For the person who runs the church's email and website
Church security, without the jargon
Most church security problems are not exotic. They are an email that looks like it came from the pastor, a password shared by five people, and software nobody has updated. This guide covers those, and what to do about the scary headlines.
What we found.
We checked the public records of 157 church web domains in one United Methodist conference, October 2026. Of the 113 that receive email, 101 (89%) have nothing published that stops someone sending forged mail from the church's address. It is a free fix. How we know.
Start here
Check your church's email protection → Type your web address and see in seconds whether your church can be impersonated. It uses only public records, and nothing you type is stored.
The guides
Stop people impersonating your church
Set up SPF and DMARC, in Google Workspace or Microsoft 365, without breaking your own mail.
Scams that target churches
The "pastor needs a favor" gift-card email, and a simple rule that defeats it.
Passwords and two-step sign-in
A password manager, two-step sign-in on the accounts that matter, and what to do about shared logins.
Your website
HTTPS, certificates, and WordPress upkeep. What actually matters and what is noise.
Church management software
Realm, Planning Center, Shelby, PowerChurch: where your members' sensitive records live, and how to protect them.
Outside your control
Hosting, vendor and software problems you can't fix, and how to stay safe anyway.
People's data
Directories, prayer lists, and removing access when someone leaves.