A Website Security Check for Small Museum and Nonprofit Teams

A small team can check its website’s security in about 30 minutes by answering four questions: who has administrator access, when the website was last updated, whether backups actually restore, and whether forms are protected from spam. None of these require technical skills, and each one shows where real risk sits.

Why a security check belongs on your October calendar?

October is Cybersecurity Awareness Month, a good reminder to look at something most small organizations rarely review. Museums and nonprofits often assume they are too small to be a target. Unfortunately, most attacks are not personal.

Automated programs scan the web constantly, looking for outdated software, weak passwords, and forgotten accounts. They do not check whether a website belongs to a global brand or a community museum. They look for an open door.

For a mission-driven organization, the cost of a compromised website is rarely just technical. Donors see warning pages instead of your donate button. Visitors receive spam that appears to come from you. Search engines may flag the site, and rebuilding trust takes longer than restoring files.

The good news is that most risk comes from a few simple gaps. A staff member who is not technical can find them in one sitting. You do not need to fix everything yourself; you need to know what to bring to your web team.

Set aside 30 minutes, open your website’s admin area, and work through the four checks below.

Who has administrator access to your website?

Start with the people who can change everything. In WordPress, open the Users page and filter by Administrator. On other platforms, look for a section called Users, Team, or Permissions.

For each administrator, ask three questions:

1. Does this person still work with us?
2. Do they need full control, or would a more limited role do?
3. Is this account tied to a real person, not a shared login like “admin” or “office”?

This is one of the most common things I find when I take over a museum or nonprofit website. Former staff, past volunteers, and agencies from years ago still have active accounts, often with full control. Each forgotten account is a door someone else can try.

Shared logins create a second problem. When several people use one account, no one knows who changed what, and removing one person’s access means changing the password for everyone.

As a rule, keep administrator access to two or three named people, including your web partner. Give everyone else an editor or author role that lets them update content without changing settings or plugins. Turn on two-factor authentication for every administrator if your platform supports it.

Write down who has access and why. This list becomes part of your ownership records, which matter even more when staff change. For more on this, read Who Actually Owns Your Website.

When was the website last updated?

Software updates close security holes as they are discovered. A website that has not been updated in months is running with known weaknesses that automated attacks are built to find. In 2025, plugins accounted for 91 percent of newly reported WordPress vulnerabilities, according to Patchstack’s annual security report.

If your website runs on WordPress, open the Dashboard and look at Updates. Note three things: whether WordPress itself is current, how many plugins need updating, and whether any plugins are marked as no longer supported by their developers. Then check the Plugins page for anything installed but inactive.

Many teams assume a deactivated plugin is harmless. It isn’t. Its files stay on the server, where outdated code can still be exploited, and its settings and data often stay in the database, taking up space and slowing things down over time.

If you no longer use a plugin, ask your web team to delete it, not just switch it off, and to clean up any data it leaves behind.

If your website runs on a hosted platform such as Squarespace or Wix, the platform handles core updates for you. Your responsibility shifts to third-party add-ons, connected apps, and the accounts that control them.

What should concern you:

• Updates waiting for more than a month
• Plugins that have not been updated by their developers in over a year
• No one on staff knowing who is responsible for updates

Plugin developers release updates at different times, so new ones appear throughout every month. That is why updates should be a monthly habit, with someone responsible for them. Three months is the longest a website should ever go without updates, and even that leaves it exposed for too long.

One rule has no exceptions: back up the database before every update to plugins, themes, or WordPress itself. For larger changes, such as a major version update or a new theme, back up the entire website. Updates can occasionally break a page, and a fresh backup is what lets you undo it in minutes instead of days.

Would your backups actually restore?

Most organizations believe they have backups. Fewer have ever tested one. A backup only protects you if it is complete, recent, stored somewhere separate from the website, and can actually be restored.

Ask your web team or hosting company four questions:

1. How often is the website backed up?
2. Where are the backups stored, and is that separate from the website’s server?
3. How long are backups kept?
4. When was the last time a backup was restored, even as a test?

If no one can answer the last question, that is your most important finding. A backup that has never been tested is a hope, not a plan.

A good arrangement backs up the website at least daily or weekly, depending on how often it changes, and keeps copies in a separate location. Once a month, a backup should be restored on a separate test copy of the website, never the live one, to confirm it actually works.

Backups also matter beyond attacks. They protect you from a failed update, an accidental deletion, or a hosting problem. When something goes wrong, the question every leader asks is, “How quickly can we get back?” A tested backup is the answer.

Are your forms protected from spam?

Contact, volunteer, newsletter, and donation forms are among the most common entry points for abuse. Unprotected forms fill your inbox with spam, can be used to send unwanted email in your name, and can damage your email reputation so real messages stop reaching people.

Start by looking at what your forms have received in the last month. If your team regularly deletes junk submissions, the forms need better protection.

Then check three things:

• Spam protection: Does each form use a tool such as a CAPTCHA, a hidden honeypot field, or a filtering service?
• Delivery: Submit each form yourself and confirm the message arrives where it should.
• Email setup: Ask your web team whether your domain’s email authentication records (SPF, DKIM, and DMARC) are in place. These help prove that email from your domain really comes from you.

Forms also collect personal information. Make sure submissions are not stored longer than needed, and that only the right people can see them.

What to do with what you find?

You now have a short list of findings. Not all of them need the same response.

Fix this week:

• Remove or downgrade administrator accounts that are no longer needed
• Replace shared logins with named accounts
• Turn on two-factor authentication for administrators

Bring to your web team this month:

• Pending updates and unsupported plugins
• Deactivated plugins that should be deleted
• Backup questions no one could answer
• Forms receiving spam or failing to deliver
• Missing email authentication records

The 30-minute checklist

1. List every administrator and confirm each one still needs access.
2. Note pending updates, unsupported plugins, and deactivated plugins.
3. Ask when a backup was last restored.
4. Submit every form and check what arrives.
5. Write a one-page summary and share it with your executive director.

Security is not a project with an end date.

It is part of stewardship: the steady care that keeps a website trustworthy for the people who rely on it. For a broader view, read Why Website Security Planning Protects Institutional Trust and Security, Accessibility, and SEO Aren’t Separate.

If your team does not have the time to run these checks every month, the Sunlight Monthly Retainer covers them. Every level includes updates, security monitoring, regular backups, uptime monitoring, and a monthly summary, so problems are found before your donors find them.

Frequently Asked Questions