Outside your control
What's outside your control, and how to stay safe anyway
Some of the biggest security news has nothing to do with anything your church did: a flaw in software your website uses, a breach at a company that holds your members' records. You can't fix those. You can limit how much they cost you.
Four things you can't fix, and what you can do
- A flaw in software your website or host uses
- Example: the PHP flaws of October 2026. The fix comes from the software's maker and your host. You can know what you're running, keep your own parts updated (WordPress, plugins), choose a host that patches promptly, and know whom to call. Builders like Wix or Squarespace carry less of this burden for you.
- A breach at a vendor that holds your members' data
- Your giving platform, church software, newsletter service or website host can be breached. Hold less data with each of them, turn on two-step sign-in for every account, and know what each vendor would tell you. Ask now how they notify customers of an incident.
- A password leaked from some other site
- Your volunteers' reused passwords end up in breach lists. A different password for every account, and two-step sign-in, mean a leak elsewhere doesn't open your church. Passwords.
- A lapse in a domain, certificate or subscription
- An expired domain can be bought by someone else, who then receives mail sent to your old address. An expired certificate frightens visitors. Put renewals in a shared calendar, with someone besides the one person who set them up.
A short readiness list
- Know what you have. Write one page: what the website runs on and who hosts it, who runs your email, which software holds member and giving records, who the domain is registered with, and the person responsible for each.
- Know whom to call. A phone number for your host, your domain registrar, and your church software support, kept somewhere other than the website and the email system they protect.
- Keep the keys with more than one person. Recovery codes and admin logins in a shared password manager, with at least two trusted people.
- Keep backups away from the thing they back up. A site backup stored only on the same host won't help if the host is compromised.
- Decide in advance who is told. If a vendor reports a breach of member data, who tells the pastor, and who tells the people affected? Most U.S. states have laws requiring notice when personal information is breached; ask your conference or a lawyer what yours requires.
Reading the news without panicking
When a big security story breaks, three questions sort it out:
- What software is it in? If you don't use it, it's not about you.
- Do we run it, or does a vendor? If a vendor runs it, your job is to confirm they've acted, not to fix it.
- Is there an official fix, and from whom? Updates come from the software's maker or your host, never from an email asking you to click or pay.