially another dependency to maintain. Use the plugins you genuinely need, choose reputable software that is actively maintained, and remove anything that’s no longer required.
3. Back up properly
Backups won’t prevent an attack, but they can make recovery dramatically easier. It’s important to make sure they’re updated and actually work, as a backup that has never been tested isn’t much of a recovery plan.
4. Monitor your website
Don’t wait for a visitor to tell you that your website has been hacked. Website monitoring and malware scanning can help identify suspicious changes and vulnerabilities. Your hosting environment should also provide appropriate security measures, and a web application firewall can provide another layer of protection by filtering malicious traffic before it reaches your website. This is something we check and maintain within our Hosting & Maintenance packages, which you can find out more about here.
5. Have a plan for when something goes wrong
Even well-maintained websites can be attacked. Know who is responsible for your website, who you contact if it is compromised and how you will restore it. The Charity Commission recommends that charities have a plan for responding to cyber attacks, act quickly when an incident occurs and keep a record of what happened.
Security is part of good website management
Website security isn’t something that should only be considered when a site gets hacked. It should be part of the ongoing maintenance of your website, particularly for charities. Your website might be your primary fundraising channel, the first place a potential supporter encounters your organisation and an important source of information for the people you work with. Keeping it secure is therefore about more than protecting a website, it’s about protecting trust.
Looking for malware removal or code clean up?
Frequently asked questions
Why are charity websites targeted by malware?
Charities can be attractive targets because they handle money, donations and sensitive information, while often relying on digital systems and networks of staff and volunteers. However, many attacks are automated rather than specifically aimed at a particular charity. Attackers scan websites for vulnerabilities they can exploit.
Are WordPress websites more vulnerable to malware?
WordPress itself has a dedicated security team and is regularly updated to address vulnerabilities. The bigger risk is often outdated WordPress core, plugins or themes, vulnerable third-party software, weak passwords or poor website maintenance. Keeping WordPress and its components updated is one of the most important security measures.
How can I protect my charity's WordPress website?
Keep WordPress, plugins and themes updated, remove unused software, use strong unique passwords and two-factor authentication, limit access (particularly to admins), maintain tested backups, use secure hosting and monitor the website for suspicious activity.
Can a WordPress security plugin prevent malware?
A security plugin or web application firewall can provide an important layer of protection, but it shouldn’t be treated as a complete security solution. Website security also depends on keeping software updated, controlling access, using secure hosting, maintaining backups and monitoring the site.
What should I do if my charity website has been hacked?
Don’t simply delete suspicious files and assume the problem is solved. A compromise may leave backdoors that allow attackers to regain access. Take the site offline if appropriate, contact your web developer or security provider, identify how the attacker gained access, restore from a known-clean backup where possible, update vulnerable software and change affected credentials. UK charities should also follow The Charity Commission’s guidance on responding to and reporting cyber attacks.
How often should a charity website be backed up?
There isn’t one frequency that works for every charity. The right approach depends on how frequently the website changes and how much data you could afford to lose. More important than a specific schedule is having automated backups, keeping copies separate from the live website and regularly testing that they can actually be restored. These are things that we maintain within our Hosting & Maintenance package – get in touch to find out more.
Does having an SSL certificate protect a WordPress website from malware?
No. HTTPS and an SSL/TLS certificate encrypt the connection between a visitor and your website, which is important for security, but they don’t protect WordPress from vulnerable plugins, stolen passwords or malicious code.
Is WordPress security the responsibility of the charity or the web agency?
It’s usually shared. A web agency can build, maintain and monitor a secure website, while the charity needs to manage content, passwords, internal processes and other parts of its wider digital environment. Agreeing who is responsible for updates, backups, monitoring and incident response is an important part of managing a website securely.
We design, build and maintain websites for charities. Get in touch today to find out how we can support your mission