A few simple checks to keep your charity safer online.
Article provided by VAC Members, Hebble & Stone CIC
Here’s a true story. A charity website went offline suddenly. No hack, no attack: they had simply forgotten to pay the hosting bill. Cue panic on the Board WhatsApp, until someone remembered that the only person with access to the hosting account was the volunteer who had set the site up in the first place. The Board ended up sending him credit card details over WhatsApp so he could log in and switch the service back on.
Nothing was stolen and no harm was done. But think about what that site was actually doing while it was dark. It’s where people found their opening hours, where supporters went to donate, where someone in need might have looked for help and found a blank page instead. That’s the real cost of these lapses. Not the technology, but the interruption to everything the charity exists to do.
Which is why this article isn’t really about websites. It’s about people, and one question worth asking out loud: who holds the keys to your organisation’s online presence? The answer might surprise you.
None of what follows costs anything. Most of it takes five minutes, and my hope is that by the end you’ll be slotting that five-minute check into your diary. Recurring, quarterly or yearly, up to you!
A single point of failure
Whoever built or looks after your website might reasonably hold access to it. That’s normal, often sensible even. But it should be a decision your charity made, not something that happened by default.
We (Hebble & Stone) were once asked to rebuild a charity’s website, only to discover that their previous agency was the sole holder of every login: hosting, domain, the lot. Nothing sinister, and the agency hadn’t done anything wrong. The charity simply had no idea. So here’s the question worth asking today: if you needed to get into your hosting account this afternoon, could you? Or does somebody else hold the keys to a service your whole organisation depends on?
Know what you’re actually paying for
A quick glossary, because these three get muddled constantly, even by tech-confident people:
- Domain: your web address itself (yourcharity.org). This is the thing people actually type, and what they land on when they search for you.
- Registrar: where you bought that domain, and who you pay to renew it each year.
- Host: a completely separate service. This is the actual server where your website’s files live and run. It’s easy to assume it’s the same thing as your domain, because they’re often bought from the same company, but they’re not.
We worked recently with a local club in Yorkshire who had faithfully paid their hosting bill every year, but not their domain renewal, never realising these were two different things with two different providers. The domain lapsed, went back on the open market, and was snapped up by a stranger who used it for their own unrelated site. Overnight, the address printed on their posters, their newsletters and their members’ bookmarks pointed somewhere else entirely. We got it back, but the clean-up is still ongoing.
The lesson: registrar, domain and hosting are usually separate services with separate credentials, and someone in your organisation needs to be able to reach all three.
Shared credentials
Another true story, and not even a rare one. A charity gave its volunteers a shared, low-permission login and kept the same password for simplicity. Somewhere along the way, that password leaked. Nobody knows exactly how, and none of the volunteers did anything wrong. But shared credentials, passed around informally like gossip, have a way of quietly escaping. The first anyone knew of it was spam appearing on the site: the charity’s own trusted web address, suddenly publishing nonsense to the very people it serves.
Sometimes a shared password is genuinely unavoidable, and that’s not a catastrophe. It just means you need to know who has it, and change it regularly, especially when someone moves on.
Who’s still on the list
We recently audited a charity’s website and found six admin accounts, eight duplicate logins (several people had two each), and around five accounts still active for people who had left months, sometimes years, earlier. Nothing bad had happened. Nobody had ever checked, that’s all. They were genuinely shocked when we showed them the list, and we brought it down from over a dozen users to just five.
The check costs nothing: how many people can log into our site, and should each of them still be able to? That’s the five minutes I mentioned at the start. And the same principle applies whenever anyone leaves, whether volunteer, trustee or staff member: their access should end when they do. If they come back, you can always make them a new login. What you can’t easily undo is a forgotten account being misused in your charity’s name.
Write it down, once a year
None of this needs a policy document. A simple list of who has access to what, where your domain and hosting sit, and where the logins live, reviewed once a year (your AGM is a natural moment), closes the loop on everything above.
The best technology in the world can’t protect your charity better than these basic checks. They cost nothing, they take minutes, and they keep the front door open for the people you’re actually here for.
Hebble & Stone
Hebble & Stone are a non‑profit Community Interest Company that specialise in helping small local groups and organisations (usually with fewer than 20 staff) strengthen their online presence.
They support everything from creating a friendly, welcoming visual identity to checking how accessible, secure, easy to find and well‑performing a website is, all with the aim of helping community organisations connect better with the people they serve.
