Website
Your church website
A church website is rarely where the serious harm happens, but a broken or hijacked one is embarrassing, can send visitors to a scam, and can be a way into other accounts. A short list covers what matters.
What we found
- no working HTTPS
- 14%
- self-hosted WordPress
- 17%
- on a builder like Wix or Squarespace
- 30%
Of 135 sites with working HTTPS, 76 also tell browsers to always use it. None of the 157 published a security.txt contact file. Of the 22 sites without working HTTPS, some were dead domains and some had a certificate problem rather than a missing site. Method.
Find out what you have
This decides everything else. Ask whoever built the site, or look at the hosting bill:
- A website builder (Wix, Squarespace, Weebly, GoDaddy's builder)
- The company runs the servers and patches them. Your job: strong password, two-step sign-in, keep the subscription paid.
- WordPress on shared hosting
- The host runs the server; you keep WordPress and its plugins updated, and choose a current PHP version in the hosting control panel.
- A site a volunteer built and hosts somewhere
- Someone has to patch it, and it needs a name attached to that job.
- Don't know
- Find out this month. Not knowing is the most common and riskiest answer.
Do this week
- Visit your site with http:// in front of the address. It should switch to https:// and show a padlock with no warning. If it doesn't, ask your host or builder to fix it. It is usually a setting.
- If you run WordPress: log in and apply every update (WordPress itself, plugins, theme). Delete plugins you don't use. Take a backup first, if your host offers one.
- Turn on two-step sign-in for the website admin login and the hosting account.
- Find the date your domain name and your certificate expire (your host or registrar shows both) and put a reminder in a shared calendar a month before.
Do this year
- If you run WordPress, check the PHP version your host uses. PHP 8.2 stops getting security fixes on 31 December 2026; PHP 8.1 and older already have. See the PHP news page.
- Keep up regular backups, stored away from the site itself, and test that you can restore one.
- Consider whether a self-hosted site is the right choice. If nobody at the church maintains it, a managed builder carries less risk.
What about "security headers"?
These are instructions a website sends to a visitor's browser, such as "don't let other sites embed this page." They help, but they are refinements. Missing headers are a sign of basic upkeep not done, not proof a site can be broken into. If your host or builder has a setting for them, turn it on; otherwise it is not where to spend your time first.