Estimated reading time: 11 minutes
Key Takeaways
- Non-profits and associations hold valuable donor, member, payroll and client data, and attackers see small IT teams as easy entry points.
- Turning on multi-factor authentication for every key login stops most common attacks, and you can do it today.
- Your website needs its own security plan: tested updates, monitoring, alerts and a named person who responds when something breaks at 3am.
- Follow the 3-2-1 backup rule and test your backups every quarter so they work when you need them.
- Cyber insurance and a written incident response plan decide how fast you recover after a breach.
Table of Contents
October is Cybersecurity Month, so it’s the perfect time to ask a simple question: If someone on your team clicked the wrong link tonight, how long would it take you to find out?
For many non-profits and associations, the honest answer is “we’re not sure.” The website launched years ago, and nobody has looked under the hood since. Five people share one login. The backup drive sits untested in a drawer. None of this feels urgent until the day a donor calls to ask why your organization emailed them a strange invoice.
This post brings together two episodes of the Non-Profit Digital Success Podcast: episode 140 on cybersecurity basics and episode 145 on website security. You’ll get the practical steps, with no fearmongering and no tech overwhelm.
Why Attackers Target Mission-Driven Organizations
Attackers go where the data is. Non-profits store donor records, payroll details and sometimes health or client information. Associations store member profiles, payment history and professional credentials. That data has real value on the black market.
At the same time, most mission-driven organizations run with small IT budgets, a part-time tech person or a helpful volunteer, and systems that haven’t been patched in a while. They also run on trust. Staff open emails from people they know and help whoever asks. Criminals call these organizations soft targets.
Downtime hurts you more than it hurts a corporation. Your organization depends on public trust and continuity, and attackers know it.
A breach can lead to reputational damage, legal exposure and donor or member mistrust, even when the amount of data lost looks small.
5 Hidden Mistakes That Leave Your Organization Exposed
1. Assuming you’re too small to be a target
Most attacks are “spray and pray.” Criminals send hundreds of thousands of emails and wait for 1 or 2 people to hand over their passwords. They don’t need to know your name to find you.
New Book from David PisarekSteal 101 Proven AI Prompts for Non-Profits and AssociationsGrant proposals taking three days? Member renewals slipping through the cracks? The AI Advantage gives you a copy-paste prompt for every one of its 101 strategies. Works with any AI tool you already use.Get Instant Access for $37
2. Sharing logins and reusing passwords
An info@ inbox that 6 people sign into, or a single WordPress admin account for the whole communications team, makes it impossible to know who did what. If your email, website and financial platform all use the same password, one leak opens every door.
3. Skipping updates and patches
Software vendors release patches to close security holes. When those patches sit unapplied for months, attackers walk through holes the vendor already fixed.
4. Leaning on volunteers for IT
Volunteers bring generous help, and they also come and go. When the person who set up your systems moves on, their knowledge (and sometimes their access) goes with them.
5. Having no plan for when something goes wrong
Without a written response plan, a suspected breach turns into a panicked scramble. Who do you call? Who locks down accounts? Who tells your board, your donors or your members?
5 Proven Fixes That Protect Your People and Logins
1. Turn on multi-factor authentication everywhere
Multi-factor authentication (MFA, also called 2FA) asks for a short code from your phone on top of your password. Apps like Microsoft Authenticator and Google Authenticator generate a fresh code every 30 seconds or so. Treat every account like your personal bank account.
Here’s why it matters. One of our clients had over $100,000 transferred from their Canadian bank account because they hadn’t enabled MFA on their banking login. They reported it to the RCMP, recovered the money, and won’t make that mistake again. Another client clicked a fake “secure document” link and typed in their email password. MFA stopped the criminals cold because they didn’t have the code.
Turning on MFA for your key logins stops roughly 90% of common attacks. If you do only one thing this month, do this.
2. Use a password manager
A password manager creates long, unique passwords so nobody has to memorize them or stick them on a Post-it under the keyboard. We use Bitwarden, and 1Password is another popular option. Before you choose one, check the company’s breach history.
If you require password changes, once a year is a reasonable minimum, and every 6 months suits organizations with sensitive data. Make sure people change the whole password. Adding a “1” or “!” to the end does nothing against modern cracking tools.
3. Give people only the access they need
Does every staff member need administrator access to your WordPress site, or would an Editor or Author role do the job? Does your whole management team need access to the entire network, or one shared folder? Review access once a year. You’ll likely find accounts for volunteers who left two years ago.
4. Build an offboarding checklist
When someone leaves, voluntarily or not, you need a list of every system to revoke: email, phone extension, website, donor database, membership platform, shared drives. If a former employee walked back into your office tomorrow, could they log in?
5. Train your team to spot phishing
Most incidents start with a human click. A typical scam looks like an “outstanding invoice” with a PDF that leads to a fake Microsoft or Google sign-in page. Teach your team these habits:
- Check the sender’s email address, not only the display name.
- Hover over links to see where they go before clicking.
- Be suspicious of invoices you weren’t expecting, especially if you don’t work in finance.
- Call the vendor on a known phone number to confirm. Replying by email might tip off a criminal who already controls that inbox.
That last point matters more than most people realize. Once attackers get into an email account, they often set up hidden rules that forward incoming messages to an outside Gmail or Hotmail address and delete them from your inbox. The real account owner never sees a thing.
Make cybersecurity part of your annual training.
Create a short course in your learning management system or gather everyone in a room (or a Zoom room) once a year, and have each person sign off. Some organizations go further and send test phishing emails to see who clicks.
6 Urgent Website Security Checks
Your logins protect your website, and your website protects your donations, member data and reputation. Many organizations we talk to have sites that are 10 or more years old, with email lists scattered across a dozen Excel files. Here’s where to start.
1. Know who owns and controls your website
Write down who has access to your server, hosting account, database, SFTP, content management system and form submissions. Then look at what your forms collect. Store personal health information or other identifying data securely and encrypted.
Never store credit card numbers in a Word document or spreadsheet. We met an organization a couple of months ago doing exactly that. It’s a breach waiting to happen.
2. Test updates before they hit your live site
Clicking “update all” in WordPress works fine most of the time, maybe 85% of the time. The other 15% leaves you with a broken site, a page stuck in maintenance mode or errors popping up for visitors. At Wow Digital, we follow this process for every client:
- Clone the website into a staging environment.
- Run the updates on the staging copy.
- Thoroughly test the front end and back end.
- Back up the live site.
- Apply the updates to the live site and test again.
Document your own process as a standard operating procedure so anyone on your team can follow it. When a major WordPress vulnerability surfaced this past July, we contacted every support client the same day, plus former clients who had opted out of support.
3. Install malware monitoring and firewall protection
We install Wordfence on every WordPress site we manage. It monitors your plugins, theme, WordPress core and files, and alerts you to threats. The paid version sends alerts right away, while the free version can lag by up to 30 days. MalCare is another solid option, and some of its tiers clean up malware automatically.
Why file monitoring matters: attackers often sneak a small script onto a site through an outdated plugin. On one client’s site, that script built an entire fake online store selling knock-off purses and electronics, which drew hundreds of thousands of visits a day. We cleaned it up and patched it, and the site has stayed clean since.
4. Set up alerts that reach you after hours
If your site gets compromised at 11pm, how will you find out? Most monitoring tools send an email, and nobody checks email at midnight. A free tool like IFTTT can turn specific security emails into a text message so the right person sees it. In Ontario, staff have the right to disconnect, so agree in advance who receives these alerts and what happens next.
5. Watch your traffic for strange spikes
Google Analytics tracks only pages with your tracking code, so a hidden phishing page or rogue store won’t show up there. Cloudflare sits in front of your website and sees all traffic. A sudden spike to pages you don’t recognize is a red flag worth investigating. Cloudflare’s free tier also acts as a content delivery network, blocks malicious bots, stops DDoS attacks, and covers almost all of our clients. On AWS, Amazon CloudFront offers similar monitoring.
6. Follow the 3-2-1 backup rule and test it
Backups are your last line of defence against ransomware, accidental deletion and hardware failure. Keep 3 copies of your data, in 2 different formats, with 1 copy stored off-site (in the cloud, with your IT provider or in a bank safety deposit box). Encrypt every portable drive, and never tape the password to the drive.
Test your backups monthly or quarterly. A backup that won’t restore is no backup at all.
Once your process runs smoothly, consider automating the schedule and status checks.
Your 30-Day Cybersecurity Month Action Plan
You don’t need a massive budget to make real progress before October ends. Most of this takes about 2 hours of emails and conversations.
1. Turn on MFA today
Start with email, banking, your website admin, your donor or membership database, and social media accounts.
2. Review who has access to what
Ask whether each person needs that level of access or has it only for legacy reasons. Deactivate anyone who has left.
3. Confirm your website update and monitoring process
Whether your website is managed internally or by a partner, ask how they test updates and how fast they hear about vulnerabilities. Keep it a friendly conversation, not a confrontation. If nobody owns this, find an expert who can, and put a service level agreement in place.
4. Check your cyber insurance
You likely carry liability and errors-and-omissions coverage. Cyber insurance covers you if your email, data or systems get compromised, and insurers can connect you with investigators and remediation experts fast. Those experts help you lock things down, measure how far the breach spread, file any required reports, and notify affected people.
Why Wow Digital
At Wow Digital, we have helped non-profits and associations across Canada and the United States with their websites for years, with over 320 projects completed. We monitor, update and protect the sites we support using the same staging, testing and alert process described above. Powered by people. Accelerated by AI.
- If you’re not sure your website is secure, properly maintained or being monitored, book your free 20-minute consult. We’ll review your setup, tell you what’s at risk and give you a clear plan showing what needs attention now and what can wait.
Frequently Asked Questions
When is Cybersecurity Month?
Cybersecurity Awareness Month takes place every October in both Canada and the United States. It’s a good annual reminder to review your passwords, access, backups and website security.
What is the single most important cybersecurity step for a non-profit or association?
Turn on multi-factor authentication for every key login, starting with email, banking and your website. It stops roughly 90% of common attacks and costs nothing.
How often should we update our WordPress website?
Review updates as they’re released and apply them on a weekly, monthly or quarterly plan based on risk. Annual updates leave you exposed for far too long. Always test updates on a staging copy before applying them to your live site.
Do small non-profits need cyber insurance?
Yes. Most attacks are automated and don’t care about your size. Cyber insurance helps cover the cost of investigation, remediation and notifying people whose data was exposed.
Should we handle website security internally or hire a partner?
Either works as long as the person responsible has real web security expertise and stays on top of patches and vulnerabilities. If you don’t have that expertise in-house, a partner can provide monitoring and support.
What is the 3-2-1 backup rule?
Keep 3 copies of your data, in 2 different formats, with 1 copy stored off-site. Test your backups at least quarterly to confirm you can restore them.
0 Comments